PowerShell module fields
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is in beta and is not ready for production usage. For beta features, the design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is in beta and is not ready for production usage. For beta features, the design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Beta
Beta
Stack
Beta
Beta
These are the event fields specific to the module for the Microsoft-Windows-PowerShell/Operational and Windows PowerShell logs.
powershell.id-
Shell Id.
type: keyword
example: Microsoft Powershell
powershell.pipeline_id-
Pipeline id.
type: keyword
example: 1
powershell.runspace_id-
Runspace id.
type: keyword
example: 4fa9074d-45ab-4e53-9195-e91981ac2bbb
powershell.sequence-
Sequence number of the powershell execution.
type: long
example: 1
powershell.total-
Total number of messages in the sequence.
type: long
example: 10
Data related to the executed command.
powershell.command.path-
Path of the executed command.
type: keyword
example: C:\Windows\system32\cmd.exe
powershell.command.name-
Name of the executed command.
type: keyword
example: cmd.exe
powershell.command.type-
Type of the executed command.
type: keyword
example: Application
powershell.command.value-
The invoked command.
type: text
example: Import-LocalizedData LocalizedData -filename ArchiveResources
powershell.command.invocation_details-
An array of objects containing detailed information of the executed command.
type: array
powershell.command.invocation_details.type-
The type of detail.
type: keyword
example: CommandInvocation
powershell.command.invocation_details.related_command-
The command to which the detail is related to.
type: keyword
example: Add-Type
powershell.command.invocation_details.name-
Only used for ParameterBinding detail type. Indicates the parameter name.
type: keyword
example: AssemblyName
powershell.command.invocation_details.value-
The value of the detail. The meaning of it will depend on the detail type.
type: text
example: System.IO.Compression.FileSystem
Data related to the connected user executing the command.
powershell.connected_user.domain-
User domain.
type: keyword
example: VAGRANT
powershell.connected_user.name-
User name.
type: keyword
example: vagrant
Data related to the PowerShell engine.
powershell.engine.version-
Version of the PowerShell engine version used to execute the command.
type: keyword
example: 5.1.17763.1007
powershell.engine.previous_state-
Previous state of the PowerShell engine.
type: keyword
example: Available
powershell.engine.new_state-
New state of the PowerShell engine.
type: keyword
example: Stopped
Data related to the executed script file.
powershell.file.script_block_hash-
SHA-256 hash of the executed script block.
type: keyword
powershell.file.script_block_id-
Id of the executed script block.
type: keyword
example: 50d2dbda-7361-4926-a94d-d9eadfdb43fa
powershell.file.script_block_text-
Text of the executed script block.
type: text
example: .\a_script.ps1
powershell.process.executable_version-
Version of the engine hosting process executable.
type: keyword
example: 5.1.17763.1007
Data related to the PowerShell engine host.
powershell.provider.new_state-
New state of the PowerShell provider.
type: keyword
example: Active
powershell.provider.name-
Provider name.
type: keyword
example: Variable