Stephen Ferrero StephenFerrero

## logparser.ps1
# Logparser


###############
# Security Log
###############

# Find Event id
& 'C:\Program Files (x86)\Log Parser 2.2\LogParser.exe' -stats:OFF -i:EVT "SELECT * FROM 'Security.evtx' WHERE EventID = '5038'"

## powershell_eventlog_parsing.ps1
#Security log
#============
####
#4624 - Logon & Logoff events successful
#4625 - Logon unsucceful

####
# Get usernames
Get-WinEvent -path .\Security.evtx | Where {$_.id -eq "4624"} | Foreach {([xml]$_.ToXml()).GetElementsByTagName("Data").ItemOf(5)}| Select -ExpandProperty "#text" -Unique
# Get domains

## NXLog_to_OMS
## This is a sample NXLog configuration file
## This configuration can be used to collect syslog messages from any RFC 5426 capable device
## and  write those logs to a file which can be picked up by the Log Analytics agent
## Thanks to jorritfolmer for initial inspiration here: https://gist.github.com/jorritfolmer/bc6374b48bde2ba99f983cc0889da8a9
##


define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules

## Get-ADUsers.ps1
Import-Module Active Directory
Get-ADUser -Properties * -LDAPFilter '(name=*)' -SearchBase "OU=Employees,OU=CON - User Accounts,DC=contoso,DC=com" | Select Name , SamAccountName , LastLogonDate | Export-Csv C:\Users.csv

## gist:ba04e7acf528ed6a767c4de59054f59f
Add-MailboxFolderPermission -Identity ayla@contoso.com:\Marketing -User Ed@contoso.com -AccessRights Owner
	# Logparser


	###############
	# Security Log
	###############

	# Find Event id
	& 'C:\Program Files (x86)\Log Parser 2.2\LogParser.exe' -stats:OFF -i:EVT "SELECT * FROM 'Security.evtx' WHERE EventID = '5038'"
	#Security log
	#============
	####
	#4624 - Logon & Logoff events successful
	#4625 - Logon unsucceful

	####
	# Get usernames
	Get-WinEvent -path .\Security.evtx \| Where {$_.id -eq "4624"} \| Foreach {([xml]$_.ToXml()).GetElementsByTagName("Data").ItemOf(5)}\| Select -ExpandProperty "#text" -Unique
	# Get domains
	## This is a sample NXLog configuration file
	## This configuration can be used to collect syslog messages from any RFC 5426 capable device
	## and write those logs to a file which can be picked up by the Log Analytics agent
	## Thanks to jorritfolmer for initial inspiration here: https://gist.github.com/jorritfolmer/bc6374b48bde2ba99f983cc0889da8a9
	##


	define ROOT C:\Program Files (x86)\nxlog

	Moduledir %ROOT%\modules
	Import-Module Active Directory
	Get-ADUser -Properties * -LDAPFilter '(name=*)' -SearchBase "OU=Employees,OU=CON - User Accounts,DC=contoso,DC=com" \| Select Name , SamAccountName , LastLogonDate \| Export-Csv C:\Users.csv