Hacker News Reader

It's not a deal-breaker, but <key>value</key> would indeed be nicer.

For a human to read maybe, but for some generic parsing where there are many diferent keys, I would say <data Name="key">value</data> is indeed better, also makes an XSD easier to create, if needed.

That definitely goes towards the "good reason not to use XML" part of what I said, imo ;)

This is a limitation of the way ETW does structured logging, rather than a design decision in sysmon itself.

I can understand why they wouldn't have wanted to create an XSD covering all of the possible keys.

Free-form tag names invariably leads to conflicts with previously defined tags that are used for other purposes. I don't see how not wanting an unbounded number of different tags would be antithetical to use of XML.

Couldn't that be solved with xmlns?

definitely :)