Skip to content

Standardize PowerShellLog messages to Splunk-parseable format #1436

@michaellwest

Description

@michaellwest

Summary

Standardized all ~140 PowerShellLog messages across 50 files to a consistent [Category] action=verb key=value format for machine-parseable structured logging compatible with Splunk, ELK, and Datadog.

Changes

  • Adopted [Category] action=camelCaseVerb key=value key="quoted value" format
  • Space-separated key=value pairs (no commas) for native Splunk KV_MODE=auto extraction
  • 24 categories: DelegatedAccess, Remoting, Remoting(SOAP), JWT, Security, Trust, ApiKey, Profile, Session, Console, ISE, Runner, Report, Task, Rule, Provider, Upload, Gutter, Pipeline, Timer, Command, Dialog, Host, Settings
  • Promoted security-relevant Info/Warn to Audit: access denied, script execution, authentication, session elevation, path traversal
  • Demoted noisy autocomplete/help requests from Info to Debug
  • Omitted user= from Audit() calls where framework auto-appends context user
  • Excluded pass-through logging (WriteLogCommand, ScriptingHostUserInterface, raw script body Debug lines)

Related

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions