Issue:
Why doesn´t the Elements Security Center portal's Events > Security Events alert detections always show or include the Powershell command which was run one the device, if the detection process is Powershell?
Resolution:
The Powershell command is only shown in the Security Events alert detection if the detection source is DeepGuard. If the detection source is either File Scanning (Real-time scanning) or AMSI (Antimalware Scan Interface), then they do not include the command line information, because it depends on which detection engine produced the event.
- DeepGuard events include the
CommandLine field — this is where you'll typically see the full PowerShell invocation (e.g., the powershell.exe command with arguments). - File Scanning / Real-time scanning (OAS) events focus on the file being scanned, not the launching process. They include
filePath and accessor info but typically not the command line of the process. - AMSI detections have limited portal visibility
If you have Endpoint Detection and Response (EDR) included in your subscription, you can enable Response actions the Elements profile and then use the "Retrieve PowerShell history" investigative action to get more details about any PowerShell commands that have been run on a device.
Steps how to enable advanced response actions: https://support.withsecure.com/userguides/product.html#business/edr/latest/en/task_09832986687949D783F3A086C43A2ADB-latest-en
List of investigative response actions: https://support.withsecure.com/userguides/product.html#business/edr/latest/en/concept_C1A7FE15A7794BBDB0D5767C3903D005-latest-en
Article no: 000015539