Advanced Features

Advanced Features

Mastering the powerful capabilities of Get-SecurityEventsByIP for complex security analysis scenarios.

---

CIDR Range Analysis

Analyze entire network segments with a single command using CIDR notation.

What is CIDR?

Classless Inter-Domain Routing (CIDR) allows you to specify IP address ranges in a compact format:

• /24 = 256 addresses (x.x.x.0 to x.x.x.255)
• /25 = 128 addresses
• /26 = 64 addresses
• /27 = 32 addresses
• /28 = 16 addresses
• /30 = 4 addresses

Examples

Analyze entire subnet for RDP activity:

.\Get-SecurityEventsByIP.ps1 -IpAddress "192.168.1.0/24" -Category RDP -OutputPath "rdp_subnet.csv"

Find brute force attempts across class C network:

.\Get-SecurityEventsByIP.ps1 -IpAddress "10.0.0.0/24" -Category Authentication -LastDays 7 -OutputPath "brute_force.html"

Corporate network security audit:

.\Get-SecurityEventsByIP.ps1 -IpAddress "172.16.0.0/16" -OutputPath "corporate_audit.json"

---

Time-Based Filtering

Precisely control the time window for security event analysis.

Relative Time Filters

Last N Hours:

.\Get-SecurityEventsByIP.ps1 -IpAddress "192.168.1.100" -LastHours 1 -OutputPath "last_hour.txt"
.\Get-SecurityEventsByIP.ps1 -IpAddress "192.168.1.100" -LastHours 24 -OutputPath "last_day.csv"

Last N Days:

.\Get-SecurityEventsByIP.ps1 -IpAddress "192.168.1.100" -LastDays 7 -OutputPath "last_week.html"
.\Get-SecurityEventsByIP.ps1 -IpAddress "192.168.1.100" -LastDays 30 -OutputPath "last_month.json"

Use Cases

• Incident response within specific timeframes
• Trending analysis over weeks or months
• Real-time monitoring (last 1-2 hours)
• Compliance reporting for specific periods

---

Custom Column Selection

Display only the data you need with the -ShowColumns parameter for focused analysis.

Available Columns

• TimeCreated - Event timestamp
• Account - User account name
• SourceIP - Originating IP address
• SourcePort - Source port number
• DestinationIP - Target IP address
• DestinationPort - Target port
• LogonType - Type of logon attempt
• Result - Success/Failure status
• ErrorCode - Windows error code
• EventID - Security event ID

Examples

Minimal view - only key columns:

.\Get-SecurityEventsByIP.ps1 -IpAddress "192.168.1.100" -ShowColumns TimeCreated,Account,Result

Network forensics:

.\Get-SecurityEventsByIP.ps1 -IpAddress "10.0.0.0/24" -ShowColumns TimeCreated,SourceIP,Account,Result,ErrorCode

Port analysis:

.\Get-SecurityEventsByIP.ps1 -IpAddress "*" -ShowColumns TimeCreated,SourceIP,SourcePort,DestinationPort,Account

---

Performance Optimization

Tips for Large Datasets

1. Use time filters for initial analysis:

# Analyze only recent events
.\Get-SecurityEventsByIP.ps1 -IpAddress "192.168.1.100" -LastHours 24 -OutputPath "recent.csv"

2. Limit columns to reduce processing:

# Only essential columns
.\Get-SecurityEventsByIP.ps1 -IpAddress "10.0.0.0/24" -ShowColumns TimeCreated,Account,Result

3. Use plain text output for large exports:

# Text files are faster than JSON/HTML
.\Get-SecurityEventsByIP.ps1 -IpAddress "*" -OutputPath "events.txt"

---

Troubleshooting Advanced Scenarios

CIDR Range Returns No Results

• Verify IP range is correct (use decimal notation: /24, not /255.255.255.0)
• Ensure events exist for that IP range
• Check event log isn't truncated

Custom Columns Not Showing

• Verify column names match exactly (case-sensitive)
• Separate multiple columns with commas, no spaces
• Use available columns only

Performance Issues with Large Time Ranges

• Reduce time window
• Use CIDR ranges to focus on subnets
• Export to text format instead of HTML

---

See Also: Usage Examples | Parameters Reference | Integration