PowerShell / PowerShell/PowerShell-RFC
RFC for pluggable script block/AMSI logging model
Nobody has claimed this yet.
- Dominant language
- PowerShell
- Stars
- 467
- Forks
- 140
- Avg merge
- 9m
- Merged PRs (30d)
- 1
Description
from #161/ #106
@PowerShell/powershell-committee discussed this one in detail today. We believe that there's massive value in figuring out how to tee ScriptBlock and AMSI style logs off to remote logging providers, but a bunch of the semantics in this RFC are specific to Splunk.
Instead, we think an RFC should be authored that builds a provider/plugin model for allowing multiple remote logging providers. This RFC should also give consideration to whether local logging targets should be treated the same way (e.g. if you want to exclusively log to a remote target, maybe in serverless/stateless scenarios). There should also be a consideration of whether we should have something like a Get-PSLog or Write-PSLog that are agnostic to logging providers.
The PowerShell Team has a strong interest in picking this up, but we have no idea when we can get to it right now. We only know that it should be a flexible, pluggable model.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading this RFC alongside issues #161 and #106, then review the PowerShell Committee discussion referenced in the issue. The proposed work is an RFC for a flexible provider/plugin model for ScriptBlock and AMSI-style logging, covering multiple remote providers, local targets, and provider-agnostic commands such as Get-PSLog or Write-PSLog.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- powershell
- Domain
- observability
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100