Pull AppLocker logs out of the Forwarded Logs folder on a Windows Event Collector, and present them in a GridView

Get-ForwardedAppLockerLogs.ps1

Function Get-AppLockerLogs {
    $filter = '
    <QueryList>
      <Query Id="0" Path="ForwardedEvents">
        <Select Path="ForwardedEvents">*[System[Provider[@Name="Microsoft-Windows-AppLocker"] and (Level=2 or Level=3)]]</Select>
      </Query>
    </QueryList>
    '

    $data = Get-WinEvent -FilterXml $filter -Oldest

    foreach ($log in $data) {
        [xml]$tempXML = $log.ToXml()

        $objSID = $null
        $objUser = $null
        $objSID = New-Object System.Security.Principal.SecurityIdentifier($log.UserId.Value)
        
        try {
            $objUser = $objSID.Translate([System.Security.Principal.NTAccount])
            }
        catch {
            $objUser = $log.UserId.Value
        }

        $tempObject = [ordered]@{
            LogName = $log.LogName
            TimeCreated = $log.TimeCreated
            FilePath = $tempXML.Event.UserData.RuleAndFileData.FilePath
            ComputerName = $log.MachineName
            UserID = $objUser.Value
            Signer = $tempXML.Event.UserData.RuleAndFileData.Fqbn
            Message = $tempXML.Event.RenderingInfo.Message
        }
    
        New-Object PSObject -Property $tempObject
    
    }
}

Get-AppLockerLogs | Out-GridView -Wait