Parsing long PowerShell sessions

henryyam — Wed, 22 May 2019 15:21:15 GMT

How is everyone parsing these powershell transcriptions when a person leaves the shell open for multiple days?
In that case it shows the user who executed once, but there can be a hundred command starts spanning multiple days.

Is the consensus to capture this still as one event? Or do you have logic that breaks those into multiple events?

I have some transcripts files 30+MB in size.

Command start time: 20190522100828

PS>CommandInvocation(Get-ProvTask): "Get-ProvTask"

ParameterBinding(Get-ProvTask): name="AdminAddress"; value="google.com:80"
ParameterBinding(Get-ProvTask): name="MaxRecordCount"; value="2147483647"

Command start time: 20190522100830

PS>CommandInvocation(Get-BrokerCatalog): "Get-BrokerCatalog"
ParameterBinding(Get-BrokerCatalog): name="AdminAddress"; value="yahoo.com:80"
ParameterBinding(Get-BrokerCatalog): name="MaxRecordCount"; value="2147483647"
ParameterBinding(Get-BrokerCatalog): name="Property"; value="Uid, Name, MetadataMap, ProvisioningSchemeId, Scopes"

Re: Parsing long PowerShell sessions

richgalloway — Wed, 22 May 2019 17:12:11 GMT

Converted from answer to a new question.

Re: Parsing long PowerShell sessions

henryyam — Wed, 29 May 2019 15:29:01 GMT

I believe we can potentially link all these events based on the fact that they generate from the same source file.
I could probably go back and look up the original user. It just seems to be a cumbersome process.

topic Re: Parsing long PowerShell sessions in Getting Data In

Parsing long PowerShell sessions

Re: Parsing long PowerShell sessions

Re: Parsing long PowerShell sessions