Glossary
WQL (WMI Query Language)
The SQL-like language WMI uses for data and event queries; event filters use it to describe the event that triggers a subscription.
WQL is WMI's query language, a subset of SQL. Data queries read instances (SELECT * FROM Win32_Process); event queries, used by event filters, describe changes: SELECT * FROM __InstanceCreationEvent WITHIN 15 WHERE TargetInstance ISA 'Win32_LogonSession'.
WITHIN n sets a polling interval in seconds. Intrinsic events (__InstanceCreationEvent, __InstanceModificationEvent, __InstanceDeletionEvent) watch any class; extrinsic ones such as Win32_ProcessStartTrace come from providers. Reading the query tells you when a subscription fires.