Get-EventLog / Get-WinEvent
Query Windows event logs.
Windowspassive
Get-WinEvent (and legacy Get-EventLog) reads Windows event logs — key for IR, logon analysis and detecting suspicious activity.
Syntax
Get-WinEvent -LogName {log} [-MaxEvents {n}]
Example
Get-WinEvent -LogName Security -MaxEvents 50 | Where Id -eq 4625
Pulls recent Security events and filters for failed logons (Event ID 4625).
Advantages
- Direct access to security telemetry
- Powerful filtering (XPath/hashtable)
- Essential for IR
Disadvantages
- Needs admin for Security log
- Large logs are slow
- Event IDs require lookup
Tags
#windows#logs#dfir
Official docs: Get-WinEvent ↗
Related commands
Frequently asked questions
What is Get-EventLog / Get-WinEvent used for?
Get-WinEvent (and legacy Get-EventLog) reads Windows event logs — key for IR, logon analysis and detecting suspicious activity.
What is an example Get-EventLog / Get-WinEvent command?
A common example is: Get-WinEvent -LogName Security -MaxEvents 50 | Where Id -eq 4625 — Pulls recent Security events and filters for failed logons (Event ID 4625).
Is Get-EventLog / Get-WinEvent part of a standard install?
Get-EventLog / Get-WinEvent runs on Windows. It is typically available by default.
What category of security tool is Get-EventLog / Get-WinEvent?
Get-EventLog / Get-WinEvent is a PowerShell tool with a passive-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.