How can you extract specific fields like TargetUserName or IpAddress from Event ID 4624 logs using EventLogSession?

The article recommends converting log entries to XML format using `eventData.ToXml()`, then parsing the XML to extract fields by fixed offset positions. For example, `data[4]` gives TargetUserSid and `data[18]` gives IpAddress. Filtering criteria include a minimum length check on these fields to isolate valid login events. This approach is detailed in the [EventLogSession implementation section](/news/penetration-basics-obtaining-domain-user-login-information#0x02-implementation-via-eventlogsession).