本文讲的是
使用Neo4j可视化Windows日志,
介绍
Import-Module C:UsersAntonDownloadsGet-WinEventData.ps1 $File = "C:UsersAntonDesktoplogs.csv" Clear-Content "C:UsersAntonDesktoplogs.csv" Add-Content $File -Value Source","Destination","DestinationPort","Application`n -NoNewline $EventsID3 = Get-WinEvent -FilterHashtable @{logname="Microsoft-Windows-Sysmon/Operational";id=3} | Get-WinEventData | select EventDataSourceIp,EventDataDestinationIp,EventDataDestinationPort,EventDataImage foreach ($Event3 in $EventsID3) { $output = Write-Output $Event3.EventDataSourceIp","$Event3.EventDataDestinationIp","$Event3.EventDataDestinationPort","$Event3.EventDataImage`n Add-Content $File -Value $output -NoNewline }
load csv with headers from "file:///logs.csv" AS csvLine CREATE (source:address { address: csvLine.Source }) CREATE (destination:addressd { addressd: csvLine.Destination }) CREATE (DestinationPort:DestPort { destport: csvLine.DestinationPort }) CREATE (application:app { Application: csvLine.Application }) CREATE (source)-[:ConnectedTo]->(destination)-[:Using]->(application)-[:OnPort]->(DestinationPort)
原文发布时间为:2017年7月31日
本文作者:愣娃
本文来自云栖社区合作伙伴嘶吼,了解相关信息可以关注嘶吼网站。