Windows event log triage: a guided PowerShell project
Documentation: Microsoft Learn
Milestone 1 — Inspect the event stream
Not checked yet
Identify Id, ProviderName, LevelDisplayName and Message.
Sample environmentStep through, copy or reset
Run the example to inspect its sample result.
Fictional data. Nothing runs on your device or tenant.
Follow the objects
Each stage shows the objects after one command. Choose Step from start repeatedly to move through the stages, or Run to see the final result.
Run or step through the command to follow its objects.
Inspect the inputs
These fictional objects are reset for every run.
Run and check the milestone
The browser runs supported sample commands against fictional objects. Nothing runs on your device or tenant.
- Open Sample data to inspect the input objects.
- Edit the command, then choose Run to see its final result.
- Choose Step from start repeatedly to inspect each pipeline stage in order.
- Choose Check answer to compare the final rows and properties with the milestone.
Reset restores the editor. Saved completion stays in your progress history.
PowerShell normally streams objects between commands. Sort-Object and Group-Object need their inputs before returning their grouped or sorted results; these sample stage snapshots show the result after each command.
Read the pipeline lesson →Milestone 2 — Focus on errors
Not checked yet
Keep events whose level is Error.
Step through, copy or reset
Run the example to inspect its sample result.
Fictional data. Nothing runs on your device or tenant.
Follow the objects
Each stage shows the objects after one command. Choose Step from start repeatedly to move through the stages, or Run to see the final result.
Run or step through the command to follow its objects.
Inspect the inputs
These fictional objects are reset for every run.
Run and check the milestone
The browser runs supported sample commands against fictional objects. Nothing runs on your device or tenant.
- Open Sample data to inspect the input objects.
- Edit the command, then choose Run to see its final result.
- Choose Step from start repeatedly to inspect each pipeline stage in order.
- Choose Check answer to compare the final rows and properties with the milestone.
Reset restores the editor. Saved completion stays in your progress history.
PowerShell normally streams objects between commands. Sort-Object and Group-Object need their inputs before returning their grouped or sorted results; these sample stage snapshots show the result after each command.
Read the pipeline lesson →Milestone 3 — Order by ID
Not checked yet
Sort event IDs; read provider and message for context.
Step through, copy or reset
Run the example to inspect its sample result.
Fictional data. Nothing runs on your device or tenant.
Follow the objects
Each stage shows the objects after one command. Choose Step from start repeatedly to move through the stages, or Run to see the final result.
Run or step through the command to follow its objects.
Inspect the inputs
These fictional objects are reset for every run.
Run and check the milestone
The browser runs supported sample commands against fictional objects. Nothing runs on your device or tenant.
- Open Sample data to inspect the input objects.
- Edit the command, then choose Run to see its final result.
- Choose Step from start repeatedly to inspect each pipeline stage in order.
- Choose Check answer to compare the final rows and properties with the milestone.
Reset restores the editor. Saved completion stays in your progress history.
PowerShell normally streams objects between commands. Sort-Object and Group-Object need their inputs before returning their grouped or sorted results; these sample stage snapshots show the result after each command.
Read the pipeline lesson →Milestone 4 — Shape the handoff
Not checked yet
Select Id, ProviderName and LevelDisplayName.
Step through, copy or reset
Run the example to inspect its sample result.
Fictional data. Nothing runs on your device or tenant.
Follow the objects
Each stage shows the objects after one command. Choose Step from start repeatedly to move through the stages, or Run to see the final result.
Run or step through the command to follow its objects.
Inspect the inputs
These fictional objects are reset for every run.
Run and check the milestone
The browser runs supported sample commands against fictional objects. Nothing runs on your device or tenant.
- Open Sample data to inspect the input objects.
- Edit the command, then choose Run to see its final result.
- Choose Step from start repeatedly to inspect each pipeline stage in order.
- Choose Check answer to compare the final rows and properties with the milestone.
Reset restores the editor. Saved completion stays in your progress history.
PowerShell normally streams objects between commands. Sort-Object and Group-Object need their inputs before returning their grouped or sorted results; these sample stage snapshots show the result after each command.
Read the pipeline lesson →Milestone 5 — Deliver the error list
Not checked yet
Return error IDs, providers and messages.
Step through, copy or reset
Run the example to inspect its sample result.
Fictional data. Nothing runs on your device or tenant.
Follow the objects
Each stage shows the objects after one command. Choose Step from start repeatedly to move through the stages, or Run to see the final result.
Run or step through the command to follow its objects.
Inspect the inputs
These fictional objects are reset for every run.
Run and check the milestone
The browser runs supported sample commands against fictional objects. Nothing runs on your device or tenant.
- Open Sample data to inspect the input objects.
- Edit the command, then choose Run to see its final result.
- Choose Step from start repeatedly to inspect each pipeline stage in order.
- Choose Check answer to compare the final rows and properties with the milestone.
Reset restores the editor. Saved completion stays in your progress history.
PowerShell normally streams objects between commands. Sort-Object and Group-Object need their inputs before returning their grouped or sorted results; these sample stage snapshots show the result after each command.
Read the pipeline lesson →Defend it
Explain what the report establishes and what you would verify before acting on a real system.
Compare with a model defense
The summary identifies sample errors but does not establish root cause. Correlate timestamps, affected machines and nearby events before proposing a fix.
Incident evidence handover
Deliver a usable report
Record the computer, log, time window, provider, event ID and message. The small browser fixture has no real incident chronology.
Test the failure path
The time window or log is wrong, or there is no access to the remote log. Distinguish a successful empty query from a query that failed.
Verify before handing over
Check an event in Event Viewer and correlate its timestamp with the reported symptom. An error event is evidence to investigate, not proof of the cause.
Complete each checked milestone above. Completion records show practice against fictional data; they do not certify a production script.
Apply this project to the next admin taskPractise the next scenario
Filter error events
Return complete System-log event records with LevelDisplayName Error.
The sandbox is visible now. Sign in with Google only when you run or check a task; commands and temporary files are discarded when you leave.
Run a command to inspect its result.