sungshu手札筆記本

嗯!!

煩死人的資安事件!!LOG無法自動寄信!!

以前都靠cmd來完成看來這次沒辦法只好Powershell初體驗了!!不免一番的要先拜讀google大神

研究好幾天終於東拼西湊弄出來的小程式

Powershell 指令如下

 
$time= get-date -Format yyy/MM/dd
$ip=foreach($ipv4 in (ipconfig) -like '*IPv4*') { ($ipv4 -split ' : ')[-1]}
$CompName = (Get-Content Env:\COMPUTERNAME).ToString()
$numbers = 1,2
$evid = 4618,5124
    $mailbody = Get-WinEvent -FilterHashtable @{Logname='Security'; id = $evid ; level  = $numbers} | Select-Object -First 1
       $msg = "Time: " + ($mailbody | select -ExpandProperty TimeCreated)+ "`r`n" + "`r`n" +
              "ip:"+($ip)+ "`r`n" + "`r`n" +
              "CompName:" + ($CompName) + "`r`n" + "`r`n" +
              "Message: " + ($mailbody  | select -ExpandProperty Message) + "`r`n" + "`r`n" +
              "EventID: " + ($mailbody  | select -ExpandProperty ID)
$mailsub="EventID: " + ($mailbody  | select -ExpandProperty ID)
$maillv= "level:"+ ($mailbody  | select -ExpandProperty level)           
$mail = New-Object System.Net.Mail.MailMessage
$mail.From = "123@abc.com.tw"
$mail.To.Add("sungshu@abc.com.tw")
$mail.Subject = "[資安告警][$maillv]Windows-Security-$mailsub-$time-$ip"
$mail.IsBodyHtml=$false  
$mail.Body = $msg
$smtp = New-Object System.Net.Mail.SmtpClient("mailserver")
$smtp.Port=25
$smtp.EnableSsl = $false
$smtp.Credentials = New-Object System.Net.NetworkCredential("123@abc.com.tw", "password")
$smtp.Send($mail)

事件檢視器加入觸發排程

觸發後寄出通知信

收工!!

後續還需要匯入各台伺服器又是後面要去找指令來執行了!!!

備註紀錄!!以免忘記!!

參考文章連結 :

Windows Server 2012 R2 設定事件檢視器對特定的事件觸發管理動作來發送郵件通知管理員搭配powershell | MIS的背影 (pmail.idv.tw)

“Send an e-mail” -Windows Server 2012 Task Scheduler deprecated feature [SOLVED!] (netwoven.com)

【powershell】Windows系統產生錯誤時，系統自動發送通知信 | Anny' IT Note - 點部落 (dotblogs.azurewebsites.net)

Filtering Event Log Events with PowerShell | Scripting Blog (microsoft.com)

Filtering PowerShell Objects | IT Pro (itprotoday.com)

Get-WinEvent (forsenergy.com)

KingKong Bruce記事: 2019 (kkbruce.net)

Noname, No Criteria: 使用工作排程器，讓Windows備份執行完後，自動寄通知郵件 (lunarforest.blogspot.com)

powershell - Getting IPV4 address from ipconfig - Super User

powershell - Get-WinEvent -FilterHashTable with multiple IDs in a variable not working - Stack Overflow

powershell script - iT 邦幫忙::一起幫忙解決難題，拯救 IT 人的一天 (ithome.com.tw)

PowerShell Tip of the Week: Get IP address - Powershellbros.com

PowerShell 筆記 (poychang.net)

powershell:Get-EventLog中缺少事件描述，但Get-winEvent和Event Viewer中存在事件描述 - Codebug

Powershell使用帶有哈希表的Get-WinEvent查詢非常特定的時間範圍 (dewebc.com)

Powershell-查詢主機名及IP地址 - IT閱讀 (itread01.com)

Scheduled task email notification Server 2012 (microsoft.com)

Send-MailMessage (Microsoft.PowerShell.Utility) - PowerShell | Microsoft Docs

Step-by-Step: How to Trigger an Email Alert when a Specific Windows Service Starts or Stops on Windows Server 2016 – Clustering For Mere Mortals

windows - How to send email when SPECIFIC scheduled task fails to run - Stack Overflow

windows - Powershell get ipv4 address into a variable - Stack Overflow

Windows日誌篩選 - IT閱讀 (itread01.com)

使用 FilterHashtable 建立 Get-WinEvent 查詢 - PowerShell | Microsoft Docs

使用 Windows PowerShell 檢查網路設定是否正確 - iT 邦幫忙::一起幫忙解決難題，拯救 IT 人的一天 (ithome.com.tw)

耕作筆記本: [筆記] 使用 Powershell 查詢系統事件 (jumping-fun.blogspot.com)

馭龍 EventLog 讀取模塊的迭代歷程_騰訊玄武實驗室 - 微文庫 (luoow.com)

實現自動化報表mail定期寄送 - iT 邦幫忙::一起幫忙解決難題，拯救 IT 人的一天 (ithome.com.tw)