diff --git a/PSWinFW.psd1 b/PSWinFW.psd1 index 8b0c2b8..e69de29 100644 Binary files a/PSWinFW.psd1 and b/PSWinFW.psd1 differ diff --git a/formats/FirewallEvent.Format.ps1xml b/formats/FirewallEvent.Format.ps1xml new file mode 100644 index 0000000..35d36c2 --- /dev/null +++ b/formats/FirewallEvent.Format.ps1xml @@ -0,0 +1,78 @@ + + + + + FirewallEvent + + PSWinFW.Log.Event + + + + + 10 + + + 8 + + + 6 + + + + 4 + + + + + + 5 + + + + 5 + + + + 7 + + + + + + + Date + + + Time + + + Action + + + Protocol + + + SourceIP + + + DestinationIP + + + SourcePort + + + DestinationPort + + + Size + + + Path + + + + + + + + \ No newline at end of file diff --git a/public/Get-PSFirewallLog.ps1 b/public/Get-PSFirewallLog.ps1 index e55e033..5c13189 100644 --- a/public/Get-PSFirewallLog.ps1 +++ b/public/Get-PSFirewallLog.ps1 @@ -16,9 +16,9 @@ function Get-PSFirewallLog { [string] $LogFileName, - # Retrieve a profile's log using registry settings of the local machine + # Retrieve a profile's log using registry settings of the local or remote machine [Parameter(Mandatory = $true, ParameterSetName = 'auto')] - [Parameter(ParameterSetName = 'remote')] + [Parameter(Mandatory = $true, ParameterSetName = 'remote')] [ValidateSet('Public','Private','Domain')] [string] $LogProfile, @@ -28,23 +28,8 @@ function Get-PSFirewallLog { [int] $Tail = 0, - # Include extended TCP information (TCP Flags, TCP Sequence Number, TCP ACK Number, TCP Window Size). Defaults to false. - [Parameter(Mandatory = $false)] - [switch] - $IncludeTcpInfo, - - # Include extended ICMP information (ICMP Type and Code). Defaults to false. - [Parameter(Mandatory = $false)] - [switch] - $IncludeIcmpInfo, - - # Include Info field. Defaults to false. - [Parameter(Mandatory = $false)] - [switch] - $IncludeInfo, - # ComputerName to retrieve log from - [Parameter(Mandatory = $false, ParameterSetName = 'remote')] + [Parameter(Mandatory = $true, ParameterSetName = 'remote')] [string] $ComputerName ) @@ -96,34 +81,16 @@ function Get-PSFirewallLog { "SourcePort" = 6 "DestinationPort" = 7 "Size" = 8 + "TcpFlags" = 9 + "TcpSyn" = 10 + "TcpAck" = 11 + "TcpWin" = 12 + "IcmpType" = 13 + "IcmpCode" = 14 + "Info" = 15 + "Path" = 16 } - if($IncludeTcpInfo) { - $tcpMembers = @{ - "TcpFlags" = 9 - "TcpSyn" = 10 - "TcpAck" = 11 - "TcpWin" = 12 - } - - $members += $tcpMembers - } - - if($IncludeIcmpInfo) { - $icmpMembers = @{ - "IcmpType" = 13 - "IcmpCode" = 14 - } - - $members += $icmpMembers - } - - if($IncludeInfo) { - $members += @{ "Info" = 15 } - } - - $members += @{ "Path" = 16 } - $log | ForEach-Object { $line = $_ $split = $line -split ('\s') @@ -134,6 +101,8 @@ function Get-PSFirewallLog { $fwEvent | Add-Member NoteProperty -Name $member.Name -Value $split[$member.Value] } + $fwEvent.pstypenames.insert(0, 'PSWinFW.Log.Event') + $fwEvent } }