#pragma namespace ("\\\\.\\root\\subscription")
// Works on Windows XP and 2003 only


instance of SMTPEventConsumer as $HoneyDropConsumer
{
    Name = "HoneyPotFilter";
    ToLine="administrator@example.com";
    ReplyToLine="administrator@example.com";
    SMTPServer="mail.example.com";
    Subject = "Honey drop warning";
    Message = "Warning: An attempt was made to login to the dcsadmin account.";
    
};

instance of __EventFilter as $HoneyDropFilter
{
    Name = "LoginEventFilter";
    Query = "SELECT * FROM __InstanceCreationEvent WITHIN 5 "
        "WHERE TargetInstance ISA \"Win32_NTLogEvent\" "
        "AND TargetInstance.EventCode = \"529\"";
    QueryLanguage = "WQL";
    EventNamespace = "root\\cimv2";
};

instance of __FilterToConsumerBinding
{
    Filter = $HoneyDropFilter;
    Consumer = $HoneyDropConsumer;
};