MSI-Packages.xml

<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
  <SubscriptionId>MSI-Packages</SubscriptionId>
  <SubscriptionType>SourceInitiated</SubscriptionType>
  <Description>MSI Packages Installation, User Applications, Windows Update Installed Events.</Description>
  <Enabled>true</Enabled>
  <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
  <ConfigurationMode>Custom</ConfigurationMode>
  <Delivery Mode="Push">
    <Batching>
      <MaxItems>5</MaxItems>
      <MaxLatencyTime>300000</MaxLatencyTime>
    </Batching>
    <PushSettings>
      <Heartbeat Interval="1800000"/>
    </PushSettings>
  </Delivery>
  <Query><![CDATA[
    <QueryList>
      <!-- Inspired by Microsoft Documentation and/or IADGOV -->
      <Query Id="0" Path="Application">
        <!-- MSI Installer Notifications -->
        <Select Path="Application">*[System[Provider[@Name='MsiInstaller'] and (EventID=1022 or EventID=1033)]]</Select>
        <!-- The change status of a Update Package -->
        <!-- Installed Update Packages -->
        <Select Path="Setup">*[System[Provider[@Name='Microsoft-Windows-Servicing'] and EventID=2 and Level=0]] and *[UserData[CbsPackageChangeState[IntendedPackageState='Installed']]] </Select>
        <!-- User Application Installation Activities -->
        <Select Path="Microsoft-Windows-Application-Experience/Program-Inventory">*[System[Provider[@Name='Microsoft-Windows-Application-Experience'] and (EventID=903 or EventID=904)]]</Select>
        <!-- User Application Update -->
        <Select Path="Microsoft-Windows-Application-Experience/Program-Inventory">*[System[Provider[@Name='Microsoft-Windows-Application-Experience'] and (EventID=905 or EventID=906)]]</Select>
        <!-- User Application Removed Activities -->
        <Select Path="Microsoft-Windows-Application-Experience/Program-Inventory">*[System[Provider[@Name='Microsoft-Windows-Application-Experience'] and (EventID=907 or EventID=908)]]</Select>
        <!-- Applications Inventory -->
        <Select Path="Microsoft-Windows-Application-Experience/Program-Inventory">*[System[Provider[@Name='Microsoft-Windows-Application-Experience'] and EventID=800]]</Select>
      </Query>
    </QueryList>]]></Query>
  <ReadExistingEvents>true</ReadExistingEvents>
  <TransportName>http</TransportName>
  <ContentFormat>RenderedText</ContentFormat>
  <Locale Language="en-US"/>
  <LogFile>WEC5-MSI-Packages</LogFile>
  <AllowedSourceNonDomainComputers/>
  <AllowedSourceDomainComputers>O:NSG:NSD:(A;;GA;;;DC)(A;;GA;;;NS)(A;;GA;;;DD)</AllowedSourceDomainComputers>
</Subscription>