Open tsale opened 5 years ago
I'm also having trouble with this as absolute path of an exported evtx file was not working. I believe line 632 function Check-Options($file, $log) could be the culprit.
Quick test to get it working: Create a directory within deepblue with the imported evtx file.
then run e.g.:
(For a folder you created within the deepblue directory using ".\"):
.\DeepBlue.ps1 ".\< Created folder name of your imported logs>\< Event Log Filename >.evtx"
(For a folder you created at the parent directory above deepblue using "..\" ):
.\DeepBlue.ps1 "..\< Created folder name of your imported logs>\< Event Log Filename >.evtx"
I have an issue where where the script local (-log) or remote (-file) arguments shows no results. There is no error so it looks like it cannot find anything even though there are event IDs that should match on the "Microsoft-Windows-PowerShell/Operational.evtx" log.
Can you please help me to troubleshoot this?