Skip to content

Home

Jump to bottom
Mikhail Deynekin edited this page Dec 23, 2025 · 1 revision

Get-SecurityEventsByIP Documentation

Professional Windows Security Event Analysis Tool

Version PowerShell License

Quick Start

Prerequisites

  • Windows 10/11 or Windows Server 2012 R2+
  • PowerShell 5.1 or later
  • Administrator privileges
  • Security event log enabled

Installation

Option 1: Direct Download

# Download latest version
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/paulmann/Get-Windows-Security-Events-By-IP/main/Get-SecurityEventsByIP.ps1" -OutFile "Get-SecurityEventsByIP.ps1"

# Check version
.\Get-SecurityEventsByIP.ps1 -Version

# View help
.\Get-SecurityEventsByIP.ps1 -Help

Option 2: Self-Update Feature

# If you already have the script, update it
.\Get-SecurityEventsByIP.ps1 -Update

First Run Examples

# Quick console analysis - no file output
.\Get-SecurityEventsByIP.ps1 -IpAddress "192.168.1.100"

# Save to HTML report (auto-detected format)
.\Get-SecurityEventsByIP.ps1 -IpAddress "192.168.1.100" -OutputPath "report.html"

# All failed authentication attempts (last 24 hours)
.\Get-SecurityEventsByIP.ps1 -LastHours 24

# CIDR range analysis
.\Get-SecurityEventsByIP.ps1 -IpAddress "10.0.0.0/24" -OutputPath "network_scan.csv"

Documentation Structure

Core Topics

Advanced Topics

Support

Key Features

Core Capabilities

  • IP Address Filtering - Single IP, CIDR ranges, wildcard patterns
  • Comprehensive Event Collection - All failed authentication attempts
  • Multiple Output Formats - Text, CSV, JSON, HTML, Markdown, MySQL
  • Time-Based Filtering - Relative (LastHours/LastDays) and absolute ranges
  • Category Filtering - RDP, FileShare, Authentication, AllEvents
  • Status Code Decoding - Human-readable Windows status messages

New in v5.0.2

  • Self-Update Mechanism - Automatic updates from GitHub
  • Interactive Help System - Built-in -Help parameter
  • Enhanced Reliability - Fixed array handling issues
  • Auto-Format Detection - Detects format from file extension

Use Cases

Security Operations

  • Failed login attempt analysis
  • Brute force attack detection
  • Password spraying identification
  • Lateral movement monitoring

Compliance & Auditing

  • PCI-DSS event log requirements
  • HIPAA access control monitoring
  • GDPR breach detection
  • SOX IT general controls

Incident Response

  • Rapid IP investigation
  • Timeline reconstruction
  • Evidence collection
  • Forensic analysis

Quick Reference

Common Commands

# Maintenance
.\Get-SecurityEventsByIP.ps1 -Update              # Update to latest version
.\Get-SecurityEventsByIP.ps1 -Version             # Show version info
.\Get-SecurityEventsByIP.ps1 -Help                # Show help

# Basic Analysis
.\Get-SecurityEventsByIP.ps1 -IpAddress "IP"     # Analyze specific IP
.\Get-SecurityEventsByIP.ps1 -LastHours N        # Recent activity
.\Get-SecurityEventsByIP.ps1 -LastDays N         # Historical analysis

# Export Formats
-OutputPath "file.txt"    # Text format
-OutputPath "file.csv"    # CSV format
-OutputPath "file.json"   # JSON format
-OutputPath "file.html"   # HTML with charts
-OutputPath "file.md"     # Markdown format
-OutputPath "file.sql"    # MySQL export

Event Categories

Category Description Event IDs
RDP Remote Desktop Protocol 4624, 4625 (LogonType=10)
FileShare Network file access 4624, 4625 (LogonType=3)
Authentication General authentication 4624, 4625
AllEvents All security events with IPs All applicable

Pro Tips

  1. Use Auto-Format Detection: Let the script detect format from file extension

    .\Get-SecurityEventsByIP.ps1 -IpAddress "192.168.1.100" -OutputPath "report.html"

  2. Collect All Failed Attempts: Omit -IpAddress to collect all failed authentications

    .\Get-SecurityEventsByIP.ps1 -LastDays 7 -OutputPath "failed_auth.html"

  3. Use CIDR for Network Analysis: Analyze entire subnets

    .\Get-SecurityEventsByIP.ps1 -IpAddress "10.0.0.0/24" -Category RDP

  4. Custom Columns for Focused Analysis: Show only relevant data

    .\Get-SecurityEventsByIP.ps1 -IpAddress "IP" -ShowColumns TimeCreated,Account,SourceIP,Result

Contributing

We welcome contributions! See our Contributing Guide for details on:

  • Code standards
  • Testing requirements
  • Pull request process
  • Documentation updates

Support

License

This project is licensed under the MIT License - see the LICENSE file for details.

Author: Mikhail Deynekin
Version: 5.0.2
Last Updated: December 2024

Clone this wiki locally