Cribl Custom Eventbreaker for Powershell Transcripts

PowershellTranscript.json

{
  "id": "PowershellTranscripts",
  "lib": "custom",
  "rules": [
    {
      "condition": "sourcetype=='powershell:transcripts'",
      "type": "regex",
      "timestampAnchorRegex": "/Start time:\\s/",
      "timestamp": {
        "type": "format",
        "length": 150,
        "format": "%Y%m%d%H%M%S"
      },
      "timestampTimezone": "local",
      "timestampEarliest": "-420weeks",
      "timestampLatest": "+1week",
      "maxEventBytes": 9999999,
      "disabled": false,
      "eventBreakerRegex": "/(?=End time:\\s+\\S+).*[\\r\\n]+\\*{20,}|Windows PowerShell transcript start/gm",
      "name": "PowershellTranscripts"
    }
  ]
}