Skip to content

Instantly share code, notes, and snippets.

@pstakuu
Last active April 12, 2021 14:40
Show Gist options
  • Select an option

  • Save pstakuu/d3f719e07f819907c373869eddfd8aab to your computer and use it in GitHub Desktop.

Select an option

Save pstakuu/d3f719e07f819907c373869eddfd8aab to your computer and use it in GitHub Desktop.
Parsing of Windows RADIUS Logs for date, status,distinguishedname,username,sourceIP
$files= Get-childitem Y: | select -last 90
function Process-RADIUSLogs () {
[CmdletBinding()]
param(
$file,
[switch]$onlyAccepted
)
Write-Verbose "Processing $file"
$data = get-Content $file
for ($i=0; $i -lt $data.count; $i++) {
Write-Verbose "Processing line $i"
if($onlyAccepted) {
Write-Verbose "Processing only authenticated attempts"
$data[$i] -match '".+?",".+?",(?<date>.+?),2,,"(?<distinguishedname>.+?)"' | out-null
if ($matches) {
New-object -TypeName PSObject -Property @{
Date = $matches['date']
DistinguishedName = $matches['distinguishedname']
}
$matches = $Null
}
} else {
$data[$i] -match '"(?<server>.+?)","(?<process>.+?)",(?<date>.+?),(?<status>1|2|3),"(?<username>.+?)","(?<distinguishedname>.+?)","(?<publicIP>.+?)","(?<srcIP>.+?)",' | out-null
if ($matches) {
New-object -TypeName PSObject -Property @{
Date = $matches['date']
Status = $matches['status']
Username = $matches['username']
DistinguishedName = $matches['distinguishedname']
SourceIP = $matches['srcIP']
}
$matches = $Null
}
}
}
}
$results = $files |Foreach {Process-RADIUSLogs -file $_.fullname -verbose}
$results | export-csv C:\temp\RADIUSLOGS.csv -NoTypeInformation
@pstakuu
Copy link
Author

pstakuu commented Apr 12, 2021

Updated to not use $i=$i++ in the for loop. PROTIP: the 'i' is incremented AFTER the operation. so $i=0; then $i gets 1 added. but I is still 0...

@pstakuu
Copy link
Author

pstakuu commented Apr 12, 2021

Updated to be able to specify only accepted connections and fix a bug where the regex value from previous run was still loaded so it gave faulty outputs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment