How to get a Full Encoded Command from a Notable

[CSNinja]

We are receiving some notables that reference an encoded command being used with PowerShell, and the notable lists the command in question. The issue is that the command it is listing appears to be incomplete when we decode the string. Does anyone know a way for us to potentially hunt down and figure out what the full encoded command referenced in the notable may be?

[CSNinja]

We are receiving some notables that reference an encoded command being used with PowerShell, and the notable lists the command in question. The issue is that the command it is listing appears to be incomplete when we decode the string. Does anyone know a way for us to potentially hunt down and figure out what the full encoded command referenced in the notable may be?

[PickleRick]

Please don't spam the same question in multiple places.

As to the your question - check the original event which triggers your notable and see if your event is not truncated. If it is you might need to tweak your ingestion parameters so that longer part of the event is retained.