Splunk powershell

arunsundarm — Thu, 18 Jun 2020 06:49:03 GMT

Here we are using a PowerShell script to extract the data from the AD subnets from a windows server

This is scheduled to run once every week to pull the list of subnets on a particular root domain

We are supposed to get the results only from a parent domain, instead we are getting the results from the subdomains which is not the expected result.

Also when we run the Script in PowerShell ISE directly we are getting a list of subnets from a domain , but the result we see in splunk is entirely different from different domains than the results we get while running the script locally

Since the results contains the subnets and IP Address we are unable to attach the screenshot due to the sensitivity of the results.

Script used “

# extract domain rootDNS
$domain=$([adsi] "LDAP://RootDSE").Get("rootDomainNamingContext") -replace "DC=","" -replace ",","."

# create LDAP path for AD subnets
$subnetsDN="LDAP://CN=Subnets,CN=Sites," + $([adsi] "LDAP://RootDSE").Get("ConfigurationNamingContext")

#ouput properties
$props = @{domain=$domain;ip="";sitename=""}

# get subnets and loop through list
foreach ($subnetDN in $([adsi] $subnetsDN).psbase.children){
$tmpTable = new-object psobject -property $props
# get CN of the subnet's site objects
$tmpTable.sitename=$([adsi] "LDAP://$($subnetDN.siteObject)").cn.tostring()
# validate sitename
if($tmpTable.sitename -ne $null){
#extract subnet CN
$tmpTable.ip=$subnetDN.cn.tostring()
#write output
$tmpTable |select domain, ip, sitename

}
}

Input Stanza:

[powershell://Get-ADSubnets]
script = . "$SplunkHome\etc\apps\bhp_hf_ad_audit_powershell_subnet\bin\RunAudit-ADSubnets.ps1"
schedule = 30 15 * * 0
sourcetype = microsoft:ad:subnets

topic Splunk powershell in Getting Data In

Splunk powershell