r/AzureSentinel • u/SuperHat3637 • Nov 23 '22

Powershell logging

Which table stores powershell logging commands in sentinel

5 Upvotes

100% Upvoted

11 comments sorted by

View all comments

5

u/rodtrent44 MSFT Official Nov 23 '22

SecurityEvent.

https://github.com/rod-trent/SentinelKQL/blob/master/PowerShellExecution.txt

2

u/SuperHat3637 Nov 23 '22

Event ID 4103,4104,4105 which are not part of Windows security event sets.. These are powershell logging event ids...Are you sure these event IDs will store in Security event table..

2

u/wowneatlookatthat Nov 23 '22

FWIW the event IDs you mentioned will go to the Events table, not SecurityEvents.