Windows Logs via PS

winlogs.ps1

# Configure win32_event_log 
echo "init_config:
instances:
    - type:
         - Information
         - Critical
         - Error
         - Warning
         - Audit Failure
         - Audit Success
      log_file:
         - Application
         - System
         - Security
         - Application
         - Setup
logs:
  - type: windows_event
    channel_path: Application
    source: Application
    service: Application
    sourcecategory: windowsevent
  - type: windows_event
    channel_path: Security
    source: Security
    service: Security
    sourcecategory: windowsevent
  - type: windows_event
    channel_path: System
    source: System
    service: System
    sourcecategory: windowsevent
  - type: windows_event
    channel_path: Setup
    source: Setup
    service: Setup
    sourcecategory: windowsevent" > C:\ProgramData\Datadog\conf.d\win32_event_log.d\conf.yaml