No matter the mechanism used to capture the data to fulfill the “investigation” phase of the audit, if the data is not analyzed and reports generated, then the audit did not happen. With that in mind, I settled on a quick intro in how to get the audit data in order to generate reports.
Tag: Extended Events
Intro to Reading Event_File Target Data
The event_file target is an asynchronous consumer for Extended Events. This target stores the received payload in a proprietary binary format. Because of this, one needs to use the sys.fn_xe_file_target_read_file function. This article will discuss this function and show how to use it in its simplest form.
Simplified Session Backups
I have demonstrated how to backup a deployed session to a script previously. In this article I demonstrate how to create Simplified Session Backups.
Deployed Target Metadata with PoSH
This article shows a deeper dive that will show how to expose the Deployed Target Metadata with PoSH and familiarity with this powerful tool.
Deployed Action and Predicate Metadata with PoSH
This article shows a deeper dive that will show how to expose the Deployed Action and Predicate Metadata with PoSH and familiarity with this powerful tool.
Exposing Deployed Event Metadata with PoSH
Now that some of the basics concerning how to access Extended Events via PowerShell have been covered, it is appropriate to start digging in a little deeper. This deeper dive will continue in the direction of Exposing Deployed Event Metadata with PoSH and familiarity with this powerful tool.
Extended Event Management Power Tools
PowerShell can pack a pretty big punch when dealing with Extended Events. Using PowerShell as one of your Extended Events Management Tools, there could be a bit of a learning curve, and it may not be the right tool all the time, but it can sure pack a big hit.
Backup Deployed Sessions
Having just completed several segments on the metadata for deployed sessions, it is time to bring all of that information together and see how it can be used – by showing how to backup deployed sessions.
SET Operations and Metadata
SET operations in extended events are the extra configurations that can be made to various components. As an example, a target can be configured with certain properties via the use of a SET operation when creating the Extended Event Session. The best way to see the SET Options and Metadata, is by seeing it in action.
Session Target Metadata
In the case of the final core component, Targets, the exploration into the metadata can be a little awkward. At least at first. Read on to see how to explore the deployed session target metadata at a preliminary level.