WinSecEventTable WinSecEvent TimeCreated19 Computer18 Id6Right Outcome8 SourceIp16 TargetAccount24 LT3Right Status / Event TimeCreatedyyyy-MM-dd HH:mm:ss Computer EventId Outcome SourceIp TargetAccount if ([int]$_.LogonType -gt 0) { [int]$_.LogonType } else { '' } if ($_.StatusCode) { $_.StatusCode } else { $_.EventName } WinSecSessionTable WinSecSession LogonId10 Account26 Computer18 LogonType18 SourceIp16 StartUtc19 Admin5 Ended LogonId Account Computer LogonType SourceIp StartUtcyyyy-MM-dd HH:mm:ss IsAdmin Ended WinSecBruteForceFindingTable WinSecBruteForceFinding Pattern22 Severity9 TargetAccount24 SourceIp16 Fail6Right OK4Right /min7Right Description Pattern Severity TargetAccount SourceIp FailureCount SuccessCount AttemptsPerMinuteN1 Description WinSecLogCoverageTable WinSecLogCoverage Computer18 Log42 Enabled7 Records9Right OldestUtc19 Used%6Right Risk9 Warning Computer LogName IsEnabled RecordCount OldestRecordUtcyyyy-MM-dd HH:mm:ss UsedPercentN0 Risk Warning WinSecHostResultTable WinSecHostResult Computer26 Status10 Events8Right Ms8Right Error Computer Status EventsFound DurationMsN0 ErrorMessage WinSecAuditGapTable WinSecAuditGap Subcategory40 Current22 Required22 Severity9 Affected events Subcategory CurrentSetting RequiredSetting Severity $_.AffectedEventIds -join ', ' WinSecTimelineBucketTable WinSecTimelineBucket Bucket (UTC)19 Count7Right Fail6Right OK5Right Accts6Right Histogram BucketStartUtcyyyy-MM-dd HH:mm Count FailureCount SuccessCount DistinctAccounts Bar WinSecIpAttributionList WinSecIpAttribution IpAddress Version IsPrivate PtrHostname Country Region City Asn AsnOrganization Provider AbuseConfidenceScore TotalReports Categories$_.Categories -join ', ' Verdict WinSecCaseList WinSecCase CaseId Title Description Operator CreatedUtc SubjectIps$_.SubjectIps -join ', ' ScopeHosts$_.ScopeHosts -join ', ' Findings$_.Findings.Count EvidenceFiles$_.Evidence.Count