<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
  <Provider Name="Application" /> 
  <EventID Qualifiers="0">1001</EventID> 
  <Level>4</Level> 
  <Task>0</Task> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2015-07-12T21:26:07.000000000Z" /> 
  <EventRecordID>86554</EventRecordID> 
  <Channel>Application</Channel> 
  <Computer>YOUR_COMPUTER</Computer> 
  <Security /> 
  </System>
  <EventData>
       <Data>DeskTop Agent: mike|Observer Username: miguel|File name/s with extension: 10|Action Performed: e.g. Copied project documents from C: drive to F: (USB Drive)|Explanation: e.g. To allow work on project document from another workstation.|Machine Name: R123456|IP Address: 192.168.0.1|App1Installed: 1|App2Installed: 1</Data> 
  </EventData>
</Event>