Windows Integration - PowerShell (x86)

gistfile1.txt

{
  "_index": ".ds-logs-windows.powershell-default-2024.06.24-000001",
  "_id": "vt4BUJABQNtldP-O4_UR",
  "_version": 1,
  "_score": 0,
  "_source": {
    "agent": {
      "name": "gus-windows-test",
      "id": "79d44f1c-3ffd-4b8a-9932-d4763f2f0ef4",
      "ephemeral_id": "71bc468e-813b-4a26-8d9c-087751f8d20a",
      "type": "filebeat",
      "version": "8.14.1"
    },
    "process": {
      "args": [
        "powershell",
        "Start-Process",
        "notepad.exe"
      ],
      "args_count": 3,
      "entity_id": "b233558a-a2ce-4992-9ede-be83a9c4f349",
      "title": "ConsoleHost",
      "command_line": "powershell Start-Process notepad.exe"
    },
    "winlog": {
      "computer_name": "gus-windows-test",
      "record_id": "211",
      "event_id": "403",
      "task": "Engine Lifecycle",
      "keywords": [
        "Classic"
      ],
      "channel": "Windows PowerShell",
      "api": "wineventlog",
      "opcode": "Info",
      "provider_name": "PowerShell"
    },
    "log": {
      "level": "information"
    },
    "elastic_agent": {
      "id": "79d44f1c-3ffd-4b8a-9932-d4763f2f0ef4",
      "version": "8.14.1",
      "snapshot": false
    },
    "message": "Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=15\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.20348.2400\n\tHostId=b233558a-a2ce-4992-9ede-be83a9c4f349\n\tHostApplication=powershell Start-Process notepad.exe\n\tEngineVersion=5.1.20348.2400\n\tRunspaceId=7b398f63-b6e3-4511-98a1-16023558d2de\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=",
    "cloud": {
      "availability_zone": "us-east1-b",
      "instance": {
        "name": "gus-windows-test",
        "id": "4057368033249160694"
      },
      "provider": "gcp",
      "service": {
        "name": "GCE"
      },
      "machine": {
        "type": "e2-medium"
      },
      "project": {
        "id": "elastic-security-dev"
      },
      "region": "us-east1",
      "account": {
        "id": "elastic-security-dev"
      }
    },
    "input": {
      "type": "winlog"
    },
    "@timestamp": "2024-06-25T15:26:50.521Z",
    "ecs": {
      "version": "8.0.0"
    },
    "data_stream": {
      "namespace": "default",
      "type": "logs",
      "dataset": "windows.powershell"
    },
    "powershell": {
      "process": {
        "executable_version": "5.1.20348.2400"
      },
      "engine": {
        "previous_state": "Available",
        "new_state": "Stopped",
        "version": "5.1.20348.2400"
      },
      "runspace_id": "7b398f63-b6e3-4511-98a1-16023558d2de"
    },
    "host": {
      "hostname": "gus-windows-test",
      "os": {
        "build": "20348.2527",
        "kernel": "10.0.20348.2520 (WinBuild.160101.0800)",
        "name": "Windows Server 2022 Datacenter",
        "family": "windows",
        "type": "windows",
        "version": "10.0",
        "platform": "windows"
      },
      "ip": [
        "fe80::d62:63c:5af1:eb51",
        "10.142.0.44"
      ],
      "name": "gus-windows-test",
      "id": "82e87ac9-89b8-4791-ab3d-6954411cade3",
      "mac": [
        "42-01-0A-8E-00-2C"
      ],
      "architecture": "x86_64"
    },
    "event": {
      "agent_id_status": "verified",
      "sequence": 15,
      "ingested": "2024-06-25T15:26:59Z",
      "code": "403",
      "provider": "PowerShell",
      "created": "2024-06-25T15:26:51.276Z",
      "kind": "event",
      "action": "Engine Lifecycle",
      "category": "process",
      "type": "end",
      "dataset": "windows.powershell"
    }
  },
  "fields": {
    "elastic_agent.version": [
      "8.14.1"
    ],
    "event.category": [
      "process"
    ],
    "host.os.name.text": [
      "Windows Server 2022 Datacenter"
    ],
    "winlog.provider_name": [
      "PowerShell"
    ],
    "host.hostname": [
      "gus-windows-test"
    ],
    "winlog.computer_name": [
      "gus-windows-test"
    ],
    "host.mac": [
      "42-01-0A-8E-00-2C"
    ],
    "cloud.availability_zone": [
      "us-east1-b"
    ],
    "process.title.text": [
      "ConsoleHost"
    ],
    "agent.name.text": [
      "gus-windows-test"
    ],
    "host.os.version": [
      "10.0"
    ],
    "winlog.keywords": [
      "Classic"
    ],
    "winlog.record_id": [
      "211"
    ],
    "cloud.service.name.text": [
      "GCE"
    ],
    "host.os.name": [
      "Windows Server 2022 Datacenter"
    ],
    "log.level": [
      "information"
    ],
    "agent.name": [
      "gus-windows-test"
    ],
    "host.name": [
      "gus-windows-test"
    ],
    "event.agent_id_status": [
      "verified"
    ],
    "event.kind": [
      "event"
    ],
    "powershell.engine.new_state": [
      "Stopped"
    ],
    "powershell.runspace_id": [
      "7b398f63-b6e3-4511-98a1-16023558d2de"
    ],
    "cloud.region": [
      "us-east1"
    ],
    "host.os.type": [
      "windows"
    ],
    "powershell.process.executable_version": [
      "5.1.20348.2400"
    ],
    "input.type": [
      "winlog"
    ],
    "data_stream.type": [
      "logs"
    ],
    "host.architecture": [
      "x86_64"
    ],
    "cloud.machine.type": [
      "e2-medium"
    ],
    "cloud.provider": [
      "gcp"
    ],
    "event.provider": [
      "PowerShell"
    ],
    "event.code": [
      "403"
    ],
    "agent.id": [
      "79d44f1c-3ffd-4b8a-9932-d4763f2f0ef4"
    ],
    "cloud.service.name": [
      "GCE"
    ],
    "ecs.version": [
      "8.0.0"
    ],
    "event.created": [
      "2024-06-25T15:26:51.276Z"
    ],
    "agent.version": [
      "8.14.1"
    ],
    "host.os.family": [
      "windows"
    ],
    "process.title": [
      "ConsoleHost"
    ],
    "powershell.engine.previous_state": [
      "Available"
    ],
    "process.command_line.text": [
      "powershell Start-Process notepad.exe"
    ],
    "powershell.engine.version": [
      "5.1.20348.2400"
    ],
    "process.entity_id": [
      "b233558a-a2ce-4992-9ede-be83a9c4f349"
    ],
    "host.os.build": [
      "20348.2527"
    ],
    "cloud.instance.id": [
      "4057368033249160694"
    ],
    "event.sequence": [
      15
    ],
    "host.ip": [
      "fe80::d62:63c:5af1:eb51",
      "10.142.0.44"
    ],
    "agent.type": [
      "filebeat"
    ],
    "event.module": [
      "windows"
    ],
    "host.os.kernel": [
      "10.0.20348.2520 (WinBuild.160101.0800)"
    ],
    "winlog.api": [
      "wineventlog"
    ],
    "elastic_agent.snapshot": [
      false
    ],
    "host.id": [
      "82e87ac9-89b8-4791-ab3d-6954411cade3"
    ],
    "winlog.task": [
      "Engine Lifecycle"
    ],
    "elastic_agent.id": [
      "79d44f1c-3ffd-4b8a-9932-d4763f2f0ef4"
    ],
    "process.args_count": [
      3
    ],
    "data_stream.namespace": [
      "default"
    ],
    "process.args": [
      "powershell",
      "Start-Process",
      "notepad.exe"
    ],
    "message": [
      "Engine state is changed from Available to Stopped. \n\nDetails: \n\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=15\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.20348.2400\n\tHostId=b233558a-a2ce-4992-9ede-be83a9c4f349\n\tHostApplication=powershell Start-Process notepad.exe\n\tEngineVersion=5.1.20348.2400\n\tRunspaceId=7b398f63-b6e3-4511-98a1-16023558d2de\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine="
    ],
    "winlog.event_id": [
      "403"
    ],
    "event.action": [
      "Engine Lifecycle"
    ],
    "event.ingested": [
      "2024-06-25T15:26:59.000Z"
    ],
    "@timestamp": [
      "2024-06-25T15:26:50.521Z"
    ],
    "winlog.channel": [
      "Windows PowerShell"
    ],
    "cloud.account.id": [
      "elastic-security-dev"
    ],
    "host.os.platform": [
      "windows"
    ],
    "data_stream.dataset": [
      "windows.powershell"
    ],
    "event.type": [
      "end"
    ],
    "process.command_line": [
      "powershell Start-Process notepad.exe"
    ],
    "winlog.opcode": [
      "Info"
    ],
    "agent.ephemeral_id": [
      "71bc468e-813b-4a26-8d9c-087751f8d20a"
    ],
    "event.dataset": [
      "windows.powershell"
    ],
    "cloud.instance.name": [
      "gus-windows-test"
    ],
    "cloud.project.id": [
      "elastic-security-dev"
    ]
  }
}