Permalink
Cannot retrieve contributors at this time
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
100 lines (82 sloc)
4.29 KB
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#Requires -Version 5 -RunAsAdministrator | |
<# | |
.SYNOPSIS | |
Create-EventViewerCustomViews - Creates local event viewer custom view files based on Palantir's WEF Github repo | |
.DESCRIPTION | |
Palantir have a great Github repo that contains WEF (Windows Event Forwarding) subscriptions to be created on | |
a WEC (Windows Event Collector) server. They've done the hard work of setting up event log filters | |
to capture various events. https://github.com/palantir/windows-event-forwarding | |
I'd recently been wondering if it was possible to push out custom Event Viewer views, and at the same time | |
decided I'd like to leverage the work Palantir had done with WEF/WEC to create custom view files | |
that allow you to filter local or remote event logs using Event Viewer. | |
Rather than create these views manually, this script does the following: | |
1. Downloads the Palantir 'windows-event-forwarding' repo in ZIP format | |
2. Extracts the Event Log query out of each file in the 'wef-subscriptions' folder, and | |
turns it into a custom Event Viewer view (XML) file in %PROGRAMDATA%\Microsoft\Event Viewer\Views | |
YMMV with this, as I couldn't test the actual outbound connectivity and download functionality on my work | |
laptop. My Windows Firewall policies don't allow PowerShell to communicate out to the Internet. I have, however, | |
tested the script from line #63 onwards. | |
Needs to be run as an admin in order to create the view files in %PROGRAMDATA%, unless you change the | |
output path in the $templateStoragePath variable | |
.OUTPUTS | |
Places custom view files into %PROGRAMDATA%\Microsoft\Event Viewer\Views | |
.EXAMPLE | |
Create-EventViewerCustomViews.ps1 | |
.LINK | |
https://github.com/dstreefkerk/PowerShell/blob/master/Create-EventViewerCustomViews.ps1 | |
.NOTES | |
Written By: Daniel Streefkerk | |
Website: http://daniel.streefkerkonline.com | |
Twitter: http://twitter.com/dstreefkerk | |
Todo: Nothing at the moment | |
Change Log | |
v1.0, 07/11/2017 - Initial version | |
#> | |
# Download URL for the Palantir windows-event-forwarding Repo on Github | |
$repoZipURL = 'https://codeload.github.com/palantir/windows-event-forwarding/zip/master' | |
# Location in which to create the custom Event Viewer views | |
$templateStoragePath = Join-Path $env:ProgramData 'Microsoft\Event Viewer\Views' | |
$xmlTemplate = @" | |
<ViewerConfig> | |
<QueryConfig> | |
<QueryParams> | |
<UserQuery /> | |
</QueryParams> | |
<QueryNode> | |
<Name>{NAMEHERE}</Name> | |
<Description>{DESCRIPTIONHERE}</Description> | |
{QUERYLISTHERE} | |
</QueryNode> | |
</QueryConfig> | |
</ViewerConfig> | |
"@ | |
# Temporary storage location for the downloaded Palantir WEF | |
$tempFile = (Join-Path $env:temp 'wef-repo.zip') | |
Remove-Item $tempFile -Force -ErrorAction SilentlyContinue | |
# Download the Repo, but it requires TLS 1.2 | |
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 | |
Invoke-WebRequest -Uri $repoZipURL -OutFile $tempFile | |
# https://stackoverflow.com/questions/8095638/how-do-i-negate-a-condition-in-powershell | |
if (-Not (Test-Path $tempFile)) { | |
throw "Couldn't locate the downloaded Repo ZIP file. You could manually download it at $repoZipURL and save it as $tempFile" | |
} | |
# Expand the ZIP file to a temporary folder | |
$tempFolder = (Join-Path $env:temp 'wef-repo') | |
Expand-Archive $tempFile -DestinationPath $tempFolder -Force | |
# Get our list of WEF Subscription files | |
$subscriptionFiles = Get-ChildItem (Join-Path $tempFolder 'windows-event-forwarding-master\wef-subscriptions\*.xml') -File | |
foreach ($file in $subscriptionFiles) { | |
# Grab a copy of our custom Event Log view template XML | |
$eventXml = $xmlTemplate | |
# Convert the repo subscription file to XML | |
$fileXml = [xml](Get-Content $file.FullName) | |
# For test | |
"Processing: " + $file.Name | |
# Insert the info from the repo subscription file into our template | |
$eventXml = $eventXml.Replace('{NAMEHERE}',$filexml.Subscription.SubscriptionId) | |
$eventXml = $eventXml.Replace('{DESCRIPTIONHERE}',$filexml.Subscription.Description) | |
$eventXml = $eventXml.Replace('{QUERYLISTHERE}',$filexml.Subscription.Query.InnerText) | |
# Write our populated template variable out to a custom view XML file | |
$outputPath = Join-Path $templateStoragePath "CUSTOMVIEW - $($filexml.Subscription.SubscriptionId).xml" | |
$eventXml | Out-File -FilePath $outputPath -Force | |
} |