Update ExchangePowerShellSnapin.yaml
Fix correct name of pssnapin module
This commit is contained in:
Родитель
3bb69d3b51
Коммит
bd8a8484ec
|
@ -15,7 +15,7 @@ query: |
|
|||
| where EventID == 4688
|
||||
| where Process has_any ("cmd.exe", "powershell.exe", "PowerShell_ISE.exe")
|
||||
| where isnotempty(CommandLine)
|
||||
| where CommandLine contains "Add-PSSnapin Microsoft.Exchange.Powershell.Snapin"
|
||||
| where CommandLine contains "Add-PSSnapin Microsoft.Exchange.Management.Powershell.Snapin"
|
||||
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, Account, CommandLine
|
||||
| extend timestamp = FirstSeen, AccountCustomEntity = Account, HostCustomEntity = Computer
|
||||
entityMappings:
|
||||
|
@ -26,4 +26,4 @@ entityMappings:
|
|||
- entityType: Host
|
||||
fieldMappings:
|
||||
- identifier: FullName
|
||||
columnName: HostCustomEntity
|
||||
columnName: HostCustomEntity
|
||||
|
|
Загрузка…
Ссылка в новой задаче