PowerShell Logstash filter

logstash/10-powershell-filter.conf

@@ -0,0 +1,22 @@
+filter {
+  if [source_name] == "Microsoft-Windows-PowerShell" {
+    if [event_id] == 4103 {
+	  kv {
+		include_keys => [ "value", "Application" ]
+	  }
+	  grok {
+		match => ["value", "(?<ps_value>^([\D].+))"]
+		remove_field => [ "value"]
+	  }
+	  grok {
+	    match => [ "[event_data][Payload]" , "CommandInvocation\((?<ps_commandinvocation>[\D].+?)\)" ]
+	  }
+	  mutate {
+	    rename => {
+		  "Application" => "ps_hostapplication"
+		  "value" => "ps_value_num"
+		}
+	  }
+	}
+  }
+}

winlogbeat/winlogbeat.yml

@@ -23,6 +23,7 @@ winlogbeat.event_logs:
   - name: Security
   - name: System
   - name: Microsoft-windows-sysmon/operational
+    event_id: 4103, 4104
 
 #================================ General =====================================