Skip to content

Commit

Permalink
change
Browse files Browse the repository at this point in the history
  • Loading branch information
@YosfanEilay
YosfanEilay committed Feb 21, 2024
1 parent 1501640 commit 5d8275b
Show file tree
Hide file tree
Showing 3 changed files with 82 additions and 22 deletions.
77 changes: 65 additions & 12 deletions 02-LogModules/Auth.Log/03-Features/05-UsersGroupsActivity.ps1
View file
Original file line number Diff line number Diff line change
Expand Up @@ -168,6 +168,9 @@ if ($useradd_Count -ge 1) {
Write-Output " |"
Write-Output " V User Creation Activity - Statistics Table"

# flag to stop $Border iteration after first iteration
$Flag = "Enable"

# foreach loop to iterate and past each event separate from the hashtable
foreach ($Event in $UsersGroupActivity_HT["useradd"]) {

Expand All @@ -181,12 +184,17 @@ if ($useradd_Count -ge 1) {
$UserCreation = $UserCreation.PadRight($MaxChar_UserCreation)

# Output the result for the current event
$Result = Write-Output "| Event: User Creation Activity | Time: $TimeAndDate | Created User Name: $UserCreation |"
$Result = Write-Output "| Time: $TimeAndDate | Event: User Creation Activity | Created User Name: $UserCreation |"

# multiply $Result.Length with "-" hyfen symbol to get the boarder
$Border = '-' * ($Result.Length - 2)

# print the result in a table
if ($Flag -match "Enable") {
Write-Output " +$Border+"
$Flag = "Disable"
}

Write-Output " $Result"
}

Expand Down Expand Up @@ -243,6 +251,9 @@ if ($userdel_Count -ge 1) {
Write-Output " |"
Write-Output " V User Deletion Activity - Statistics Table"

# flag to stop $Border iteration after first iteration
$Flag = "Enable"

# foreach loop to iterate and past each event separate from the hashtable
foreach ($Event in $UsersGroupActivity_HT["userdel"]) {

Expand All @@ -256,12 +267,17 @@ if ($userdel_Count -ge 1) {
$UserDeletion = $UserDeletion.PadRight($MaxChar_UserDeletion)

# Output the result for the current event
$Result = Write-Output "| Event: User Deletion Activity | Time: $TimeAndDate | Deleted User Name: $UserDeletion |"
$Result = Write-Output "| Time: $TimeAndDate | Event: User Deletion Activity | Deleted User Name: $UserDeletion |"

# multiply $Result.Length with "-" hyfen symbol to get the boarder
$Border = '-' * ($Result.Length - 2)

# print the result in a table
if ($Flag -match "Enable") {
Write-Output " +$Border+"
$Flag = "Disable"
}

Write-Output " $Result"
}

Expand Down Expand Up @@ -347,6 +363,9 @@ if ($groupadd_Count -ge 1) {
Write-Output " |"
Write-Output " V Group Creation Activity - Statistics Table"

# flag to stop $Border iteration after first iteration
$Flag = "Enable"

# foreach loop to iterate and past each event separate from the hashtable
foreach ($Event in $UsersGroupActivity_HT["groupadd"]) {

Expand All @@ -360,12 +379,17 @@ if ($groupadd_Count -ge 1) {
$CreatedGroup = $CreatedGroup.PadRight($MaxChar_CreatedGroup)

# Output the result for the current event
$Result = Write-Output "| Event: Group Creation Activity | Time: $TimeAndDate | Created Group: $CreatedGroup |"
$Result = Write-Output "| Time: $TimeAndDate | Event: Group Creation Activity | Created Group: $CreatedGroup |"

# multiply $Result.Length with "-" hyfen symbol to get the boarder
$Border = '-' * ($Result.Length - 2)

# print the result in a table
if ($Flag -match "Enable") {
Write-Output " +$Border+"
$Flag = "Disable"
}

Write-Output " $Result"
}

Expand Down Expand Up @@ -422,6 +446,9 @@ if ($groudel_Count -ge 1) {
Write-Output " |"
Write-Output " V Group Deletion Activity - Statistics Table"

# flag to stop $Border iteration after first iteration
$Flag = "Enable"

# foreach loop to iterate and past each event separate from the hashtable
foreach ($Event in $UsersGroupActivity_HT["groudel"]) {

Expand All @@ -435,12 +462,17 @@ if ($groudel_Count -ge 1) {
$DeletedGroup = $DeletedGroup.PadRight($MaxChar_DeletedGroup)

# Output the result for the current event
$Result = Write-Output "| Event: Group Deletion Activity | Time: $TimeAndDate | Deleted Group: $DeletedGroup |"
$Result = Write-Output "| Time: $TimeAndDate | Event: Group Deletion Activity | Deleted Group: $DeletedGroup |"

# multiply $Result.Length with "-" hyfen symbol to get the boarder
$Border = '-' * ($Result.Length - 2)

# print the result in a table
if ($Flag -match "Enable") {
Write-Output " +$Border+"
$Flag = "Disable"
}

Write-Output " $Result"
}

Expand Down Expand Up @@ -500,7 +532,10 @@ if ($AddUserToGroup_Count -ge 1) {

# Strings for the top title of the Statistics Table
Write-Output " |"
Write-Output " V User Removed From A Group Activity - Statistics Table"
Write-Output " V User Added To A Group Activity - Statistics Table"

# flag to stop $Border iteration after first iteration
$Flag = "Enable"

# foreach loop to iterate and past each event separate from the hashtable
foreach ($Event in $UsersGroupActivity_HT["AddUserToGroup"]) {
Expand All @@ -519,12 +554,17 @@ if ($AddUserToGroup_Count -ge 1) {
$ToGroup = $ToGroup.PadRight($MaxChar_ToGroup)

# Output the result for the current event
$Result = Write-Output "| Event: User Added To A Group | Time: $TimeAndDate | The User: $AddedUser | To Group: $ToGroup |"
$Result = Write-Output "| Time: $TimeAndDate | Event: User Added To A Group | The User: $AddedUser | To Group: $ToGroup |"

# multiply $Result.Length with "-" hyfen symbol to get the boarder
$Border = '-' * ($Result.Length - 2)

# print the result in a table
if ($Flag -match "Enable") {
Write-Output " +$Border+"
$Flag = "Disable"
}

Write-Output " $Result"
}

Expand Down Expand Up @@ -590,6 +630,9 @@ if ($RemoveUserFromGroup_Count -ge 1) {
Write-Output " |"
Write-Output " V User Removed From A Group Activity - Statistics Table"

# flag to stop $Border iteration after first iteration
$Flag = "Enable"

# foreach loop to iterate and past each event separate from the hashtable
foreach ($Event in $UsersGroupActivity_HT["RemoveUserFromGroup"]) {

Expand All @@ -610,21 +653,26 @@ if ($RemoveUserFromGroup_Count -ge 1) {
$FromGroup = $FromGroup.PadRight($MaxChar_FromGroup)

# Output the result for the current event
$Result = Write-Output "| Event: User Removed From Group | Time: $TimeAndDate | The User: $RemovedUser | Removed By: $RemovedBy | From Group: $FromGroup |"
$Result = Write-Output "| Time: $TimeAndDate | Event: User Removed From Group | The User: $RemovedUser | Removed By: $RemovedBy | From Group: $FromGroup |"

# multiply $Result.Length with "-" hyfen symbol to get the boarder
$Border = '-' * ($Result.Length - 2)

# print the result in a table
if ($Flag -match "Enable") {
Write-Output " +$Border+"
$Flag = "Disable"
}

Write-Output " $Result"
}

Write-Output " +$Border+"
}


# print out the user information change
if ($UserInformationChange_Count -ge 1) {

Write-Output ""
Write-Output "User Information Change - Raw Events"

Expand Down Expand Up @@ -675,15 +723,16 @@ if ($UserInformationChange_Count -ge 1) {
$UserInformationChange[$UserName] = 1
}
}

# print out the title of the table
Write-Output " |"
Write-Output " V User Information Change - Statistics Table"

# Find max lengths for the keys and the values of the hashtable
$MaxCharKey = ($UserInformationChange.Keys | Measure-Object Length -Maximum).Maximum
$MaxCharValue = ($UserInformationChange.Values | Measure-Object -Maximum).Maximum.ToString().Length

# flag to stop $Border iteration after first iteration
$Flag = "Enable"

# iterate through all the keys in the hashtable in a foreach loop
foreach ($Key in $UserInformationChange.Keys) {

Expand All @@ -697,13 +746,17 @@ if ($UserInformationChange_Count -ge 1) {
# calculate border
$Border = '-' * ($Final.Length - 2)

# print the result in a table
# Print the boarder once
if ($Flag -match "Enable") {
Write-Output " +$Border+"
$Flag = "Disable"
}

Write-Output " $Final"

}
# last board print outside of the foreach loop
Write-Output " +$Border+"

}

# reset variables
Expand Down
26 changes: 16 additions & 10 deletions 02-LogModules/Auth.Log/03-Features/07-sudoActivity.ps1
View file
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,9 @@ if ($Elevated_Sessions_Opened_Count -ge 1) {
$MaxCharKey = ($Session_HT.Keys | Measure-Object Length -Maximum).Maximum
$MaxCharValue = ($Session_HT.Values | Measure-Object -Maximum).Maximum.ToString().Length

# flag to stop $Border iteration after first iteration
$Flag = "Enable"

# Output table
foreach ($Key in $Session_HT.Keys) {
$SpacedKey = $Key.PadRight($MaxCharKey)
Expand All @@ -76,7 +79,12 @@ if ($Elevated_Sessions_Opened_Count -ge 1) {
$Final = "| Sessions opened for user $SpacedKey | Session Count: $SpacedValue |"
$Border = '-' * ($Final.Length - 2)

# Print the boarder once
if ($Flag -match "Enable") {
Write-Output "+$Border+"
$Flag = "Disable"
}

Write-Output $Final
}

Expand Down Expand Up @@ -154,10 +162,9 @@ if ($ElevatedCommands_Count -ge 1) {

# the printing of the $NameTag plus the table
Write-Output ""
Write-Output " User Information"
Write-Output " +$BorderHyphenForUser+"
Write-Output " $Key"
Write-Output " +$BorderHyphenForUser+"
Write-Output "User Command History Of:"
Write-Output "+$BorderHyphenForUser+"
Write-Output "$Key"

# Find the maximum character count in $ElevatedCommandsHT[$Key] which is the commands
$MaxCharCount = ($ElevatedCommandsHT[$Key] | Measure-Object Length -Maximum).Maximum
Expand All @@ -169,15 +176,14 @@ if ($ElevatedCommands_Count -ge 1) {
$Commands = $ElevatedCommandsHT[$Key].PadRight($MaxCharCount)

# the printing of the whole table with the commands
Write-Output " |"
Write-Output " V User Command History (Total Executions:$($ElevatedCommandsHT[$Key].Count))"
Write-Output " +$BorderHyphen+"
Write-Output "+$BorderHyphen+"

foreach ($Command in $Commands) {
Write-Output " |$Command|"
Write-Output " +$BorderHyphen+"

Write-Output "|$Command|"
}
Write-Output "+$BorderHyphen+"
}

}

# reset
Expand Down
1 change: 1 addition & 0 deletions MasterParser.ps1
View file
Original file line number Diff line number Diff line change
Expand Up @@ -170,3 +170,4 @@ switch ($O) {
exit
}
}

0 comments on commit 5d8275b

Please sign in to comment.