Журналы событий Windows

$f=@{LogName="System";ProviderName="Service Control Manager";StartTime=(Get-Date).AddHours(-1)}
Get-WinEvent -FilterHashtable $f -MaxEvents 100

$result = Get-WinEvent -LogName System -MaxEvents 20 -Oldest
$shape = if($null -eq $result){'<null>'}elseif($result -is [array]){'array'}else{$result.GetType().Name}
[pscustomobject]@{ Shape=$shape; Values=@($result) }

Get-WinEvent -LogName System -MaxEvents 1 | Select-Object Id,ProviderName,TimeCreated,Properties

Get-WinEvent -LogName System -FilterXPath "*[System[(EventID=7036) and TimeCreated[timediff(@SystemTime) <= 3600000]]]"

Get-WinEvent -LogName Security -FilterXPath "*[EventData[Data[@Name='TargetUserName']='alice']]"

$user="alice" # предварительная валидация перед сборкой XPath
$valueType = if($null -eq $user){'<null>'}else{$user.GetType().FullName}
[pscustomobject]@{ Value=$user; Type=$valueType; Count=@($user).Count }

$events|Select-Object @{n="Utc";e={$_.TimeCreated.ToUniversalTime()}},MachineName,Id|Sort-Object Utc

$result = $e|Select-Object LogName,RecordId,TimeCreated
$resultType = if($null -eq $result){'<null>'}else{$result.GetType().FullName}
[pscustomobject]@{ Result=$result; Type=$resultType; Count=@($result).Count }

$bookmark=$event.Bookmark
$valueType = if($null -eq $bookmark){'<null>'}else{$bookmark.GetType().FullName}
[pscustomobject]@{ Value=$bookmark; Type=$valueType; Count=@($bookmark).Count }

$xml=[xml]$event.ToXml();$xml.Event.System.Correlation.ActivityID
$valueType = if($null -eq $xml){'<null>'}else{$xml.GetType().FullName}
[pscustomobject]@{ Value=$xml; Type=$valueType; Count=@($xml).Count }

$result = $events|Group-Object MachineName,ProcessId
$items = @($result)
[pscustomobject]@{ Count=$items.Count; First=$items | Select-Object -First 1; IsNull=($null -eq $result) }

$result = $event.Properties | ForEach-Object Value
$summary = [ordered]@{ IsNull=($null -eq $result); Count=@($result).Count }
if($null -ne $result){$summary.Type=$result.GetType().FullName};[pscustomobject]$summary

Get-WinEvent -ListLog * | Where-Object LogName -eq $log | Select-Object LogName,IsEnabled,RecordCount

$result = [xml](Get-WinEvent -LogName System -MaxEvents 1).ToXml()
$items = @($result)
[pscustomobject]@{ Count=$items.Count; First=$items | Select-Object -First 1; IsNull=($null -eq $result) }

# Сценарий для ревью: Message пустое на аналитическом сервере.
$events = Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=(Get-Date).AddHours(-1)} -MaxEvents 50
$events | Select-Object TimeCreated,Id,RecordId,ProviderName,Message,@{n='Xml';e={$_.ToXml()}}
$events | Export-Clixml .\event-snapshot.clixml

# Сценарий для ревью: Сборщик читает Security log.
$events = Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=(Get-Date).AddHours(-1)} -MaxEvents 50
$events | Select-Object TimeCreated,Id,RecordId,ProviderName,Message,@{n='Xml';e={$_.ToXml()}}
$events | Export-Clixml .\event-snapshot.clixml

$safeMessage=$event.Message -replace "(?i)(token|password)=\S+",'$1=[REDACTED]'
$valueType = if($null -eq $safeMessage){'<null>'}else{$safeMessage.GetType().FullName}
[pscustomobject]@{ Value=$safeMessage; Type=$valueType; Count=@($safeMessage).Count }

# Сценарий для ревью: Журнал может быть очищен злоумышленником.
$events = Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=(Get-Date).AddHours(-1)} -MaxEvents 50
$events | Select-Object TimeCreated,Id,RecordId,ProviderName,Message,@{n='Xml';e={$_.ToXml()}}
$events | Export-Clixml .\event-snapshot.clixml