diff --git a/README.md b/README.md index c7fe248..81fc334 100644 --- a/README.md +++ b/README.md @@ -10,6 +10,7 @@ Sample evtx files are in the .\evtx directory ## Usage: + ` .\DeepBlue.ps1 ` @@ -17,26 +18,36 @@ Sample evtx files are in the .\evtx directory ## Examples: Process local Windows security event log: + ` .\DeepBlue.ps1 ` + or: + ` .\DeepBlue.ps1 -log security ` + Process local Windows system event log: + ` .\DeepBlue.ps1 -log system ` + or: + ` .\DeepBlue.ps1 "" system ` + Process evtx file: ` .\DeepBlue.ps1 .\evtx\new-user-security.evtx ` + or: + ` .\DeepBlue.ps1 -file .\evtx\new-user-security.evtx `