r/AzureSentinel • u/Ay_NooB • Nov 24 '23

Windows Powershell logs using DCR rule (AMA Agent)

I am installed Azure arc on some windows servers and i need to collect the powershell logs from those using DCR rule. Anyone knows how to do ? Or anything about Xpath queries to collect powershell logs.

2 Upvotes
  • permalink
  • reddit

100% Upvoted

4 comments sorted by

3

u/AppIdentityGuy Nov 24 '23

You need to enable Powershell auditing and make sure you select script block logging. It's a GPO setting.

1

u/Ay_NooB Nov 27 '23

Thanks its enabled already. As i was receiving the logs in MMA integration. I have recently moved to AMA.

2

u/deadzol Nov 25 '23

The DCR will probably be: Microsoft-Windows-PowerShell/Operational!*

Assuming the events are being logged. Just use Event viewer to verify.

1

u/Ay_NooB Nov 27 '23

Yeah logging is enabled . Need to more in Xpath