paulmann · open source
Get-Windows-Security-Events-By-IP
Everything a server knows about one IP address
PowerShell forensics: pull every Windows Security event for one IPv4 or IPv6 address, decode logon failure sub-codes and export HTML, CSV or JSON for abuse reports and SOC triage.
What it does
- IPv4 and IPv6 filters across the Security log
- Failure codes translated into readable reasons
- HTML, CSV and JSON reports for abuse desks
Built with
PowerShell