Using IP management module

2018-12-04 PowerShell

Assume we’ve got three different ranges ‘10.192.0.0/11’, ‘10.64.0.0/11’ and ‘10.128.0.0/11’. These ranges correspond to three different geographic locations in Azure. There are already some ranges used in these top level blocks. And we have the whole list of ranges, which are in use already. So what we want to achieve is we want to automatically select the next available range and provision VNET for it.

Continue reading

Use Powershell to analyze Sysmon events

2017-08-10

Hello colleagues, this is an example I promised answering this tweet. I used this sysmon config to capture activities happening on my system. Unfortunately it did not capture a lot of network-related activities, perhaps I need to change it to extend network-level filters. But on the other hand it captured a lot of process level activities, so in this example i’d like to try to graph process creation events.

Continue reading

Using graphs to analyze Windows Firewall logs

Hello colleagues, lets talk about how we can use graphs to look inside of communications happening in our environments in an easy way. First of all we need to have some data to analyze. Lets gather some. It is pretty simple - just use this article and enable Windows Firewall Logging. I usually put the logs into a separate folder, just for easy access. Here is how it looks like on my system: Continue reading

Enhancing VM Search in Azure with PowerShell

2015-12-17
In this walkthrough, we’ll explore various functionalities of PowerShell, including dynamic parameters, parallel execution of script blocks, and index building for efficient searches, among other features. Let’s dive in by understanding the problem at hand. Often, there’s a need to search VMs not only by their names but also by their internal IP addresses or the names of their disks. However, the absence of an out-of-the-box API for this task led me to develop a custom tool. Continue reading

Search Azure Objects

2015-11-02
In our environment we have more than one subscription. Even more than five. And this amount grows constantly. What we do with all of this is we support VMs and stuff there. One of the issues is that users usually do not know name of Azure Service which is used to host their VMs, and it so happens that they do not know even their Subscription Name or Subscription ID. To bring up and control their VMs and environments the use some “middleware” which hides all of this info from them. Continue reading