Data Source: Powershell Installed IIS Modules

Date: 2024-07-18

ID: 4f2ccf42-3503-4417-a684-bfccf7f0d7b4

Author: Patrick Bareiss, Splunk

Description

Data source object for Powershell Installed IIS Modules

Details

Property	Value
Source	`powershell://AppCmdModules`
Sourcetype	`Pwsh:InstalledIISModules`

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">Schema</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">timestamp</span>
  
</div>

Example Log

1Schema="Microsoft.IIs.PowerShell.Framework.ConfigurationElementSchema"

Source: GitHub | Version: 1