Skip to content

Instantly share code, notes, and snippets.

@mavjs

mavjs/PowerShell Script Block Merge in Kusto

Forked from LeeHolmes/PowerShell Script Block Merge in Kusto
Created March 25, 2022 22:38
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save mavjs/e6cbd87663adfef81d9e0d1e5662c5e4 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save mavjs/e6cbd87663adfef81d9e0d1e5662c5e4 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @LeeHolmes LeeHolmes created this gist Mar 9, 2022.
    14 changes: 14 additions & 0 deletions PowerShell Script Block Merge in Kusto
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,14 @@
    Event
    | where EventID == "4104"
    | extend ParsedEvent = parse_xml(strcat("<root>", ParameterXml, "</root>"))
    | extend MessageNumber = tolong(ParsedEvent.root.Param[0])
    | extend MessageTotal = tolong(ParsedEvent.root.Param[1])
    | extend ScriptBlockElement = iff(
    strlen(tostring(ParsedEvent.root.Param[2]["#text"])) > 0,
    ParsedEvent.root.Param[2]["#text"],
    ParsedEvent.root.Param[2])
    | extend ScriptBlockId = tostring(ParsedEvent.root.Param[3])
    | extend Path = ParsedEvent.root.Param[4]
    | order by MessageNumber asc
    | summarize TimeGenerated = min(TimeGenerated),
    Path = take_any(Path), ScriptBlockText = strcat_array(make_list(tostring(ScriptBlockElement)), "") by ScriptBlockId