Pass ipaddress to calculated column fail

PowerShell Help
1

Hi there,

I’m a newbie and I’ve been struggeling with this challenge for a couple of days now.
I’ve used an excellent code I found on Github to parse Windows Firewall logs.
I’ve successfully added a DNS lookup based on IP adress and now I also would like to add the computer description based on IP address. But for some reason I’m not able to get the description to work.

This is the column which fails:
@{Name=“src-desc”;Expression={ (Get-ADComputer -Filter {IPv4Address -eq $_.“src-ip”} -Property description).description}} ,
Any suggestions? Thx in advance :wink:

####Begin of code
function Get-WindowsFirewallLog {
param(
[parameter(Position=0,Mandatory=$false)]
[ValidateScript({Test-Path $_})]
[string]$LogFilePath = “$env:SystemRoot\System32\LogFiles\Firewall\pfirewall.log”
)

# CSV header fields, to be used later when converting each line of the tailed log from CSV
$headerFields = @("date","time","action","protocol","src-ip","dst-ip","src-port","dst-port","size","tcpflags","tcpsyn","tcpack","tcpwin","icmptype","icmpcode","info","path")

# Read in the firewall log
$firewallLogs = Get-Content $LogFilePath | ConvertFrom-Csv -Header $headerFields -Delimiter ' '

# Output logs into a gridview
  $firewallLogs | select-object -property "protocol","src-ip",@{Name="src-fqdn";Expression={ ([System.Net.Dns]::GetHostEntry($_."src-ip").HostName)}} ,@{Name="src-desc";Expression={ (Get-ADComputer -Filter {IPv4Address -eq $_."src-ip"} -Property description).description}} ,"src-port","dst-ip",@{Name="dst-fqdn";Expression={ ([System.Net.Dns]::GetHostEntry($_."dst-ip").HostName)}} ,"dst-port","path" |OUT-GRIDVIEW

}
Get-WindowsFirewallLog

####End of code

2

Martin,
welcome to the forums.

The value for the parameter -Filter is actually a string - not script block. Even if PowerShell does an implicit conversion for you. And … sometimes it is a little picky when you want to do variable expansion inside the filter string. I’d try to do it outside and provide a simple variable inside the filter string. … like this:

@{Name = 'src-desc'; Expression = { $IPv4 = $($_.'src-ip'); (Get-ADComputer -Filter "IPv4Address -eq '$IPv4'" -Property Description).Description } }

It might have been a little easier when your property name wouldn’t have a dash in it. I’d try to avoid property names like “src-desc”. Instead I’d use something more descriptive like “SourceDescription”. :wink:

3

Super!

Thank uou!

ons 12 maj 2021 kl. 15:03 skrev Olaf Soyk via PowerShell Forums <powershell@discoursemail.com>: