CMPivot usage

Question

Hello,

Is it possible to combive some WinEvent with some EventLog I am asking because in old Operating Systems the events were in EventLog Only...

WinEvent('Microsoft-Windows-Windows Defender/operational', 7d) | where (ID == 1000 or ID == 1001)

OR

EventLog('System') | where (ID == 1000 or ID == 1001)

Thanks,

Dom

Answer 1

Hi, @Duchemin, Dominique

Thank you for posting in Microsoft Q&A forum.

First, the command for EventLog should be:

EventLog('System') | where (EventID == 1000 or EventID == 1001)

Then, I think we cannot combine the WinEvent with EventLog, they even return different column lists.

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Add comment".