Notifications for file audit events on Windows

We covered this topic when we walked through monitoring for successful and failed logon events. Like the logon notification Sentinel that we built in the previous chapter, it's possible to build out a file audit Sentinel with notifications by subscribing to new Audit ACL events and notifying the user when an interesting one is generated.

The following steps show the code/commands in PowerShell to do so:

1. First, we create an EventLogWatcher for the Security event log and enable it:

   $watcher = New-Object System.Diagnostics.Eventing.Reader.EventLogWatcher("Security")
   $watcher.Enabled = $true

2. Then, we implement the method that should be called whenever a new event is created. We will call it OnEventWritten:

   $OnEventWritten =
   {
      $e = $event.sourceEventArgs.EventRecord
      if ($e.Id -eq 4656)
      {
        if ($e.FormatDescription() -like "*passwords...