Skip to main content
Skip table of contents

EVID 4100, 4101, 4102, 4103

Vendor Documentation

Classification

Rule Name

Rule Type

Classification

Common Event

EVID 4100/4101/4102/4103

Base Rule

Audit: Other Audit

MS Windows PowerShell Event

EVID 4100: PS Error

Sub Rule

Operations: Error

General Error Message

EVID 4101: PS Activity

Sub Rule

Audit: Other Audit

MS Windows PowerShell Event

EVID 4102: PS Error

Sub Rule

Operations: Error

General Error Message

EVID 4103: PS Event

Sub Rule

Audit: Other Audit

MS Windows PowerShell Event

Mapping with LogRhythm Schema

Device Key in Log MessageLogRhythm SchemaData TypeSchema Description
Provider NameN/AN/AIdentifies the provider that logged the event. The Name and GUID attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.
EventID<vmid>NumberThe identifier that the provider used to identify the event.
VersionN/ANumberThe version number of the event's definition.
Level<severity>StringThe severity level is defined in the event.
Task<vendorinfo>StringThe task is defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.
OpcodeN/AN/AThe opcode is defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.
KeywordsN/AN/AA bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).
TimeCreatedN/AN/AThe time stamp that identifies when the event was logged. The timestamp will include either the SystemTime attribute or the RawTime attribute.
EventRecordIDN/AN/AThe record number assigned to the event when it was logged.
CorrelationN/AN/AThe activity identifiers that consumers can use to group related events together.
ExecutionN/AN/AContains information about the process and thread that logged the event.
ChannelN/AN/AThe channel to which the event was logged.
Computer<dname>Text/StringThe name of the computer on which the event occurred.
Security<domainorigin>Text/StringN/A
N/A<login>Text/StringN/A
Severity N/AN/AN/A
Host NameN/AN/AN/A
Host VersionN/AN/AN/A
Host IDN/AN/AN/A
Host ApplicationN/AN/AN/A
Engine VersionN/AN/AN/A
Runspace IDN/AN/AN/A
Pipeline IDN/AN/AN/A
Command Name<action>Text/StringN/A
Command Type<objecttype>Text/StringN/A 
Script Name<object>Text/StringN/A 
Command PathN/AN/AN/A
Sequence NumberN/AN/AN/A
User N/AN/AN/A
Connected UserN/AN/A N/A
Shell IDN/AN/AN/A
UserDataN/AN/AN/A
Error Message<command>Text/StringN/A


JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.