Why doesn\u00b4t the Elements Security Center portal's Events > Security Events<\/strong> alert detections always show or include the Powershell command which was run one the device, if the detection process is Powershell?<\/p>\n The Powershell command is only shown in the Security Events alert detection if the detection source is DeepGuard. If the detection source is either File Scanning<\/strong> (Real-time scanning) or AMSI<\/strong> (Antimalware Scan Interface), then they do not include the command line information, because it depends on which detection engine produced the event.\u00a0<\/p>\n If you have Endpoint Detection and Response (EDR) included in your subscription, you can enable Response <\/strong>actions the Elements profile and then use the "Retrieve PowerShell history" investigative action to get more details about any PowerShell commands that have been run on a device.\u00a0<\/p>\n Steps how to enable advanced response actions: https:\/\/support.withsecure.com\/userguides\/product.html#business\/edr\/latest\/en\/task_09832986687949D783F3A086C43A2ADB-latest-en<\/a>\u00a0<\/p>\nResolution:<\/h3>\n
\n
CommandLine<\/code> field \u2014 this is where you'll typically see the full PowerShell invocation (e.g., the powershell.exe<\/code> command with arguments).\u00a0<\/li>\nfilePath<\/code> and accessor info but typically not the command line of the process.<\/li>\n