Last active
April 12, 2021 14:40
-
-
Save pstakuu/d3f719e07f819907c373869eddfd8aab to your computer and use it in GitHub Desktop.
Parsing of Windows RADIUS Logs for date, status,distinguishedname,username,sourceIP
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| $files= Get-childitem Y: | select -last 90 | |
| function Process-RADIUSLogs () { | |
| [CmdletBinding()] | |
| param( | |
| $file, | |
| [switch]$onlyAccepted | |
| ) | |
| Write-Verbose "Processing $file" | |
| $data = get-Content $file | |
| for ($i=0; $i -lt $data.count; $i++) { | |
| Write-Verbose "Processing line $i" | |
| if($onlyAccepted) { | |
| Write-Verbose "Processing only authenticated attempts" | |
| $data[$i] -match '".+?",".+?",(?<date>.+?),2,,"(?<distinguishedname>.+?)"' | out-null | |
| if ($matches) { | |
| New-object -TypeName PSObject -Property @{ | |
| Date = $matches['date'] | |
| DistinguishedName = $matches['distinguishedname'] | |
| } | |
| $matches = $Null | |
| } | |
| } else { | |
| $data[$i] -match '"(?<server>.+?)","(?<process>.+?)",(?<date>.+?),(?<status>1|2|3),"(?<username>.+?)","(?<distinguishedname>.+?)","(?<publicIP>.+?)","(?<srcIP>.+?)",' | out-null | |
| if ($matches) { | |
| New-object -TypeName PSObject -Property @{ | |
| Date = $matches['date'] | |
| Status = $matches['status'] | |
| Username = $matches['username'] | |
| DistinguishedName = $matches['distinguishedname'] | |
| SourceIP = $matches['srcIP'] | |
| } | |
| $matches = $Null | |
| } | |
| } | |
| } | |
| } | |
| $results = $files |Foreach {Process-RADIUSLogs -file $_.fullname -verbose} | |
| $results | export-csv C:\temp\RADIUSLOGS.csv -NoTypeInformation |
Author
Author
Updated to be able to specify only accepted connections and fix a bug where the regex value from previous run was still loaded so it gave faulty outputs
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Updated to not use $i=$i++ in the for loop. PROTIP: the 'i' is incremented AFTER the operation. so $i=0; then $i gets 1 added. but I is still 0...