Today I needed to filter a security log to discover the source location of a particular user logging in.  It took me a bit of digging to discover the appropriate XML search filter, so I include it here for future reference:

<QueryList>
<Query Id=”0″ Path=”Security”>
<Select Path=”Security”>* [EventData[Data[@Name=’targetusername’]=’username’] and  EventData[Data[@Name=’LogonType’]=’7′] and System[(EventID=4624)]]</Select>
</Query>
</QueryList>