Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 958250" data-attributes="member: 32260">H_C uses an external application (FullEvntLog) to display the events.SWH is a portable application, so I skipped FullEventLog tool and started using Windows built-in tool (wevtutil) + my filtering function to display the events.[URL unfurl=&quot;true&quot;]https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil[/URL]Wevtutil creates different outputs for SRP, PowerShell, and Windows Script Host events. With some effort, I could gather different outputs into one file, but I am not sure if this would be a better idea. The most troublesome are usually SRP blocks so making a separate output for them seems to be reasonable.I am thinking about skipping FullEventLog in H_C, and using the idea of separate logs for SRP, PowerShell, Defender, and FirewallHardening. In most cases, the advanced users can recognize what sort of block has happened and can choose the right log to see the details. Next, it is easier to inspect the log witch is focused on the specific class of events. Only rarely, the user will be forced to use two or more logs to solve the problem with blocked processes.</blockquote>

[QUOTE="Andy Ful, post: 958250, member: 32260"] H_C uses an external application (FullEvntLog) to display the events. SWH is a portable application, so I skipped FullEventLog tool and started using Windows built-in tool (wevtutil) + my filtering function to display the events. [URL unfurl="true"]https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil[/URL] Wevtutil creates different outputs for SRP, PowerShell, and Windows Script Host events. With some effort, I could gather different outputs into one file, but I am not sure if this would be a better idea. The most troublesome are usually SRP blocks so making a separate output for them seems to be reasonable. I am thinking about skipping FullEventLog in H_C, and using the idea of separate logs for SRP, PowerShell, Defender, and FirewallHardening. In most cases, the advanced users can recognize what sort of block has happened and can choose the right log to see the details. Next, it is easier to inspect the log witch is focused on the specific class of events. Only rarely, the user will be forced to use two or more logs to solve the problem with blocked processes. [/QUOTE]

Verification