psLogAnalytics

0.2.2

queries.xml

                                <queries>

    <query>

        <name>hwComputerSystem</name>

        <type>WMI</type>

        <comment>Computer System</comment>

        <command>Get-CimInstance -ClassName Win32_ComputerSystem | ForEach-Object {

    [pscustomobject]@{

        TotalPhysicalMemory = [math]::Round($_.TotalPhysicalMemory / 1GB,0);

        Manufacturer = $_.Manufacturer;

        Model = $_.Model;

        SystemSKUNumber = $_.SystemSKUNumber;

        PCSystemType = $_.PCSystemType

    }}</command>

    </query>

    <query>

        <name>hwProcessors</name>

        <type>WMI</type>

        <comment>Processors</comment>

        <command>Get-CimInstance -ClassName Win32_processor | Select-Object SystemName,Name,DeviceID,NumberOfCores,NumberOfLogicalProcessors,Addresswidth</command>

    </query>

    <query>

        <name>hwDiskPartitions</name>

        <type>WMI</type>

        <comment>Logical Disk Partitions</comment>

        <command>Get-CimInstance -ClassName Win32_DiskPartition | Select-Object Index,Caption,Description,BlockSize,Bootable,Size,PrimaryPartition</command>

    </query>

    <query>

        <name>swLogicalDisks</name>

        <type>WMI</type>

        <comment>Logical Disk Volumes</comment>

        <command>Get-CimInstance -ClassName Win32_LogicalDisk | Select-Object Name,DeviceID,DriveType,MediaType,FileSystem,SizeBytes,FreeSpaceBytes,VolumeName,VolumeSerialNumber</command>

    </query>

    <query>

        <name>swShares</name>

        <type>WMI</type>

        <comment>File Shares</comment>

        <command>Get-CimInstance -ClassName Win32_Share | Select-Object Name,Path,Description,Type</command>

    </query>

    <query>

        <name>hwNetwokAdapterConfig</name>

        <type>WMI</type>

        <comment>Network Adapter Configurations</comment>

        <command>Get-CimInstance -ClassName Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $True} | Foreach-Object {

    [pscustomobject]@{

        Index = $_.Index;

        Description = $_.Description;

        DHCPEnabled = $_.DHCPEnabled;

        DHCPServer = $_.DHCPServer;

        MACAddress = $_.MACAddress;

        IPAddress = $_.IPAddress -join ',';

        IPSubnet = $_.IPSubnet -join ',';

        DefaultIPGateway = $_.DefaultIPGateway -join ',';

        InterfaceIndex = $_.InterfaceIndex;

        WINSEnableLMHostsLookup = $_.WINSEnableLMHostsLookup;

        DomainDNSRegistrationEnabled = $_.DomainDNSRegistrationEnabled;

        FullDNSRegistrationEnabled = $_.FullDNSRegistrationEnabled;

        DNSServerSearchOrder = $_.DNSServerSearchOrder -join ',';

        DNSDomainSuffixSearchOrder = $_.DNSDomainSuffixSearchOrder -join ','

    }}</command>

    </query>

    <query>

        <name>hwDisplayConfiguration</name>

        <type>WMI</type>

        <comment>Display Configurations</comment>

        <command>Get-CimInstance -ClassName Win32_DisplayConfiguration | Select-Object DeviceName,SpecificationVersion,PelsWidth,PelsHeight</command>

    </query>

    <query> 

        <name>swBIOS</name>

        <type>WMI</type>

        <comment>BIOS information</comment>

        <command>Get-CimInstance -ClassName Win32_BIOS | Select-Object Manufacturer,Version,SMBIOSBIOSVersion,Name,SerialNumber</command>

    </query>

    <query> 

        <name>hwBattery</name>

        <type>WMI</type>

        <comment>Batteries</comment>

        <command>Get-CimInstance -ClassName Win32_Battery | Select-Object Name,DeviceID,Status,PowerManagementSupported</command>

    </query>

    <query>

        <name>hwPortableBattery</name>

        <type>WMI</type>

        <comment>Portable Batteries</comment>

        <command>Get-CimInstance -ClassName Win32_PortableBattery | Select-Object DeviceID,Name,Manufacturer,SmartBatteryVersion,ManufactureDate</command>

    </query>

    <query> 

        <name>swOperatingSystem</name>

        <type>WMI</type>

        <comment>Operating System</comment>

        <command>Get-CimInstance -ClassName Win32_OperatingSystem | Foreach-Object {

    [pscustomobject]@{

        Caption = $_.Caption;

        Version = $_.Version;

        BuildNumber = $_.BuildNumber;

        InstallDate = $_.InstallDate;

        LastBootUpTime = $_.LastBootUpTime;

        OSArchitecture = $_.OSArchitecture;

        OSLanguage = $_.OSLanguage;

        OSType = $_.OSType;

        WindowsDirectory = $_.WindowsDirectory

    }}</command>

    </query>

    <query> 

        <name>swOptionalFeature</name>

        <type>WMI</type>

        <comment>Windows Optional Features</comment>

        <command>Get-CimInstance -ClassName Win32_OptionalFeature | Select-Object Name,Caption,InstallState</command>

    </query>

    <query> 

        <name>swHotfixes</name>

        <type>WMI</type>

        <comment>Installed Hotfixes</comment>

        <command>Get-CimInstance -ClassName Win32_QuickFixEngineering | Select-Object HotFixID,Caption,Description,InstalledOn</command>

    </query>

    <query>

        <name>swStartupCommands</name>

        <type>WMI</type>

        <comment>Windows Automatic Startup Commands</comment>

        <command>Get-CimInstance -ClassName Win32_StartupCommand | Select-Object Name,Caption,Description,Command,Location,User,UserSID</command>

    </query>

    <query> 

        <name>hwPrinterConfigurations</name>

        <type>WMI</type>

        <comment>Printer Configurations</comment>

        <command>Get-CimInstance -ClassName Win32_PrinterConfiguration | Select-Object * -ExcludeProperty BitsPerPixel,Caption,DisplayFlags,CimClass,CimInstanceProperties,CimSystemProperties</command>

    </query>

    <query>

        <name>swServices</name>

        <type>WMI</type>

        <comment>Windows Services</comment>

        <command>Get-CimInstance -ClassName Win32_Service | Select-Object Name,DisplayName,Description,DesktopInteract,StartMode,DelayedAutoStart,Started,StartName,State,AcceptPause,AcceptStop,ExitCode</command>

    </query>

    <query> 

        <name>swLocalUsers</name> 

        <type>WMI</type>

        <comment>Local User Accounts</comment>

        <command>Get-CimInstance -ClassName Win32_UserAccount | Select-Object Name,Caption,Description,Domain,LocalAccount,FullName,Disabled,Lockout,PasswordChangeable,PasswordExpires,PasswordRequired,SID,Status | Where-Object {$_.LocalAccount -eq "True"}</command>

    </query>

    <query> 

        <name>swLocalGroups</name>

        <type>WMI</type>

        <comment>Local Security Groups</comment>

        <command>Get-CimInstance -ClassName Win32_Group | Select Name,Caption,Description,LocalAccount | Where-Object {$_.LocalAccount -eq "True"}</command>

    </query>

    <query> 

        <name>swUserProfiles</name>

        <type>WMI</type>

        <comment>Local User Profiles</comment>

        <command>Get-CimInstance -ClassName Win32_UserProfile | Select-Object LocalPath,SID,RoamingConfigured,Special,LastUseTime,Loaded,HealthStatus</command>

    </query>

    <query>

        <name>swEnvironment</name>

        <type>WMI</type>

        <comment>System and User Environment Variables</comment>

        <command>Get-CimInstance -ClassName Win32_Environment | Select Name,SystemVariable,VariableValue | Sort-Object Name</command>

    </query>

    <query> 

        <name>swTimeZone</name>

        <type>WMI</type>

        <comment>Time Zone Configurations</comment>

        <command>Get-CimInstance -ClassName Win32_TimeZone | Select-Object StandardName,DaylightName,Caption,Bias,DaylightBias</command>

    </query>

    <query>

        <name>swInstalledSoftware</name>

        <type>WMI</type>

        <comment>Installed Software Products</comment>

        <command>Get-CimInstance -ClassName Win32_Product | Where-Object {![string]::IsNullOrEmpty($_.Caption)} | Select-Object Caption,Vendor,Description,IdentifyingNumber,InstallDate,InstallLocation,InstallSource,PackageCode,PackageCache,PackageName,Language</command>

    </query>

</queries>