PowerShell logs details about PowerShell operations, such as starting and stopping the engine and providers, and executing PowerShell commands. Therefore, audit configuration and logging are important. The following steps should be followed for configuration;
Known limitation: following the steps below will successfully collect PowerShell events into Logsign, but a source-code review found that events from the Microsoft-Windows-PowerShell/Operational channel are not currently matched to Logsign's PowerShell event-mapping data (the rich Module Logging / Script Block Logging field enrichment for events 4103/4104 is keyed to a different, legacy source name than what this channel's events actually carry). In practice this means the raw events will appear in Logsign but with limited EventMap enrichment. This is a backend mapping issue, not a step you can work around in this configuration; if enrichment is important for your use case, raise it with Logsign Support so the mapping can be corrected.
1- Connect to the group policy management.
2- Required fields are Enabled under Administrative Templates – Windows components- Windows Powershell.
3- Logs with Audit enabled start to appear under EventViewer-Application and Services Logs- Microsoft – Windows – Powershell – Operational.
4- After this stage, we will see how to add this source to Logsign Unified SecOps Platform with WMI Integration;
5- The fullpath of the relevant log file is in Regedit as the new key.
It should be created under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog.
6- The generated key name should be entered carefully. For Powershell, this domain name is;
Microsoft-Windows-PowerShell/Operational to be entered.
7- The gpupdate /force is executed in cmd.
8- When performing Logsign resource integration, WMI is selected. Integration is completed by selecting the Microsoft-Windows-PowerShell/Operational in log file tab.