update evtx page with link to doc