Skip to main content
Skip table of contents

EVID 400, 403, 600

Vendor Documentation

Classification

Rule Name

Rule Type

Classification

Common Event

EVID 400/403/600

Base Rule

Audit : Other Audit

MS Windows PowerShell Event

EVID 400 : PS Activity Started

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 403 : PS Activity Stopped

Sub Rule

Startup and Shutdown

Process/Service Stopped

EVID 600 : PS Provider Started

Sub Rule

Startup and Shutdown

Process/Service Started

Mapping with LogRhythm Schema

Device Key in Log MessageLogRhythm SchemaData TypeSchema Description
Provider NameN/AN/AIdentifies the provider that logged the event. The Name and GUID attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.
EventID Qualifiers="0"<vmid>NumberThe identifier that the provider used to identify the event.
Level<severity>Text/StringThe severity level defined in the event.
Task<vendorinfo>Text/StringThe task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.
KeywordsN/AN/AA bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).
TimeCreatedN/AN/AThe time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute.
EventRecordIDN/AN/AThe record number assigned to the event when it was logged.
ChannelN/AN/AThe channel to which the event was logged.
Computer<dname>Text/StringThe name of the computer on which the event occurred.
SecurityN/AN/AN/A
NewEngineState<status>Text/StringN/A
PreviousEngineStateN/AN/AN/A
ProviderNameN/AN/AN/A
NewProviderState<status>Text/StringN/A
SequenceNumberN/AN/AN/A
HostName<account>Text/StringN/A
HostVersionN/A N/AN/A
HostIdN/AN/AN/A
HostApplicationN/AN/AN/A
EngineVersionN/AN/A N/A
RunspaceIdN/AN/AN/A
PipelineIdN/AN/AN/A
CommandNameN/AN/AN/A
CommandTypeN/AN/AN/A
ScriptNameN/AN/AN/A
CommandPathN/AN/AN/A
CommandLine<command>Text/StringN/A


JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.