Help with PS script that gets run when an event ID is triggered.

Question

Hello,
I've had some great help from Mike Laughlin on this forum on creating a simple PS script that can email me when a particular event id is seen on a server.
Here it is:
$serverName = $env:COMPUTERNAME
Send-MailMessage -to [email protected] -Subject "$serverName - Low on Virtual Memory" -body "$serverName
- low on virtual memory" -smtpserver smtp.gb.local -from [email protected]
What I want to add is the event id to in the email too so we can get more information, is this possible?

Answer 1

Here are some suggestions:
Here is a defined trigger for security event ID 5156.  It is good for learning because it happens frequently.
<Triggers>
<EventTrigger>
<Enabled>true</Enabled>
<Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Security"&gt;&lt;Select Path="Security"&gt;*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=5156]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
<ValueQueries>
<Value name="Application">Event/EventData/Data[@Name='Application']</Value>
<Value name="DestAddress">Event/EventData/Data[@Name='DestAddress']</Value>
<Value name="DestPort">Event/EventData/Data[@Name='DestPort']</Value>
<Value name="SourceAddress">Event/EventData/Data[@Name='SourceAddress']</Value>
<Value name="SourcePort">Event/EventData/Data[@Name='SourcePort']</Value>
<Value name="TimeCreated">Event/System/TimeCreated/@SystemTime</Value>
</ValueQueries>
</EventTrigger>
</Triggers>
The ValueQuery defines the path to the values in the event data.
Here is how we pass the data to the command usingnamed parameters:
<Actions Context="Author">
<Exec>
<Command>powershell</Command>
<Arguments>
-file test5156.ps1
-Application $(Application)
-SourceAddress $(SourceAddress)
-SourcePort $(SourcePort)
-DestAddress $(DestAddress)
-DestPort $(DestPort)
-TimeCreated $(TimeCreated)
</Arguments>
<WorkingDirectory>c:\test</WorkingDirectory>
</Exec>
</Actions>
Notice that I do NOT use single quotes and have formatted the XML so it is easy to edit.
The line breaks are not preserved by the XML when passed and the extra space is unimportant.
Here is the test script that displays the passed arguments.
Param(
$Application,
$SourceAddress,
$SourcePort,
$DestAddress,
$DestPort,
$TimeCreated
'[{0:hh:mm:ss}] {1}' -f [datetime]::Now,'New Event 5156' | Out-file c:\test\testel.log -append
$p=@{
Application=$Application
SourceAddress=$SourceAddress
SourcePort=$SourcePort
DestAddress=$DestAddress
DestPort=$DestPort
TimeCreated=$TimeCreated
$parms=New-Object PsObject -Property $P
$parms |Format-List |Out-String | Out-file c:\test\testel.log -append
Each event ID can have very different data structures  thei si what the 5256 class o structures looks like:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>5156</EventID>
<Version>1</Version>
<Level>0</Level>
<Task>12810</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2015-03-18T16:51:12.152331100Z" />
<EventRecordID>34783304</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="3656" />
<Channel>Security</Channel>
<Computer>W8Test</Computer>
<Security />
</System>
<EventData>
<Data Name="ProcessID">2608</Data>
<Data Name="Application">\device\harddiskvolume4\windows\system32\svchost.exe</Data>
<Data Name="Direction">%%14592</Data>
<Data Name="SourceAddress">239.255.255.250</Data>
<Data Name="SourcePort">1900</Data>
<Data Name="DestAddress">192.168.1.106</Data>
<Data Name="DestPort">2232</Data>
<Data Name="Protocol">17</Data>
<Data Name="FilterRTID">275543</Data>
<Data Name="LayerName">%%14610</Data>
<Data Name="LayerRTID">44</Data>
<Data Name="RemoteUserID">S-1-0-0</Data>
<Data Name="RemoteMachineID">S-1-0-0</Data>
</EventData>
</Event>
Note how the mappingis done from event data name and argument then to PowerSHell Parameter name.
EVENT DATA: <Data Name="SourceAddress">239.255.255.250</Data>
ValueQuery:   <Value name="SourceAddress">Event/EventData/Data[@Name=SourceAddress]</Value>
TRIGGER COMMAND:
       <Arguments>
             -file test5156.ps1
             -SourceAddress $(SourceAddress) 
SCRIPT PARAMS:
     Param(
         $SourceAddress,
¯\_(ツ)_/¯