A little more about graphs, or how to detect dependencies between your applications.

Good time of day, colleagues. Recently, quite a lot of talk about the transfer of applications from physical infrastructures, read data centers, to the cloud. For example, in Microsoft Azure . Well, or in general, about any other transfer of one or several applications from one place to another. One of the biggest problems in such tasks is the need to find all external dependencies of the application. This does not mean dependencies in the code, but dependencies on external, in relation to the application, systems. As a matter of fact, sometimes we need to find with whom our proposal is talking, and who is talking to him. How to do this if we do not have a deployed SIEM, so to say means "SIEM for the poor." As a matter of fact, for systems on Windows there is the following sentence.

We need:

• Enable logging to the Windows Firewall on all machines one way or another associated with the application
• Download to PSQuickGraph module admin station
• Collect and analyze logs, build a connection graph

In the simplest form, log analysis looks like this. Terrible, in the forehead, but what can you do. In fact, I was even too lazy to write logic for a run through the logs, I just copied everything twice. But for our purposes, "roughly and to the forehead" will also go to show the idea.

$f = gc "C:\Temp\pfirewall_public.log"
$regex = '^(?<datetime>\d{4,4}-\d{2,2}-\d{2,2}\s\d{2}:\d{2}:\d{2})\s(?<action>\w+)\s(?<protocol>\w+)\s(?<srcip>\b(?:\d{1,3}\.){3}\d{1,3}\b)\s(?<dstip>\b(?:\d{1,3}\.){3}\d{1,3}\b)\s(?<srcport>\d{1,5})\s(?<dstport>\d{1,5})\s(?<size>\d+|-)\s(?<tcpflags>\d+|-)\s(?<tcpsyn>\d+|-)\s(?<tcpack>\d+|-)\s(?<tcpwin>\d+|-)\s(?<icmptype>\d+|-)\s(?<icmpcode>\d+|-)\s(?<info>\d+|-)\s(?<path>.+)$'
$log =
$f | % {
    $_ -match $regex | Out-Null
    if ($Matches) {
    [PSCustomObject]@{
        action   = $Matches.action
        srcip    = [ipaddress]$Matches.srcip
        dstport  = $Matches.dstport
        tcpflags = $Matches.tcpflags
        dstip    = [ipaddress]$Matches.dstip
        info     = $Matches.info
        size     = $Matches.size
        protocol = $Matches.protocol
        tcpack   = $Matches.tcpac
        srcport  = $Matches.srcport
        tcpsyn   = $Matches.tcpsyn
        datetime = [datetime]$Matches.datetime
        icmptype = $Matches.icmptype
        tcpwin   = $Matches.tcpwin
        icmpcode = $Matches.icmpcode
        path     = $Matches.path
    }
    }
}
$f = gc "C:\Temp\pfirewall_public2.log"
$log2 =
$f | % {
    $_ -match $regex | Out-Null
    if ($Matches) {
    [PSCustomObject]@{
        action   = $Matches.action
        srcip    = [ipaddress]$Matches.srcip
        dstport  = $Matches.dstport
        tcpflags = $Matches.tcpflags
        dstip    = [ipaddress]$Matches.dstip
        info     = $Matches.info
        size     = $Matches.size
        protocol = $Matches.protocol
        tcpack   = $Matches.tcpac
        srcport  = $Matches.srcport
        tcpsyn   = $Matches.tcpsyn
        datetime = [datetime]$Matches.datetime
        icmptype = $Matches.icmptype
        tcpwin   = $Matches.tcpwin
        icmpcode = $Matches.icmpcode
        path     = $Matches.path
    }
    }
}
$l = $log + $log2
$g = new-graph -Type BidirectionalGraph
$l | ? {$_.srcip -and $_.dstip} | % {
    Add-Edge -From $_.srcip -To $_.dstip -Graph $g | out-null
}
Show-GraphLayout -Graph $g

As a matter of fact, in this example, we simply parse the Windows Firewall log using a regular expression, breaking it into objects - one object per line. God bless her with RAM, we won't die. In this example, we have two logs from two different machines. After parsing, we simply merge everything into one large array and search through it, adding vertices and edges of the graph. Well, as a result - we display it. So, approximately, it looks as a result:

I hope someone will come in handy.