Grouping on part of Windows Event message text

PowerShell Help
1

Hello. Is it possible to group by part of the message content of Windows events?

Basically I would like to group on a certain property (Image) which is located in the event message of a number of Sysmon events. I tried using regex to group by ‘Image (.*)\s’ but that did not work as below:

Get-WinEvent -FilterHashtable @{logname='Microsoft-Windows-Sysmon/Operational'} | group {$_.Message -like '*Image: (.*)\s*'}

Is there a way that I can I group on all combinations of “Image: <some text>” which are located in the event’s message?

 

 

2

Might be worth mentioning - like isn’t quite Regex. You seem to have a bit of a mix of regex and wildcard there - -like accepts ‘’ as a wildcard character. You could try using "-match '.Image: (.)\s’", which may work?

3

I believe you can get elements of the message from the event data and system data xml as discussed here: Could Someone Please Write a RegEx For Me ?

4

I would first filter events with Where-Object and then the grouping would be easier to do

Get-WinEvent -FilterHashtable @{logname='Microsoft-Windows-Sysmon/Operational'} |
    Where-Object Message -Match '.*Image: (.*)\s.*' |
    Group-Object -Property Message