counteractive/Get-EnhancedWinEvent

Stream of hash tables doesn't behave like stream of PS objects (e.g., with format-table)

Opened this issue · 0 comments

Our primary use-case for this was typically streaming into JSON for use by downstream tools, so we didn't notice it falls down on some standard use-cases like using format-table. Since winlogbeat now supports evtx files and does a very decent job of pulling out common important data into semantically useful json, getting this to work in an idiomatic powershell way is pretty key to it staying relevant for us.