In question
Q_28621867 I asked for a script to read from a log file an execute commands that queried and output the windows event logs to separate files. That works well. I'd like to take it further, and search each event log for the <EventRecordID> tag and the value in it. Using that value I'd like to execute a command similar to this:
wevtutil qe "Microsoft-Windows-Sysmon/
Operationa
l" /q:"*[System[Provider[@Nam
e='
Microsoft-Windows-Sysmon'] and EventRecordID >
xyz ]]"
The bolded items above need to be replaced by their respective log names, and the number found in the <EventRecordID> tag.
Not all logs will contain data, and some that do have data may not have that tag, those should just be skipped.
PowerShell is out, but VBScript or Batch is fine, as long as wevturil is being called by the Vbs or Bat file.
The goal again to be that instead of writing the log over itself, have it look for the highest number in the event log's (in the EventRecordID tag), and then issue appended query results to the respective log files.
1st run: wevtutil qe "Microsoft-Windows-Sysmon/
Operationa
l"
2nd run: wevtutil qe "Microsoft-Windows-Sysmon/
Operationa
l" /q:"*[System[Provider[@Nam
e='
Microsoft-Windows-Sysmon'] and EventRecordID > 123456 ]]"
Again where 123456 was the highest number found in eventrecordID tag in the sysmon event log from the first run. All runs after CountGood >=1 should use the "second run" query.
-rich
~bp