The PowerShell History script acquires data from event logs specific to PowerShell history when the script is enabled on host endpoints. This script can be requested for Windows host endpoints only.
Note
PowerShell History script support is not provided for macOS or Linux host endpoints.
You cannot copy, edit, reset, import, or delete the PowerShell History script or use this script in data acquisition scripts you create. This script does not appear on the Data Acquisition Scripts page.
.png "HX_SSType_PowerShell_scap.png")
Requesting PowerShell History data
Select Hosts in the Endpoint Security (HX) Web UI.
Select one or more hosts.
From the Actions menu, select PowerShell History. Alternatively, you can select PowerShell History from the Acquire menu on a host details page.
Click Go to access the Acquire PowerShell History dialog box.
In the Comment field, enter the reason you want to acquire the file and log details about the data acquisition request that you want to track.
Click Acquire to submit the request.
PowerShell History data can be requested as a regular data acquisition. See Requesting a data acquisition.