PSWinFW/public/Get-PSFirewallLog.ps1

122 lines
3.9 KiB
PowerShell
Raw Normal View History

2019-11-01 08:20:21 +00:00
function Get-PSFirewallLog {
[CmdletBinding(DefaultParameterSetName = 'direct')]
param (
# Path to firewall log. Defaults to $ENV:SystemRoot\system32\LogFiles\Firewall\pfirewall.log if parameter not supplied.
[Parameter(Mandatory = $false, Position = 0, ValueFromPipeline, ParameterSetName = 'direct')]
[string]
$Path = "$ENV:SystemRoot\system32\LogFiles\Firewall\pfirewall.log",
# Path to firewall log directory. Defaults to $ENV:SystemRoot\system32\LogFiles\Firewall\ if parameter not supplied.
[Parameter(Mandatory = $false, ParameterSetName = 'indirect')]
[string]
$LogDirectory = "$ENV:SystemRoot\system32\LogFiles\Firewall\",
# Log file name.
[Parameter(Mandatory = $true, ParameterSetName = 'indirect')]
[string]
$LogFileName,
2019-11-09 14:38:30 +00:00
# Retrieve a profile's log using registry settings of the local or remote machine
2019-11-01 08:20:21 +00:00
[Parameter(Mandatory = $true, ParameterSetName = 'auto')]
2019-11-09 14:38:30 +00:00
[Parameter(Mandatory = $true, ParameterSetName = 'remote')]
2019-11-01 08:20:21 +00:00
[ValidateSet('Public','Private','Domain')]
[string]
$LogProfile,
# Number of firewall events to retrieve. Defaults to -1 (All events).
2019-11-01 08:20:21 +00:00
[Parameter(Mandatory = $false)]
[int]
$Tail = -1,
2019-11-01 08:20:21 +00:00
# ComputerName to retrieve log from
2019-11-09 14:38:30 +00:00
[Parameter(Mandatory = $true, ParameterSetName = 'remote')]
2019-11-01 08:20:21 +00:00
[string]
$ComputerName,
# Follow the log
[Parameter(Mandatory = $false)]
[switch]
$Wait
2019-11-01 08:20:21 +00:00
)
begin {
if($PSCmdlet.ParameterSetName -eq 'auto') {
$Path = Get-PSFirewallLogPath -LogProfile $LogProfile -Verbose:$VerbosePreference
}
elseif($PSCmdlet.ParameterSetName -eq 'remote') {
$Path = Get-PSFirewallLogPath -LogProfile $LogProfile -ComputerName $ComputerName -Verbose:$VerbosePreference
}
}
process {
if($PSCmdlet.ParameterSetName -eq 'indirect') {
# Check for trailing slash and add if necessary
if(!$LogDirectory.EndsWith('\')) {
$LogDirectory += '\'
}
$logPath = $LogDirectory + $LogFileName
}
else {
$logPath = $Path
}
if(Test-Path $logPath) {
$members = @{
"Date" = 0
"Time" = 1
"Action" = 2
"Protocol" = 3
"SourceIP" = 4
"DestinationIP" = 5
"SourcePort" = 6
"DestinationPort" = 7
"Size" = 8
"TcpFlags" = 9
"TcpSyn" = 10
"TcpAck" = 11
"TcpWin" = 12
"IcmpType" = 13
"IcmpCode" = 14
"Info" = 15
"Path" = 16
}
2019-11-01 08:20:21 +00:00
$count = (Get-Content -Path $logPath).Count
2019-11-01 08:20:21 +00:00
# Check if outputting all events from the log and cut the first 5 lines that aren't events.
if(($Tail -lt 0) -or ($Tail -gt $count)) {
$Tail = $count - 5
}
2019-11-01 08:20:21 +00:00
Write-Verbose "Log has $count lines. Retrieving $Tail lines."
2019-11-01 08:20:21 +00:00
$c = "Get-Content -Path $logPath -Tail $Tail"
2019-11-01 08:20:21 +00:00
if($Wait) {
$c = "$c -Wait"
}
Invoke-Expression $c | ForEach-Object {
$line = $_
$split = $line -split ('\s')
2019-11-01 08:20:21 +00:00
$fwEvent = New-Object PSCustomObject
foreach($member in $members.GetEnumerator() | Sort-Object Value) {
$fwEvent | Add-Member NoteProperty -Name $member.Name -Value $split[$member.Value]
2019-11-01 08:20:21 +00:00
}
$fwEvent.pstypenames.insert(0, 'PSWinFW.Log.Event')
$fwEvent
2019-11-01 08:20:21 +00:00
}
}
else {
Write-Error "Failed to retrieve log at $logPath."
}
}
}