Mastering Get-WinEvent: The Ultimate PowerShell Cheat Sheet & Terminal Workflow Guide

Whether you are performing system administration, auditing security logs, or conducting incident response, Windows Event Logs hold the critical footprint of everything happening on a machine. While the traditional Event Viewer GUI (eventvwr.msc) works for quick checks, it quickly becomes slow and impractical at scale.

PowerShell’s Get-WinEvent cmdlet is the gold standard for querying Windows logs—it’s significantly faster than legacy cmdlets like Get-EventLog, supports XPath queries, and can read both classic channels and modern crimson log files.

In this guide, we’ve put together a 25-command cheat sheet formatted for your documentation, along with terminal clipboard tips used by security professionals to streamline their workflow.

---

📖 Best Practices for Documenting Command Placeholders

When creating internal documentation, wikis, or cheat sheets for your team, choosing the right placeholder convention matters:

• Standard Documentation (<Placeholder>): Best for reference guides and formal docs (e.g., ID=<EventID>). It’s immediately recognizable, though pasting it blindly will cause a PowerShell syntax error.
• Copy-Paste Safe (YOUR_VARIABLE): Best if your audience copies and pastes directly into terminals without editing first (e.g., ID=YOUR_EVENT_ID).
• PowerShell Variable Style ($EventID): Best for instructional tutorials or script templates where variables are declared beforehand (e.g., $ID = 41).

---

⚡ The 25 Essential Get-WinEvent Examples

Here is a comprehensive 25-command cheat sheet categorized for everyday sysadmin duties, performance optimization, and deep security analysis:

Category / Task	PowerShell Command Syntax	Mini-Description	Usage Tips & Notes
Recent System Events	Get-WinEvent -LogName System -MaxEvents 20	Fetches the 20 most recent entries from the System log.	Use -MaxEvents to limit query execution time on large log files.
Filter by Event ID	Get-WinEvent -FilterHashtable @{LogName='System'; ID=<EventID>}	Retrieves system events matching a specific Event ID.	Replace <EventID> with an integer like 41 (Kernel-Power) or 6005 (EventLog start).
Multiple Event IDs	Get-WinEvent -FilterHashtable @{LogName='System'; ID=<EventID1>,<EventID2>}	Filters log entries for multiple specific Event IDs simultaneously.	Pass IDs as a comma-separated list inside the hashtable value array.
Filter by Event Level (Errors)	Get-WinEvent -FilterHashtable @{LogName='Application'; Level=2}	Gets all Error-level events from the Application log.	Level values: 1=Critical, 2=Error, 3=Warning, 4=Information, 5=Verbose.
Filter by Level & ID	Get-WinEvent -FilterHashtable @{LogName='System'; Level=2; ID=<EventID>}	Combines severity level and Event ID filtering in a single query.	Combining keys in FilterHashtable narrows results server-side for maximum performance.
Filter by Provider Name	Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='<ProviderName>'}	Filters events created by a specific log provider/source.	Example providers: 'Microsoft-Windows-GroupPolicy', 'Service Control Manager'.
Events in Time Window (Past 24 Hours)	Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=(Get-Date).AddDays(-1)}	Retrieves all events logged within the last 24 hours.	Use AddHours(-X), AddDays(-X), or explicit [datetime] objects for exact timestamps.
Events Between Start and End Time	Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=[datetime]'<YYYY-MM-DD>'; EndTime=[datetime]'<YYYY-MM-DD>'}	Filters events that occurred within a strict date/time range.	Ensure StartTime is earlier than EndTime; format dates per local culture or ISO 8601.
Query Crimson Channel / Operational Log	Get-WinEvent -LogName '<LogName>' -MaxEvents 50	Reads from modern ETL/Operational logs like PowerShell or Task Scheduler.	Example log names: 'Microsoft-Windows-PowerShell/Operational', 'Microsoft-Windows-TaskScheduler/Operational'.
List All Available Log Names	Get-WinEvent -ListLog * | Select-Object LogName, RecordCount, IsClassicLog	Displays all registered event logs on the system and record counts.	Helpful for discovering exact channel names before running detailed queries.
List Providers for a Log	Get-WinEvent -ListProvider *Micro* | Select-Object Name	Lists installed event providers matching a wildcard search.	Useful when finding the exact ProviderName parameter value for FilterHashtable.
Read Offline .evtx Log File	Get-WinEvent -Path '<FilePath.evtx>' -MaxEvents 100	Queries an exported or archived .evtx log file from disk.	Great for forensic analysis or examining logs collected from remote endpoints.
Filter Offline .evtx File with Hashtable	Get-WinEvent -FilterHashtable @{Path='<FilePath.evtx>'; ID=<EventID>}	Applies hashtable filtering directly against an offline .evtx file.	Use 'Path' key inside FilterHashtable instead of 'LogName' key.
Query Remote Computer	Get-WinEvent -ComputerName '<ComputerName>' -LogName System -MaxEvents 20	Fetches event logs from a remote machine over WinRM/RPC.	Requires administrative privileges and Remote Event Log Management firewall rules enabled.
Interactive Grid View Display	Get-WinEvent -LogName System -MaxEvents 100 | Out-GridView	Pipes event results into a GUI table for interactive searching/filtering.	Allows real-time quick column sorting and quick keyword filtering without re-running commands.
Select Specific Properties	Get-WinEvent -LogName System -MaxEvents 20 | Select-Object TimeCreated, Id, LevelDisplayName, Message	Outputs key fields in a clean tabular view.	Select-Object prevents screen clutter and speeds up pipeline processing.
Export Events to CSV File	Get-WinEvent -FilterHashtable @{LogName='System'; Level=2} | Select-Object TimeCreated, Id, ProviderName, Message | Export-Csv -Path '<FilePath.csv>' -NoTypeInformation	Exports filtered log records into a CSV report file.	Always select desired properties before exporting to prevent dumping raw XML objects.
XPath Advanced Query	Get-WinEvent -LogName System -FilterXPath "*[System[(EventID=<EventID>)]]"	Uses raw XPath expressions for complex log query scenarios.	XPath provides ultra-fast server-side evaluation when FilterHashtable parameters are insufficient.
Search Event Message Text	Get-WinEvent -LogName Application -MaxEvents 500 | Where-Object {$_.Message -like '*<Keyword>*'}	Searches event body text for specific text strings or keywords.	Filtering message content happens client-side; combine with -MaxEvents or StartTime to improve performance.
Group Events by Event ID Count	Get-WinEvent -LogName System -MaxEvents 1000 | Group-Object Id -NoElement | Sort-Object Count -Descending	Aggregates log events by Event ID to identify top recurring issues.	Ideal for system health audits to quickly isolate high-frequency error codes.
Filter by User / SID	Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624; UserID='<UserSID>'}	Finds events (e.g., successful logons) associated with a specific user’s Security Identifier (SID).	Obtain a SID using (Get-LocalUser <Username>).SID or (Get-ADUser <Username>).SID.
Search Multiple Logs At Once	Get-WinEvent -FilterHashtable @{LogName='System','Application'; Level=2}	Queries multiple log channels simultaneously in a single execution.	Pass log names as an array inside FilterHashtable to consolidate error auditing.
Filter by Event Keywords / Audit Flag	Get-WinEvent -FilterHashtable @{LogName='Security'; Keywords=9007199254740992}	Filters events by bitmask keywords like Audit Success (9007199254740992) or Audit Failure (4503599627370496).	Essential for Security log analysis to isolate failed logon attempts without heavy client-side filtering.
Query Oldest Events First	Get-WinEvent -LogName System -Oldest -MaxEvents 50	Reads events in chronological order starting from the beginning of the log file.	Useful when analyzing initial system setup, historical boot logs, or log rollover points.
Extract XML / Detailed Payload Properties	Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624} -MaxEvents 1 | Select-Object -ExpandProperty Properties	Expands the positional array of event-specific payload parameters.	To inspect full event XML data, cast to XML: [xml]$event.ToXml() for deep field extraction.

---

🛠️ Pro-Tip: Managing Terminal Snippets & Clipboard Safety

When repeatedly managing complex commands like those above, security engineers and blue teamers rely on specialized utilities to organize and paste commands efficiently:

1. Terminal Snippet Managers (TUI / CLI Vaults)

• snip: An offline TUI snippet manager for rapid fuzzy searching and yanking snippets straight to your clipboard.
• navi: An interactive terminal cheat sheet that prompts you for variable inputs (like <TargetIP> or <EventID>) before executing or copying.
• pet: A Go-based CLI snippet manager integrated with fzf that allows hotkey injection (Ctrl+S) directly into your active shell prompt.

2. Native CLI Clipboard Integration

• PowerShell: "Command Here" | Set-Clipboard and Get-Clipboard
• macOS: pbcopy and pbpaste
• Linux (X11 / Wayland): xclip, xsel, and wl-clipboard

⚠️ A Warning on Pastejacking

Security professionals are notoriously careful when copying commands from web pages or documentation. Pastejacking (or clipboard hijacking) occurs when malicious JavaScript injects hidden newline characters (\n) or shell instructions into copied text. When pasted into a terminal, the hidden command executes immediately before you can inspect it.

Mitigation: Ensure Bracketed Paste Mode is enabled in your terminal emulator, or paste complex commands into a local text buffer or editor before execution.