Sync all scripts from website downloads — 352 scripts total
Includes updated JS challenge scripts with Claude-User whitelist, same-site referer bypass, Blackbox-Exporter allowed bot, and all new exporters, cheat sheets, and automation scripts.
This commit is contained in:
@@ -0,0 +1,470 @@
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Windows Firewall Log Prometheus Metrics Exporter
|
||||
.DESCRIPTION
|
||||
Prometheus exporter for Windows Firewall log activity -- parses the
|
||||
pfirewall.log file and exports metrics about firewall events including
|
||||
allowed/dropped connections, top blocked ports, top blocked source IPs,
|
||||
and log file statistics. Exports metrics as Prometheus-compatible text
|
||||
format for windows_exporter textfile collector.
|
||||
.PARAMETER LogFile
|
||||
Path to Windows Firewall log file
|
||||
(default: C:\Windows\System32\LogFiles\Firewall\pfirewall.log)
|
||||
.PARAMETER LookbackMinutes
|
||||
Only parse log entries from the last N minutes (default: 5)
|
||||
.PARAMETER TopN
|
||||
Number of top source IPs and ports to report (default: 10)
|
||||
.PARAMETER Mode
|
||||
Output mode: 'stdout' (default), 'textfile', or 'http'
|
||||
.PARAMETER Port
|
||||
HTTP port for http mode (default: 9196)
|
||||
.PARAMETER TextfileDir
|
||||
Directory for textfile collector output (default: C:\ProgramData\node_exporter)
|
||||
.PARAMETER InstallScheduledTask
|
||||
Switch to create a scheduled task for auto-start on system boot
|
||||
.PARAMETER TaskIntervalMinutes
|
||||
Interval in minutes for the scheduled task (default: 5)
|
||||
.NOTES
|
||||
Author: Phil Connor
|
||||
Contact: contact@mylinux.work
|
||||
Website: https://mylinux.work
|
||||
License: MIT
|
||||
Version: 1.0
|
||||
|
||||
Metrics Exported:
|
||||
Core Status:
|
||||
- windows_firewall_log_up
|
||||
- windows_firewall_log_exporter_info{version}
|
||||
|
||||
Event Counts:
|
||||
- windows_firewall_log_events_total{action,protocol,direction}
|
||||
- windows_firewall_log_dropped_total
|
||||
- windows_firewall_log_allowed_total
|
||||
|
||||
Top N Breakdowns:
|
||||
- windows_firewall_log_dropped_by_port_total{port,protocol}
|
||||
- windows_firewall_log_dropped_by_source_total{source_ip}
|
||||
- windows_firewall_log_unique_source_ips
|
||||
|
||||
Log File:
|
||||
- windows_firewall_log_file_size_bytes
|
||||
- windows_firewall_log_file_lines_total
|
||||
|
||||
Exporter:
|
||||
- windows_firewall_log_exporter_duration_seconds
|
||||
- windows_firewall_log_exporter_last_run_timestamp
|
||||
#>
|
||||
|
||||
param(
|
||||
[string]$LogFile = "$env:SystemRoot\System32\LogFiles\Firewall\pfirewall.log",
|
||||
|
||||
[int]$LookbackMinutes = 5,
|
||||
|
||||
[int]$TopN = 10,
|
||||
|
||||
[ValidateSet('stdout', 'textfile', 'http')]
|
||||
[string]$Mode = 'stdout',
|
||||
|
||||
[int]$Port = 9196,
|
||||
|
||||
[string]$TextfileDir = 'C:\ProgramData\node_exporter',
|
||||
|
||||
[switch]$InstallScheduledTask,
|
||||
|
||||
[int]$TaskIntervalMinutes = 5
|
||||
)
|
||||
|
||||
# Create a scheduled task to run this script every $TaskIntervalMinutes minutes
|
||||
# The task will run as SYSTEM and will be set to run at startup
|
||||
if ($InstallScheduledTask) {
|
||||
$taskName = "WindowsFirewallLogExporter"
|
||||
$existingTask = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue
|
||||
|
||||
if (-not $existingTask) {
|
||||
$taskAction = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoProfile -ExecutionPolicy Bypass -File `"$($MyInvocation.MyCommand.Path)`" -Mode textfile"
|
||||
|
||||
if (-not $TaskIntervalMinutes -or $TaskIntervalMinutes -le 0) {
|
||||
throw "TaskIntervalMinutes must be a positive integer"
|
||||
}
|
||||
|
||||
$taskTrigger = New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes $TaskIntervalMinutes) -RepetitionDuration (New-TimeSpan -Days 365)
|
||||
$taskPrincipal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
|
||||
|
||||
try {
|
||||
Write-Host "Creating scheduled task: $taskName"
|
||||
Register-ScheduledTask -TaskName $taskName -Action $taskAction -Trigger $taskTrigger -Principal $taskPrincipal -Description "Exports Windows Firewall log metrics for Prometheus every $TaskIntervalMinutes minutes"
|
||||
|
||||
$createdTask = Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue
|
||||
if (-not $createdTask) {
|
||||
throw "Failed to verify scheduled task creation"
|
||||
}
|
||||
Write-Host "Successfully created scheduled task: $taskName" -ForegroundColor Green
|
||||
} catch {
|
||||
Write-Error "Failed to create scheduled task: $($_.Exception.Message)"
|
||||
throw
|
||||
}
|
||||
} else {
|
||||
Write-Host "Scheduled task '$taskName' already exists, skipping creation"
|
||||
}
|
||||
}
|
||||
|
||||
$ErrorActionPreference = 'SilentlyContinue'
|
||||
|
||||
# ============================================================================
|
||||
# HELPER FUNCTIONS
|
||||
# ============================================================================
|
||||
|
||||
function Get-UnixTimestamp {
|
||||
[int][double]::Parse((Get-Date -UFormat '%s'))
|
||||
}
|
||||
|
||||
function Format-MetricValue {
|
||||
param([double]$Value, [int]$Decimals = 2)
|
||||
[math]::Round($Value, $Decimals)
|
||||
}
|
||||
|
||||
# ============================================================================
|
||||
# FIREWALL LOG PARSING
|
||||
# ============================================================================
|
||||
|
||||
function Get-FirewallLogMetrics {
|
||||
$sb = [System.Text.StringBuilder]::new()
|
||||
|
||||
# pfirewall.log format (space-delimited):
|
||||
# date time action protocol src-ip dst-ip src-port dst-port size tcpflags tcpsyn tcpack tcpwin icmptype icmpcode info path
|
||||
|
||||
if (-not (Test-Path $LogFile)) {
|
||||
return $sb.ToString()
|
||||
}
|
||||
|
||||
$cutoff = (Get-Date).AddMinutes(-$LookbackMinutes)
|
||||
$lines = @()
|
||||
|
||||
try {
|
||||
$rawLines = Get-Content -Path $LogFile -Tail 50000 -ErrorAction Stop
|
||||
} catch {
|
||||
return $sb.ToString()
|
||||
}
|
||||
|
||||
# Parse and filter lines within lookback window
|
||||
$parsedEvents = @()
|
||||
$totalLinesParsed = 0
|
||||
|
||||
foreach ($line in $rawLines) {
|
||||
# Skip comment lines
|
||||
if ($line.StartsWith('#')) { continue }
|
||||
|
||||
$fields = $line -split '\s+'
|
||||
if ($fields.Count -lt 8) { continue }
|
||||
|
||||
# Parse date and time from first two fields
|
||||
try {
|
||||
$entryTime = [datetime]::ParseExact("$($fields[0]) $($fields[1])", 'yyyy-MM-dd HH:mm:ss', $null)
|
||||
} catch {
|
||||
continue
|
||||
}
|
||||
|
||||
if ($entryTime -lt $cutoff) { continue }
|
||||
|
||||
$totalLinesParsed++
|
||||
|
||||
$parsedEvents += [PSCustomObject]@{
|
||||
Action = $fields[2].ToUpper()
|
||||
Protocol = $fields[3].ToUpper()
|
||||
SrcIP = $fields[4]
|
||||
DstIP = $fields[5]
|
||||
SrcPort = $fields[6]
|
||||
DstPort = $fields[7]
|
||||
Direction = if ($fields.Count -ge 17) { $fields[16].ToUpper() } else { 'UNKNOWN' }
|
||||
}
|
||||
}
|
||||
|
||||
# --- windows_firewall_log_events_total ---
|
||||
[void]$sb.AppendLine('# HELP windows_firewall_log_events_total Total firewall log events by action, protocol, and direction')
|
||||
[void]$sb.AppendLine('# TYPE windows_firewall_log_events_total gauge')
|
||||
|
||||
$eventGroups = $parsedEvents | Group-Object -Property Action, Protocol, Direction
|
||||
foreach ($group in $eventGroups) {
|
||||
$parts = $group.Name -split ', '
|
||||
$action = $parts[0]
|
||||
$protocol = $parts[1]
|
||||
$direction = $parts[2]
|
||||
[void]$sb.AppendLine("windows_firewall_log_events_total{action=`"$action`",protocol=`"$protocol`",direction=`"$direction`"} $($group.Count)")
|
||||
}
|
||||
[void]$sb.AppendLine('')
|
||||
|
||||
# --- windows_firewall_log_dropped_total ---
|
||||
$droppedEvents = @($parsedEvents | Where-Object { $_.Action -eq 'DROP' })
|
||||
$droppedTotal = $droppedEvents.Count
|
||||
|
||||
[void]$sb.AppendLine('# HELP windows_firewall_log_dropped_total Total dropped events in lookback window')
|
||||
[void]$sb.AppendLine('# TYPE windows_firewall_log_dropped_total gauge')
|
||||
[void]$sb.AppendLine("windows_firewall_log_dropped_total $droppedTotal")
|
||||
[void]$sb.AppendLine('')
|
||||
|
||||
# --- windows_firewall_log_allowed_total ---
|
||||
$allowedEvents = @($parsedEvents | Where-Object { $_.Action -eq 'ALLOW' })
|
||||
$allowedTotal = $allowedEvents.Count
|
||||
|
||||
[void]$sb.AppendLine('# HELP windows_firewall_log_allowed_total Total allowed events in lookback window')
|
||||
[void]$sb.AppendLine('# TYPE windows_firewall_log_allowed_total gauge')
|
||||
[void]$sb.AppendLine("windows_firewall_log_allowed_total $allowedTotal")
|
||||
[void]$sb.AppendLine('')
|
||||
|
||||
# --- windows_firewall_log_dropped_by_port_total ---
|
||||
[void]$sb.AppendLine('# HELP windows_firewall_log_dropped_by_port_total Dropped events by destination port (top N)')
|
||||
[void]$sb.AppendLine('# TYPE windows_firewall_log_dropped_by_port_total gauge')
|
||||
|
||||
$portGroups = $droppedEvents |
|
||||
Where-Object { $_.DstPort -ne '-' } |
|
||||
Group-Object -Property DstPort, Protocol |
|
||||
Sort-Object Count -Descending |
|
||||
Select-Object -First $TopN
|
||||
|
||||
foreach ($group in $portGroups) {
|
||||
$parts = $group.Name -split ', '
|
||||
$port = $parts[0]
|
||||
$protocol = $parts[1]
|
||||
[void]$sb.AppendLine("windows_firewall_log_dropped_by_port_total{port=`"$port`",protocol=`"$protocol`"} $($group.Count)")
|
||||
}
|
||||
[void]$sb.AppendLine('')
|
||||
|
||||
# --- windows_firewall_log_dropped_by_source_total ---
|
||||
[void]$sb.AppendLine('# HELP windows_firewall_log_dropped_by_source_total Dropped events by source IP (top N)')
|
||||
[void]$sb.AppendLine('# TYPE windows_firewall_log_dropped_by_source_total gauge')
|
||||
|
||||
$sourceGroups = $droppedEvents |
|
||||
Group-Object -Property SrcIP |
|
||||
Sort-Object Count -Descending |
|
||||
Select-Object -First $TopN
|
||||
|
||||
foreach ($group in $sourceGroups) {
|
||||
[void]$sb.AppendLine("windows_firewall_log_dropped_by_source_total{source_ip=`"$($group.Name)`"} $($group.Count)")
|
||||
}
|
||||
[void]$sb.AppendLine('')
|
||||
|
||||
# --- windows_firewall_log_unique_source_ips ---
|
||||
$uniqueSourceIPs = ($droppedEvents | Select-Object -ExpandProperty SrcIP -Unique).Count
|
||||
|
||||
[void]$sb.AppendLine('# HELP windows_firewall_log_unique_source_ips Count of unique source IPs in dropped events')
|
||||
[void]$sb.AppendLine('# TYPE windows_firewall_log_unique_source_ips gauge')
|
||||
[void]$sb.AppendLine("windows_firewall_log_unique_source_ips $uniqueSourceIPs")
|
||||
[void]$sb.AppendLine('')
|
||||
|
||||
# --- windows_firewall_log_file_size_bytes ---
|
||||
$fileSize = (Get-Item -Path $LogFile -ErrorAction SilentlyContinue).Length
|
||||
if (-not $fileSize) { $fileSize = 0 }
|
||||
|
||||
[void]$sb.AppendLine('# HELP windows_firewall_log_file_size_bytes Size of the firewall log file in bytes')
|
||||
[void]$sb.AppendLine('# TYPE windows_firewall_log_file_size_bytes gauge')
|
||||
[void]$sb.AppendLine("windows_firewall_log_file_size_bytes $fileSize")
|
||||
[void]$sb.AppendLine('')
|
||||
|
||||
# --- windows_firewall_log_file_lines_total ---
|
||||
[void]$sb.AppendLine('# HELP windows_firewall_log_file_lines_total Total lines parsed in lookback window')
|
||||
[void]$sb.AppendLine('# TYPE windows_firewall_log_file_lines_total gauge')
|
||||
[void]$sb.AppendLine("windows_firewall_log_file_lines_total $totalLinesParsed")
|
||||
[void]$sb.AppendLine('')
|
||||
|
||||
$sb.ToString()
|
||||
}
|
||||
|
||||
# ============================================================================
|
||||
# COLLECT ALL METRICS
|
||||
# ============================================================================
|
||||
|
||||
function Get-AllMetrics {
|
||||
$scriptStart = Get-Date
|
||||
$sb = [System.Text.StringBuilder]::new()
|
||||
|
||||
try {
|
||||
if (-not (Test-Path $LogFile)) {
|
||||
# Log file not found -- exporter is down
|
||||
[void]$sb.AppendLine('# HELP windows_firewall_log_up Exporter status (1=up, 0=down)')
|
||||
[void]$sb.AppendLine('# TYPE windows_firewall_log_up gauge')
|
||||
[void]$sb.AppendLine('windows_firewall_log_up 0')
|
||||
[void]$sb.AppendLine('')
|
||||
|
||||
[void]$sb.AppendLine('# HELP windows_firewall_log_exporter_info Exporter version information')
|
||||
[void]$sb.AppendLine('# TYPE windows_firewall_log_exporter_info gauge')
|
||||
[void]$sb.AppendLine('windows_firewall_log_exporter_info{version="1.0"} 1')
|
||||
[void]$sb.AppendLine('')
|
||||
|
||||
$scriptEnd = Get-Date
|
||||
$duration = Format-MetricValue ($scriptEnd - $scriptStart).TotalSeconds
|
||||
$timestamp = Get-UnixTimestamp
|
||||
|
||||
[void]$sb.AppendLine('# HELP windows_firewall_log_exporter_duration_seconds Time to generate all metrics')
|
||||
[void]$sb.AppendLine('# TYPE windows_firewall_log_exporter_duration_seconds gauge')
|
||||
[void]$sb.AppendLine("windows_firewall_log_exporter_duration_seconds $duration")
|
||||
[void]$sb.AppendLine('')
|
||||
[void]$sb.AppendLine('# HELP windows_firewall_log_exporter_last_run_timestamp Unix timestamp of last successful run')
|
||||
[void]$sb.AppendLine('# TYPE windows_firewall_log_exporter_last_run_timestamp gauge')
|
||||
[void]$sb.AppendLine("windows_firewall_log_exporter_last_run_timestamp $timestamp")
|
||||
[void]$sb.AppendLine('')
|
||||
|
||||
return $sb.ToString()
|
||||
}
|
||||
|
||||
# Exporter up
|
||||
[void]$sb.AppendLine('# HELP windows_firewall_log_up Exporter status (1=up, 0=down)')
|
||||
[void]$sb.AppendLine('# TYPE windows_firewall_log_up gauge')
|
||||
[void]$sb.AppendLine('windows_firewall_log_up 1')
|
||||
[void]$sb.AppendLine('')
|
||||
|
||||
# Exporter info
|
||||
[void]$sb.AppendLine('# HELP windows_firewall_log_exporter_info Exporter version information')
|
||||
[void]$sb.AppendLine('# TYPE windows_firewall_log_exporter_info gauge')
|
||||
[void]$sb.AppendLine('windows_firewall_log_exporter_info{version="1.0"} 1')
|
||||
[void]$sb.AppendLine('')
|
||||
|
||||
# Collect firewall log metrics
|
||||
[void]$sb.Append((Get-FirewallLogMetrics))
|
||||
|
||||
# Exporter runtime
|
||||
$scriptEnd = Get-Date
|
||||
$duration = Format-MetricValue ($scriptEnd - $scriptStart).TotalSeconds
|
||||
$timestamp = Get-UnixTimestamp
|
||||
|
||||
[void]$sb.AppendLine('# HELP windows_firewall_log_exporter_duration_seconds Time to generate all metrics')
|
||||
[void]$sb.AppendLine('# TYPE windows_firewall_log_exporter_duration_seconds gauge')
|
||||
[void]$sb.AppendLine("windows_firewall_log_exporter_duration_seconds $duration")
|
||||
[void]$sb.AppendLine('')
|
||||
[void]$sb.AppendLine('# HELP windows_firewall_log_exporter_last_run_timestamp Unix timestamp of last successful run')
|
||||
[void]$sb.AppendLine('# TYPE windows_firewall_log_exporter_last_run_timestamp gauge')
|
||||
[void]$sb.AppendLine("windows_firewall_log_exporter_last_run_timestamp $timestamp")
|
||||
[void]$sb.AppendLine('')
|
||||
}
|
||||
catch {
|
||||
# On any error, return up=0 with basic info
|
||||
$sb = [System.Text.StringBuilder]::new()
|
||||
|
||||
[void]$sb.AppendLine('# HELP windows_firewall_log_up Exporter status (1=up, 0=down)')
|
||||
[void]$sb.AppendLine('# TYPE windows_firewall_log_up gauge')
|
||||
[void]$sb.AppendLine('windows_firewall_log_up 0')
|
||||
[void]$sb.AppendLine('')
|
||||
|
||||
[void]$sb.AppendLine('# HELP windows_firewall_log_exporter_info Exporter version information')
|
||||
[void]$sb.AppendLine('# TYPE windows_firewall_log_exporter_info gauge')
|
||||
[void]$sb.AppendLine('windows_firewall_log_exporter_info{version="1.0"} 1')
|
||||
[void]$sb.AppendLine('')
|
||||
|
||||
$timestamp = Get-UnixTimestamp
|
||||
[void]$sb.AppendLine('# HELP windows_firewall_log_exporter_last_run_timestamp Unix timestamp of last successful run')
|
||||
[void]$sb.AppendLine('# TYPE windows_firewall_log_exporter_last_run_timestamp gauge')
|
||||
[void]$sb.AppendLine("windows_firewall_log_exporter_last_run_timestamp $timestamp")
|
||||
[void]$sb.AppendLine('')
|
||||
}
|
||||
|
||||
$sb.ToString()
|
||||
}
|
||||
|
||||
# ============================================================================
|
||||
# HTTP SERVER MODE
|
||||
# ============================================================================
|
||||
|
||||
function Start-HttpServer {
|
||||
param([int]$ListenPort)
|
||||
|
||||
$prefix = "http://+:$ListenPort/"
|
||||
$listener = [System.Net.HttpListener]::new()
|
||||
$listener.Prefixes.Add($prefix)
|
||||
|
||||
try {
|
||||
$listener.Start()
|
||||
Write-Host "Starting Windows Firewall log exporter on port $ListenPort..." -ForegroundColor Green
|
||||
Write-Host "Metrics available at http://localhost:$ListenPort/metrics"
|
||||
|
||||
while ($listener.IsListening) {
|
||||
$context = $listener.GetContext()
|
||||
$request = $context.Request
|
||||
$response = $context.Response
|
||||
|
||||
if ($request.Url.AbsolutePath -eq '/metrics') {
|
||||
$metrics = Get-AllMetrics
|
||||
$buffer = [System.Text.Encoding]::UTF8.GetBytes($metrics)
|
||||
$response.ContentType = 'text/plain; version=0.0.4; charset=utf-8'
|
||||
}
|
||||
else {
|
||||
$html = @"
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head><title>Windows Firewall Log Exporter v1.0</title></head>
|
||||
<body>
|
||||
<h1>Windows Firewall Log Exporter v1.0</h1>
|
||||
<p><a href="/metrics">Metrics</a></p>
|
||||
<h2>Metrics</h2>
|
||||
<ul>
|
||||
<li>Firewall events by action, protocol, and direction</li>
|
||||
<li>Total dropped and allowed events</li>
|
||||
<li>Top dropped destination ports</li>
|
||||
<li>Top dropped source IPs</li>
|
||||
<li>Unique source IPs in dropped events</li>
|
||||
<li>Log file size and parsed line count</li>
|
||||
<li>Exporter runtime and timestamp</li>
|
||||
</ul>
|
||||
</body>
|
||||
</html>
|
||||
"@
|
||||
$buffer = [System.Text.Encoding]::UTF8.GetBytes($html)
|
||||
$response.ContentType = 'text/html; charset=utf-8'
|
||||
}
|
||||
|
||||
$response.ContentLength64 = $buffer.Length
|
||||
$response.OutputStream.Write($buffer, 0, $buffer.Length)
|
||||
$response.OutputStream.Close()
|
||||
}
|
||||
}
|
||||
catch {
|
||||
Write-Error "HTTP server error: $_"
|
||||
Write-Error "If access denied, run: netsh http add urlacl url=http://+:$ListenPort/ user=Everyone"
|
||||
}
|
||||
finally {
|
||||
if ($listener.IsListening) {
|
||||
$listener.Stop()
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# ============================================================================
|
||||
# MAIN EXECUTION
|
||||
# ============================================================================
|
||||
|
||||
switch ($Mode) {
|
||||
'http' {
|
||||
Start-HttpServer -ListenPort $Port
|
||||
}
|
||||
'textfile' {
|
||||
$OutputFile = Join-Path $TextfileDir 'windows_firewall_log.prom'
|
||||
|
||||
$outputDir = Split-Path $OutputFile -Parent
|
||||
if (-not (Test-Path $outputDir)) {
|
||||
New-Item -Path $outputDir -ItemType Directory -Force | Out-Null
|
||||
}
|
||||
|
||||
$tempFile = Join-Path $outputDir ".windows_firewall_log_metrics.$PID.tmp"
|
||||
|
||||
try {
|
||||
$metrics = Get-AllMetrics
|
||||
$metrics | Out-File -FilePath $tempFile -Encoding utf8 -NoNewline
|
||||
|
||||
$lineCount = ($metrics -split "`n").Count
|
||||
if ($lineCount -lt 10) {
|
||||
Remove-Item -Path $tempFile -Force -ErrorAction SilentlyContinue
|
||||
Write-Error "Metrics file too small ($lineCount lines), keeping previous"
|
||||
exit 1
|
||||
}
|
||||
|
||||
Move-Item -Path $tempFile -Destination $OutputFile -Force
|
||||
Write-Host "Metrics written to $OutputFile ($lineCount lines)" -ForegroundColor Green
|
||||
}
|
||||
catch {
|
||||
Remove-Item -Path $tempFile -Force -ErrorAction SilentlyContinue
|
||||
Write-Error "Failed to generate metrics: $_"
|
||||
exit 1
|
||||
}
|
||||
}
|
||||
default {
|
||||
Get-AllMetrics | Write-Output
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user