EVID 800 : PS Pipeline Execution

Vendor Documentation

https://www.myeventlog.com/search/find?searchtext=PowerShell

Classification

Rule Name	Rule Type	Classification	Common Event
EVID 800 : PS Pipeline Execution	Base Rule	Audit : Other Audit	MS Windows PowerShell Event

Mapping with LogRhythm Schema

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
Provider Name	N/A	N/A	Identifies the provider that logged the event. The Name and GUID attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.
EventID Qualifiers="0"	<vmid>	Number	The identifier that the provider used to identify the event.
Level	<severity>	Number	The severity level defined in the event.
Task	<vendorinfo>	Number	The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.
Keywords	N/A	N/A	A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).
TimeCreated	N/A	N/A	The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute.
EventRecordID	N/A	N/A	The record number assigned to the event when it was logged.
Channel	N/A	N/A	The channel to which the event was logged.
Computer	<dname>	Text/String	The name of the computer on which the event occurred.
DetailSequence	N/A	N/A	N/A
DetailTotal	N/A	N/A	N/A
SequenceNumber	N/A	N/A	N/A
UserId	<domainorigin>	Text/String	N/A
N/A	<login>	Text/String	N/A
HostName	<account>	Text/String	N/A
HostVersion	N/A	N/A	N/A
HostId	N/A	N/A	N/A
HostApplication	N/A	N/A	N/A
EngineVersion	N/A	N/A	N/A
RunspaceId	N/A	N/A	N/A
PipelineId	N/A	N/A	N/A
ScriptName	<object>	Text/String	N/A
CommandLine	<command>	Text/String	N/A
CommandInvocation	<action>	Text/String	N/A
ParameterBinding	N/A	N/A	N/A