title: Get details of event from System.Diagnostics.EventLogEntry
body: <p>I'm writing a PowerShell script to keep an eye on some event log entries. I'm able to subscribe to the Security log and trigger a script block when one of the events is logged. However, I can't find how to get the relevant data from the event object. The event object I am interacting with is of type <code>System.Diagnostics.EventLogEntry</code>. I checked the <a href="https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlogentry?view=netframework-4.8" rel="nofollow noreferrer">documentation</a> of that class and wrote all of the available properties to the console with a script block:</p>
  <pre><code>$CredentialGuardEventIds = 5379,5381,5382
  $SecurityLog = Get-EventLog -List | Where-Object {$_.Log -eq 'Security'}
  
  Register-ObjectEvent -InputObject $SecurityLog -SourceIdentifier NewCredentialEvent -EventName EntryWritten -Action {
      $entry = $event.SourceEventArgs.Entry
      if ($CredentialGuardEventIds -contains $entry.EventID) {
          Write-Host &quot;Event $($entry.EventID) occured&quot;
          Write-Host &quot;CanRaiseEvents: $($entry.CanRaiseEvents)&quot;
          Write-Host &quot;Category: $($entry.Category)&quot;
          Write-Host &quot;CategoryNumber: $($entry.CategoryNumber)&quot;
          Write-Host &quot;Container: $($entry.Container)&quot;
          Write-Host &quot;Data: $($entry.Data)&quot;
          Write-Host &quot;DesignMode: $($entry.DesignMode)&quot;
          Write-Host &quot;EntryType: $($entry.EntryType)&quot;
          Write-Host &quot;EventID: $($entry.EventID)&quot;
          Write-Host &quot;Events: $($entry.Events)&quot;
          Write-Host &quot;Index: $($entry.Index)&quot;
          Write-Host &quot;InstanceId: $($entry.InstanceId)&quot;
          Write-Host &quot;MachineName: $($entry.MachineName)&quot;
          Write-Host &quot;Message: $($entry.Message)&quot;
          Write-Host &quot;ReplacementStrings: $($entry.ReplacementStrings)&quot;
          Write-Host &quot;Site: $($entry.Site)&quot;
          Write-Host &quot;Source: $($entry.Source)&quot;
          Write-Host &quot;TimeGenerated: $($entry.TimeGenerated)&quot;
          Write-Host &quot;TimeWritten: $($entry.TimeWritten)&quot;
          Write-Host &quot;UserName: $($entry.UserName)&quot;
      }
  }
  </code></pre>
  <p>Which outputs the following data:</p>
  <pre><code>CanRaiseEvents:
  Category: (13824)
  CategoryNumber: 13824
  Container:
  Data:
  DesignMode:
  EntryType: SuccessAudit
  EventID: 5381
  Events:
  Index: 771286
  InstanceId: 5381
  MachineName: REDACTED
  Message: Vault credentials were read.
  
  Subject:
          Security ID:            S-1-5-26-2325928431-9938217593-9384716351-3004
          Account Name:           redacted
          Account Domain:         REDACTED
          Logon ID:               0x44d9f
  
  This event occurs when a user enumerates stored vault credentials.
  ReplacementStrings: S-1-5-21-2356930457-929305828-1234252251-1534 redacted REDACTED 0x3459f 142 6 2019-09-20T23:33:31.671135000Z 15136
  Site:
  Source: Microsoft-Windows-Security-Auditing
  TimeGenerated: 09/24/2019 21:26:27
  TimeWritten: 09/24/2019 21:26:27
  UserName:
  </code></pre>
  <p>However, the data I am interested in appears in the &quot;Details&quot; tab of the event viewer:</p>
  <p><a href="https://i.stack.imgur.com/Fp4CX.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Fp4CX.png" alt="enter image description here" /></a></p>
  <p>How can I access the data in the Details pane from a <code>System.Diagnostics.EventLogEntry</code> object?</p>
  <h2>Note</h2>
  <p>The events in question were added in a recent release of Windows 10 (I believe 1903), and are related to Windows Defender Credential Guard. I can't find much documentation for them, but a good video on why they were added can be found here: <a href="https://www.youtube.com/watch?v=1JJAob5fkWs&amp;t=736s" rel="nofollow noreferrer">https://www.youtube.com/watch?v=1JJAob5fkWs&amp;t=736s</a></p>