Question

我有一个PowerShell脚本，它从事件查看器获取RDP连接的登录历史记录，然后将其放入CSV文件中。我想在表中包含Correlation ActivityID，我可以在XML视图中看到它。

local function utf8_to_unicode(utf8str, pos)
   local code, size = utf8str:byte(pos), 1
   if code >= 0xC0 and code < 0xFE then
      local mask = 64
      code = code - 128
      repeat
         local next_byte = utf8str:byte(pos + size) or 0
         if next_byte >= 0x80 and next_byte < 0xC0 then
            code, size = (code - mask - 2) * 64 + next_byte, size + 1
         else
            code, size = utf8str:byte(pos), 1
         end
         mask = mask * 32
      until code < mask
   end
   -- returns code, number of bytes in this utf8 char
   return code, size
end

function utf8_to_python(utf8str)
   local pos = 1
   local z = ''
   while pos <= #utf8str do
      local unicode, size = utf8_to_unicode(utf8str, pos)
      pos = pos + size
      if unicode < 0x80 then
         z = z..string.char(unicode)
      elseif unicode < 0x10000 then
         z = z..string.format('\\\\u%04x', unicode)
      else
         z = z..string.format('\\\\U%08x', unicode)
      end
   end
   return z
end

我是如何实现这一目标的？

Answer 1

您可以使用与其他值相同的方式进行点索引：

[array]$Output += New-Object PSObject -Property @{
    TimeCreated = $_.TimeCreated
    ActivityID  = $entry.Event.System.Correlation.ActivityID     # here
    User        = $entry.Event.UserData.EventXML.User
    IPAddress   = $entry.Event.UserData.EventXML.Address
    EventID     = $entry.Event.System.EventID
    ServerName  = $Server
}

在PowerShell脚本中显示事件日志XML参数

1 个答案: