darkoperator / eventhunt Goto Github PK

Function must create Xpath Filters that allow for:

• All events after a date
• All Events before a date
• All Events between 2 dates
• Events against a file (path)
• Fields on the System Section of the event
• Fields on the data section of the event.
• Multiple Event IDs
• Specify a Log
• Specify a Provider

Supporting functions that will be used by other advanced functions for querying events.

Advanced functions for parsing events for Windows PowerShell.
Supporting events from PowerShell Versions:

• 2.0
• 3.0
• 4.0
• 5.0
• 5.1

• Pull all startup events by defult.
• Pull all stop events if specified.
• Pull both start and stop events if specified.
• Pull startup or stop event by RunspaceID
• Make all data fields properties of the returned object so they can be parsed with Where-Object
• Pull logs from remote host.
• Pull logs with alternate credentials.
• Be able to change EventLog to look in to.
• Support for Evtx file
• Specify max events to pull

• Pull all startup events by defult.
• Pull all stop events if specified.
• Pull both start and stop events if specified.
• Pull startup or stop event by RunspaceID
• Make all data fields properties of the returned object so they can be parsed with Where-Object
• Pull logs from remote host.
• Pull logs with alternate credentials.
• Be able to change EventLog to look in to.
• Support for Evtx file
• Specify max events to pull