asked on

How to add conditional for IpAddress equals to dash in security log

How do I add a conditional for the ipAddress.

if IpAddress -eq "-" do not count it or do not add it into the csv. See attachment

Get-WinEvent -FilterHashTable @{LogName='Security'; ProviderName='Microsoft-Windows-Security-Auditing';id=4624; StartTime="3/28/20"; EndTime="3/30/20"} | ForEach-Object {
	$xml = [xml]$_.ToXml().Replace('xmlns', 'dummy')
	$_ | Select-Object -Property TimeCreated, MachineName,`
	 @{n='TargetUserName';	e={"$($xml.SelectSingleNode("Event/EventData/Data[@Name='TargetDomainName']").InnerText)\$($xml.SelectSingleNode("Event/EventData/Data[@Name='TargetUserName']").InnerText)"}},
	 @{n='LogonType'; e={$xml.SelectSingleNode("Event/EventData/Data[@Name='LogonType']").InnerText}},
	 @{n='WorkstationName'; e={$xml.SelectSingleNode("Event/EventData/Data[@Name='WorkstationName']").InnerText}},
	 @{n='IpAddress'; e={$xml.SelectSingleNode("Event/EventData/Data[@Name='IpAddress']").InnerText}},
	 @{n='IpPort'; e={$xml.SelectSingleNode("Event/EventData/Data[@Name='IpPort']").InnerText}}
	} | Export-Csv D:\ger\SCRIPTS\EventID_4624.csv -nti

Open in new window

EventID_4624---Copy.csv

ASKER CERTIFIED SOLUTION

oBdA

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

namerg

ASKER

Thanks but i got this:

Interactive : The term 'Interactive' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included,
verify that the path is correct and try again.
At D:\ger\SCRIPTS\GetWinEvent4624.ps1:95 char:6
+     2 = Interactive

Open in new window

But it looks like i am getting the error for every index within the array

 $logonTypes = @{	
	 2 = Interactive
	 3 = Network
	 4 = Batch
	 5 = Service
	 7 = Unlock
	 8 = NetworkCleartext
	 9 = NewCredentials
	 10 = RemoteInteractive
	 11 = CachedInteractive
 }

Open in new window

oBdA

Sorry, Copy and Paste error.
Fixed above, just download again (changed lines 2-10).

namerg

ASKER

Thank You Very Much