CmdID / PowerShell / Cmdlets / Get
Get-EventLog
Gets the events in an event log, or a list of the event logs, on the local computer or remote computers. PowerShell reference
From the PowerShell reference 14 parameters 2 Sigma rules look for it
What it does
Gets the events in an event log, or a list of the event logs, on the local computer or remote computers. The Get-EventLog cmdlet gets events and event logs from local and remote computers. By default, Get-EventLog gets logs from the local computer. To get logs from remote computers, use the ComputerName parameter. You can use the Get-EventLog parameters and property values to search for events. The cmdlet gets events that match the specified property values. PowerShell cmdlets that contain the EventLog noun work only on Windows classic event logs such as Application, System, or Security. To get logs that use the Windows Event Log technology in Windows Vista and later Windows versions, use Get-WinEvent. NOTE: Get-EventLog uses a Win32 API that is deprecated. The results may not be accurate. Use the Get-WinEvent cmdlet instead.
Get-EventLog [-LogName] <String> [-ComputerName <String[]>] [-Newest <Int32>] [-After <DateTime>] [-Before <DateTime>] [-UserName <String[]>] [[-InstanceId] <Int64[]>] [-Index <Int32[]>] [-EntryType <String[]>] [-Source <String[]>] [-Message <String>] [-AsBaseObject] [<CommonParameters>]Get-EventLog [-ComputerName <String[]>] [-List] [-AsString] [<CommonParameters>]Get event logs on the local computer
Get-EventLog -ListIdentifyTrips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)
Get recent entries from an event log on the local computer
Get-EventLog -LogName System -Newest 5IdentifyTrips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)
Find all sources for a specific number of entries in an event log
$Events = Get-EventLog -LogName System -Newest 1000
$Events | Group-Object -Property Source -NoElement | Sort-Object -Property Count -DescendingIdentifyTrips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)
Get error events from a specific event log
Get-EventLog -LogName System -EntryType ErrorIdentifyTrips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)
Get events from an event log with an InstanceId and Source value
Get-EventLog -LogName System -InstanceId 10016 -Source DCOMIdentifyTrips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)
Get events from multiple computers
Get-EventLog -LogName System -ComputerName Server01, Server02, Server03IdentifyTrips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)
Get all events that include a specific word in the message
Get-EventLog -LogName System -Message descriptionIdentifyTrips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)
Display the property values of an event
$A = Get-EventLog -LogName System -Newest 1
$A | Select-Object -Property *IdentifyTrips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)
Get events from an event log using a source and event ID
Get-EventLog -LogName Application -Source Outlook | Where-Object {$_.EventID -eq 63} |
Select-Object -Property Source, EventID, InstanceId, MessageIdentifyTrips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)
Get events and group by a property
Get-EventLog -LogName System -UserName NT* | Group-Object -Property UserName -NoElement |
Select-Object -Property Count, NameIdentifyTrips 1 Sigma rule: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)
Its page in the reference: Get-EventLog.
Parameters
-AfterGets events that occurred after a specified date and time. The After parameter date and time are excluded from the output. Enter a DateTime object, such as the value returned by the Get-Date cmdlet.-AsBaseObjectIndicates that this cmdlet returns a standard System.Diagnostics.EventLogEntry object for each event. Without this parameter, Get-EventLog returns an extended PSObject object with additional EventLogName, Source, and InstanceId properties.
To see the effect of this parameter, pipe the events to the Get-Member cmdlet and examine the TypeName value in the result.-AsStringIndicates that this cmdlet returns the output as strings, instead of objects.-BeforeGets events that occurred before a specified date and time. The Before parameter date and time
are excluded from the output. Enter a DateTime object, such as the value returned by the
Get-Date cmdlet.-ComputerNameThis parameter specifies a remote computer's NetBIOS name, Internet Protocol (IP) address, or a fully qualified domain name (FQDN).
If the ComputerName parameter isn't specified, Get-EventLog defaults to the local computer. The parameter also accepts a dot (.) to specify the local computer.
The ComputerName parameter doesn't rely on Windows PowerShell remoting. You can use
Get-EventLog with the ComputerName parameter even if your computer is not configured to run
remote commands.-EntryTypeSpecifies, as a string array, the entry type of the events that this cmdlet gets.
The acceptable values for this parameter are:
- Error
- Information
- FailureAudit
- SuccessAudit
- Warning-IndexSpecifies the index values to get from the event log. The parameter accepts a comma-separated string of values.-InstanceIdSpecifies the Instance IDs to get from the event log. The parameter accepts a comma-separated string of values.-ListDisplays the list of event logs on the computer.-LogNameSpecifies the name of one event log. To find the log names use Get-EventLog -List. Wildcard characters are permitted. This parameter is required.-MessageSpecifies a string in the event message. You can use this parameter to search for messages that contain certain words or phrases. Wildcards are permitted.-NewestBegins with the newest events and gets the specified number of events. The number of events is required, for example -Newest 100. Specifies the maximum number of events that are returned.-SourceSpecifies, as a string array, sources that were written to the log that this cmdlet gets. Wildcards are permitted.-UserNameSpecifies, as a string array, user names that are associated with events. Enter names or name patterns, such as User01, User*, or Domain01\User*. Wildcards are permitted.