query_event_log

What query_event_log does on Procmon

AI agents call query_event_log to retrieve information from Procmon without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why query_event_log is rated Low

This tool retrieves and queries Windows event log entries using the Get-WinEvent cmdlet. No data is created, modified, deleted, or executed. However, event logs may contain sensitive security information (authentication failures, privilege escalation attempts, etc.), so unauthorized or excessive querying could expose confidential data or support reconnaissance for attacking a system.

From the tool's definition Tool name 'query_event_log' and description 'Query a Windows event log via Get-WinEvent FilterHashtable' indicate a read-only operation that retrieves event log data without modification.

The rule that runs query_event_log safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Procmon, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For query_event_log, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "query_event_log": {}
  }
}

Questions about query_event_log