Greetings,

I am attempting to run your script on to generate the said result.

OS: Windows 2012 R2
PS Version : 4

Error:
Microsoft Windows Server 2012 R2 Standard

Unable to scan localhost event logs

There is not an event log on the localhost computer that matches "WEC-Domain-Controllers-NTLM"

Caught on line number: 43

This event file does exist. We added 4 channels to the event as this is a WEC server. Does this script go through all event files found or just the main/top 3? I am running as admin and admins have full access to that event file.

Thank you.

update_StandardEventLogs_Sysmon.xml Has a syntax error causing it to fail to be used during install

Line 20

This line opens the Source Channel for security but never closes it. Without this close it the agent ignores the whole file. We tested and changing this line to read as follows works and allows agent to install and pass data properly.

	<Source Channel="Security" Enabled="true" />

For really busy servers OldestEventTime & NewestEventTime call to WMI may be executed between log-roll.
If so the Event rate based on time cannot be trusted.

When running the script I am getting the following messages after I provide Domain Credentials in the script.

PS C:\Windows\system32>>> C:\Utilities\EventLogReport\GetEventLogReport.ps1

Security Warning
Run only scripts that you trust. While scripts from the Internet can be useful, this script can potentially harm your
computer. Do you want to run C:\Utilities\EventLogReport\GetEventLogReport.ps1?
[D] Do not run [R] Run once [S] Suspend [?] Help (default is "D"): R
Starting Script

Select Computer List...

Selected: Domain ( Computer(s) Found)

Unable to Create Log Report

A parameter cannot be found that matches parameter name 'Message'.

Caught on line number: 294

This issue is for an edge case that only applies to windows event collection servers recieveing forwarded events. Due to how windows forwarding batches events with lag, e.g. the "Minimize Bandwidth" delivery can take up to 6 hours to deliver events, the very first or last event queried in a forwarded event log is not a reliable measure of the latest or oldest events overall.

https://github.com/ibm-security-intelligence/wincollect/blob/b9dddc7958e91a9a3674f2d3610f4c07e123daec/EventLogReport/GetEventLogReport.ps1#L49

A better approach is to sample the oldest and newest events. I.e. look for the oldest and newest timestamp in a sample of the first 10000 and last 10000 events to avoid latent batches with old events arriving at the Max Delivery Time. While not perfect, it's a better approximation.

Is there a way to prevent the console part to install? I tried to find the config for this but could not :(