Parse-EVT.ps1

$EventLogFile = "C:\Source\tmp\PE-23563\FromTicket\DEVAPPVD-718_FAIL_SCALE\DEVAPPVD-718_FAIL_SCALE\EventViewer"
#$EventLogFile = "C:\Source\tmp\PE-23563\FromTicket\DEVAPPVD-723_SUCCESS\DEVAPPVD-723_SUCCESS\EventViewer"
Function Get-Stuff {
  # Get Service Start/Stops
  $SearchHash = @{
    'Path' = $EventLogFile + "\System.evtx"
    'ID' = 7036;
  }
  Get-WinEvent -FilterHashtable $SearchHash | ? { ($_.Properties[0].Value -eq 'Marionette Collective Server') -or ($_.Properties[0].Value -eq 'Puppet Agent') -or ($_.Properties[0].Value -eq 'Puppet PXP Agent') }

  # Get Service Start/Stops
  $SearchHash = @{
    'Path' = $EventLogFile + "\System.evtx"
    'ID' = 7045;
  }
  Get-WinEvent -FilterHashtable $SearchHash | ? { ($_.Properties[0].Value -eq 'Marionette Collective Server') -or ($_.Properties[0].Value -eq 'Puppet Agent') -or ($_.Properties[0].Value -eq 'Puppet PXP Agent') }

  # Get Service Start Login failures
  $SearchHash = @{
    'Path' = $EventLogFile + "\System.evtx"
    'ID' = 7038;
  }
  Get-WinEvent -FilterHashtable $SearchHash
  $SearchHash = @{
    'Path' = $EventLogFile + "\System.evtx"
    'ID' = 7000;
  }
  Get-WinEvent -FilterHashtable $SearchHash

  # Get Restarts
  $SearchHash = @{
    'Path' = $EventLogFile + "\System.evtx"
    'ID' = 1074;
  }
  Get-WinEvent -FilterHashtable $SearchHash

  # Get Special Logons
  $SearchHash = @{
    'Path' = $EventLogFile + "\Security.evtx"
    'ID' = 4672;
  }
  Get-WinEvent -FilterHashtable $SearchHash | ? { ($_.Properties[1].Value -eq 'SVC-PUP-master') }

  # Get Logons
  $SearchHash = @{
    'Path' = $EventLogFile + "\Security.evtx"
    'ID' = 4648;
  }
  Get-WinEvent -FilterHashtable $SearchHash | ? { ($_.Properties[5].Value -eq 'SVC-PUP-master') }

  # Get Logoffs
  $SearchHash = @{
    'Path' = $EventLogFile + "\Security.evtx"
    'ID' = 4634;
  }
  Get-WinEvent -FilterHashtable $SearchHash | ? { ($_.Properties[1].Value -eq 'SVC-PUP-master') }

  # Get Logons
  $SearchHash = @{
    'Path' = $EventLogFile + "\Security.evtx"
    'ID' = 4625;
  }
  Get-WinEvent -FilterHashtable $SearchHash | ? { ($_.Properties[5].Value -eq 'SVC-PUP-master') }
}

Get-Stuff | % {
  $result = @{
    TimeCreated = $_.TimeCreated;
    Id = $_.Id;
    LevelDisplayName = $_.LevelDisplayName;
    Message = $_.Message;
  }
  if (($_.Id -eq 4634) -or ($_.Id -eq 4625) -or ($_.Id -eq 4672)) {$result.Add('LogonID', $_.Properties[3].Value) }
  Write-Output (New-Object PSCustomObject -Property $result)
} | Sort-Object -Property TimeCreated | ft -Property TimeCreated, Id, LevelDisplayName, LogonID, Message


# Get-WinEvent -FilterHashtable $SearchHash | % {
#   $event = $_
#   Write-Host $event.Properties[0].Value
#   Write-Host $event.Properties[0].Value
# }
#  ? { $_.Properties[0].Value -eq 'Marionette Collective Server' }