Get-EventLog / Get-WinEvent

Query Windows event logs.

Windowspassive

Get-WinEvent (and legacy Get-EventLog) reads Windows event logs — key for IR, logon analysis and detecting suspicious activity.

Syntax

Get-WinEvent -LogName {log} [-MaxEvents {n}]

Example

Get-WinEvent -LogName Security -MaxEvents 50 | Where Id -eq 4625

Pulls recent Security events and filters for failed logons (Event ID 4625).

Advantages
  • Direct access to security telemetry
  • Powerful filtering (XPath/hashtable)
  • Essential for IR
Disadvantages
  • Needs admin for Security log
  • Large logs are slow
  • Event IDs require lookup
Tags
#windows#logs#dfir

Official docs: Get-WinEvent

Related commands

Frequently asked questions

What is Get-EventLog / Get-WinEvent used for?
Get-WinEvent (and legacy Get-EventLog) reads Windows event logs — key for IR, logon analysis and detecting suspicious activity.
What is an example Get-EventLog / Get-WinEvent command?
A common example is: Get-WinEvent -LogName Security -MaxEvents 50 | Where Id -eq 4625 — Pulls recent Security events and filters for failed logons (Event ID 4625).
Is Get-EventLog / Get-WinEvent part of a standard install?
Get-EventLog / Get-WinEvent runs on Windows. It is typically available by default.
What category of security tool is Get-EventLog / Get-WinEvent?
Get-EventLog / Get-WinEvent is a PowerShell tool with a passive-risk profile when run against a live target.

Try recon tools live

Run real scans against a domain you control, stage by stage.

Open the lab →