问将snare替换为powershell，推送事件日志

EN

#$cred = Get-Credential
#$events = Get-WinEvent -Computer localhost -Credential $cred -FilterHashtable @{logname="Security"; id=4688} -MaxEvents 25
$events = Get-WinEvent -Computer localhost -FilterHashtable @{logname="Security"; id=4688} -MaxEvents 20
 #$eventXML = [xml]$events[0].ToXml()  # This was for Testing
 #$eventXML.Event.EventData.Data       # This was for Testing
$outputcol = @()
ForEach ($Event in $Events ) {
$eventXML = [xml]$Event.ToXml() 
if ($eventXML.Event.EventData.Data[8].'#text' -like "*") {
  $output = New-Object PSobject
  $output | Add-Member -MemberType NoteProperty -Name Time -value $Event.TimeCreated
  $output | Add-Member -MemberType NoteProperty -Name Event -value $Event.ID
  $output | Add-Member -MemberType NoteProperty -Name Computer -Value $Event.MachineName
  #$output | Add-Member -MemberType NoteProperty -Name Computer $eventXML.Event.EventData.Data[1].'#text'  #Computer
  $output | Add-Member -MemberType NoteProperty -Name Command $eventXML.Event.EventData.Data[8].'#text'  #CommandLine
  $outputcol += $output
}  
} 
$outputcol | Format-table -auto | Tee-Object "C:\Users\eventlogs.txt"