https://github.com/osquery/osquery logo
b

Brandon

11/02/2020, 8:51 PM
I cannot seem to collect powershell logs. Can someone let me know where my config is off?
Copy code
--disable_events=false
--disable_forensic=false
--enable_windows_events_publisher=true
--enable_windows_events_subscriber=true
--windows_events_channel=System,Application,Setup,Security,Microsoft-Windows-PowerShell
a

alessandrogario

11/02/2020, 9:17 PM
can you check the --help output? powershell should have its own flag if i am not mistaken
Powershell block logging should also be enabled from gpedit.msc
b

Brandon

11/02/2020, 9:22 PM
enabled block logging
6 Views