使用PowerShell分析流日志

上文中介绍了流日志的一些基本功能和配置方法，最后也看了下流日志的格式，很明显是没办法直接阅读的，一般还是推荐用traffic analytics或者其他企业级的ELK,Splunk之类的进行可视化处理

如果只是自己查一些log的话，其实写个脚本把JSON文件转换成可读性更强的csv就够了，下边分享下自己写的用来转换的脚本

param (
    [parameter(Mandatory = $false)]
    $NSGLogFilePath = "C:\Users\xy\Downloads\PT1H.json",
    [parameter(Mandatory = $false)]
    $ExportTo = [Environment]::GetFolderPath("Desktop") + "\" + "NSGLog-" + $(Get-Date -Format "yyyyMMdd-HHmmss") + ".csv"

)

if (!(test-path $NSGLogFilePath)) {
    throw "$NSGLogFilePath not exist"
}

$JSON = Get-Content $NSGLogFilePath
$JSON = $JSON | ConvertFrom-Json
$i = 0
[pscustomobject[]]$NSGObjects = $null

foreach ($a in $JSON.records.GetEnumerator()) {
    foreach ($b in $a.properties.flows.GetEnumerator()) {
        
        if ($null -ne $b.flows.flowTuples) {
            $log = $b.flows.flowTuples.split(",")
            $rule = $b.rule
            # Protocol 
            if ($log[5] -eq 'T') {
                $Protocol = 'TCP'
            }
            elseif ($log[5] -eq 'U') {
                $Protocol = 'UDP'
            }
            else {
                $Protocol = $log[5]
            }

            # Traffic Flow
            if ($log[6] -eq 'O') {
                $Direction = 'Outbound'
            }
            elseif ($log[6] -eq 'I') {
                $Direction = 'Inbound'
            }
            else {
                $Direction = $log[6]
            }

            # Decision 
            if ($log[7] -eq 'A') {
                $Decision = 'Allow'
            }
            elseif ($log[7] -eq 'D') {
                $Decision = 'Deny'
            }
            else {
                $Decision = $log[7]
            }

            # Flow state
            if ($log[8] -eq 'B') {
                $state = 'Begin'
            }
            elseif ($log[8] -eq 'C') {
                $state = 'Continuing '
            }
            elseif ($log[8] -eq 'E') {
                $state = 'End '
            }
            else {
                $state = $log[8]
            }
        
            $i++
            $NSGObject = New-Object PSObject -Property $([ordered]@{
                    Timestamp                    = Get-Date ([timezone]::CurrentTimeZone.ToLocalTime(([datetime]'1/1/1970').AddSeconds($log[0]))) -uformat "%Y-%m-%d %H:%M:%S"
                    RuleName                     = $rule
                    MAC                          = $a.macAddress
                    SourceIP                     = $log[1]
                    DestinationIP                = $log[2]
                    SourcePort                   = $log[3]
                    DestinationPort              = $log[4]
                    Protocol                     = $Protocol
                    TrafficFlow                  = $Direction
                    TrafficDecision              = $Decision
                    FlowState                    = $State
                    PacketsSourcetoDestination   = $log[9]
                    BytesSentSourcetoDestination = $log[10]
                    PacketsDestinationtoSource   = $log[11]
                    BytesSentDestinationtoSource = $log[12]

                })
            $NSGObjects += $NSGObject
        }
        

    }
}

Write-Output "$(Get-Date) * $i records found"

if ($null -ne $NSGObjects) {
    $NSGObjects | Export-Csv -LiteralPath $ExportTo -NoTypeInformation -Force -ErrorAction Stop
    Write-Output "$(Get-Date) * Export successfully, Please check $ExportTo"
}
else {
    Write-Host "$(Get-Date) * Something wrong" -ForegroundColor Red
            
}

使用起来也非常简单，直接调用，然后加个JSON文件的路径作为参数就够了

可以看到转换后立马强了N多个档次