Wazuh .evtx

[никита какдела]

Is there any way I can send the event log other than through the Windows event channel?
It truncates half the required fields, including the username.

I'm interested in this log:
%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx

[никита какдела]

I am facing a problem with logging 4104 events (Microsoft-Windows-PowerShell/Operational) For some reason, I'm not getting the username (initiator) in the log. It seems to be truncated by the Windows Event Channel. These events are completely unsuitable for tracking and analyzing incidents. Please tell me how to fix this? I've spent several days searching for a solution, and nothing works. {"win":{"system":{"providerName":"Microsoft-Windows-PowerShell","providerGuid":"{a0c1853b-5c40-4b15-8766-3cf1c58f985a}","eventID":"4104","version":"1","level":"5","task":"2","opcode":"15","keywords":"0x0","systemTime":"2026-01-29T07:35:41.1077418Z","eventRecordID":"1113447","processID":"20048","threadID":"2520","channel":"Microsoft-Windows-PowerShell/Operational","computer":"pc1.domain.ru","severityValue":"VERBOSE","message":"\"Создание текста Scriptblock (1 из 1):\r\npowershell -NoProfile -Command \"Get-LocalUser | Select-Object -First 1\"\r\n\r\nИД ScriptBlock: 9e7084c7-b9cd-4ba7-bffe-50cfb7852187\r\nПуть: \""},"eventdata":{"messageNumber":"1","messageTotal":"1","scriptBlockText":"powershell -NoProfile -Command \\\"Get-LocalUser | Select-Object -First 1\\\"","scriptBlockId":"9e7084c7-b9cd-4ba7-bffe-50cfb7852187"}}}

четверг, 29 января 2026 г. в 15:04:19 UTC+3, никита какдела: