A PowerShell interface for Graylog.
Go to file
2024-07-25 15:12:10 +01:00
Functions chore: Ensure Graylog session is set before making requests, and added better error handling 2024-07-25 03:11:59 +01:00
Install.ps1 chore: Update PSGraylog module installation script to install required modules (if they're not installed already) 2024-07-25 15:08:40 +01:00
PSGraylog.psd1 Update PSGraylog module installation script to use the correct module path 2024-07-25 15:12:10 +01:00
PSGraylog.psm1 chore: Update module import paths 2024-07-25 02:56:24 +01:00
README.md chore: fixed typo in install 2024-07-25 14:45:46 +01:00

PSGraylog

A PowerShell interface for Graylog

Getting Started

  1. First, download the module to your PSModulePath. You should probably verify random scripts before downloading on the internet, so maybe check out the Install.ps1 file before running it? c:
     $URI = "https://git.wnd.sh/n/PSGraylog/raw/branch/main/Install.ps1"
     Invoke-RestMethod $URI | Invoke-Expression
    
  2. Next, import the module into your environment. You should be prompted to set up your Graylog host, and your credentials. (Note that you can always re-run this with Initialize-GraylogServiceVault later if you wish)
     Import-Module PSGraylog
    
  3. Then, connect to Graylog.
     Connect-Graylog
    
  4. Finally, run a query (the default for the -LogName parameter is 'Windows Security', which is (in my environment, anyways) Active Directory logs):
     $Query = "EventID:4740 && TargetUsername:ab123456" 
     Search-Graylog $Query
    
  5. If you want to re-use the data, you can use the -AsJob parameter to return a GraylogSearchJob object. This object contains various identifers used to locate the search query, and is much quicker then re-running the entire query from scratch with new identifiers.
    Job = Search-Graylog $Query -AsJob
    Job | Receive-GraylogSearchJob