Find collection rule for specific Event Id

  • Article

Beware of word wrap.

foreach ($rule in get-rule | where {$_.category -eq "EventCollection"} | foreach-object {$_.DataSourceCollection})
    {
    if ($rule.get_configuration().ToString() -match "event number")
        {$rule.get_ParentElement().DisplayName}
    }

main menu