Matching Events into Pairs

In this article I will be taking you into the world of the pair_matching target. The pair_matching target should connote that this target works on matching like events into a single pair. Very much like a pair of socks would contain two parts, one for each foot or side of the body, the pair_matching target creates pairs of events that go together.

Know Before You GO – Target Settings

When adding a Target to a session, a configurable setting may or may not be obviously available for use with the Target. In and of itself, this can be mildly frustrating if the wrong settings are tried with the wrong Target. More frustrating is that some settings are required. While the required setting may be logically deduced, it does not always work out that way.

Reading Session Data from Memory

In this article, I introduce the topic of reading session data from memory along with some of the pitfalls and some words of caution.

Better Practices for Reading Event_file Targets

In this article, I am going to address some better practices for Reading Event_file targets attached to an XEvent Session.

Dynamically Read event_file Data

There needs to be a more efficient means of grabbing the file without having to know the location. Knowing the session name should be adequate enough to parse the payload data from the target. This is exactly what I am going to show in this article – retrieving the file and path based strictly on the name of the session.

Auditing Needs Reporting

No matter the mechanism used to capture the data to fulfill the “investigation” phase of the audit, if the data is not analyzed and reports generated, then the audit did not happen. With that in mind, I settled on a quick intro in how to get the audit data in order to generate reports.

Intro to Reading Event_File Target Data

The event_file target is an asynchronous consumer for Extended Events. This target stores the received payload in a proprietary binary format. Because of this, one needs to use the sys.fn_xe_file_target_read_file function. This article will discuss this function and show how to use it in its simplest form.

Simplified Session Backups

I have demonstrated how to backup a deployed session to a script previously. In this article I demonstrate how to create Simplified Session Backups.

Deployed Target Metadata with PoSH

This article shows a deeper dive that will show how to expose the Deployed Target Metadata with PoSH and familiarity with this powerful tool.

Deployed Action and Predicate Metadata with PoSH

This article shows a deeper dive that will show how to expose the Deployed Action and Predicate Metadata with PoSH and familiarity with this powerful tool.