Hello I need to create a stream (and relative alert) when eventvwr writes on Powershell registry startup/shutdown of Powershell script execution EventID are 400 and 403 (600 is another ID but I don’t want to consider) Obviously the script starts with event 400 and closes after some time with even…

Powershell script execution (via GELF UDP input)

tmacgbay (Tmacgbay) December 9, 2022, 5:44pm 2

Happy to help with technical questions what does your environment look like? What have you tried? Where are you stuck?

Check out the below post to help provide some relevant information so we can help you…

1 Like

Topic		Replies	Views
AD failed log on stream Graylog Central (peer support)	5	2338	January 3, 2018
Graylog alert conditions not triggered Graylog Central (peer support) sidecar , winlogbeat	3	501	May 31, 2019
Event/stream sript Graylog 3.2 Graylog Central (peer support)	2	294	June 29, 2020
Alert based on single field, but with multiple sources? Graylog Central (peer support) sidecar , nxlog , nodatanx	2	657	March 1, 2017
Alert eventid and ip source.How to have corelation Graylog Central (peer support)	4	394	July 5, 2018