Analyzing event logs

There are several ways to work with Windows event logs using PowerShell. Of course, you can always forward your event logs to the SIEM of your choice, but sometimes, it happens that you want to directly analyze the event logs on a certain machine. For this use case, it makes sense to look at the available options that come with PowerShell.

The easiest option if you just want to analyze events or create new events is the *-WinEvent cmdlets, which are still available in PowerShell Core 7. You can use Get-Command to find all available cmdlets:

Figure 4.10 – The available *-WinEvent cmdlets

In PowerShell 5.1, there was also the possibility of using the *-EventLog cmdlets, but they were removed in PowerShell Core 6 and above. Since PowerShell 5.1 is installed by default on all Windows 10 operating systems, I refer to *-EventLog here. Again, use Get-Command to find all available cmdlets:

Figure 4.11 ...