From 023e9727f3f5f98e6bdc5a308f6d290c1418c02b Mon Sep 17 00:00:00 2001 From: Eric Conrad Date: Tue, 20 Sep 2016 12:25:48 -0400 Subject: [PATCH] Update README.md --- README.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/README.md b/README.md index c7fe248..81fc334 100644 --- a/README.md +++ b/README.md @@ -10,6 +10,7 @@ Sample evtx files are in the .\evtx directory ## Usage: + ` .\DeepBlue.ps1 ` @@ -17,26 +18,36 @@ Sample evtx files are in the .\evtx directory ## Examples: Process local Windows security event log: + ` .\DeepBlue.ps1 ` + or: + ` .\DeepBlue.ps1 -log security ` + Process local Windows system event log: + ` .\DeepBlue.ps1 -log system ` + or: + ` .\DeepBlue.ps1 "" system ` + Process evtx file: ` .\DeepBlue.ps1 .\evtx\new-user-security.evtx ` + or: + ` .\DeepBlue.ps1 -file .\evtx\new-user-security.evtx `