menu with pre configured query for admin

[Ced-g-77]

Hello,
Thanks for the work, this script can be useful.
I tried to add menu to have quick access, this share of idea is for information (in french):

# Script powershell de consultation d'information Fortigate

# Cgs 12/03/2025

# Source https://github.com/FortiPower/PowerFGT

 

function Show-Menu

{

    param (

        [string]$Title = 'Menu PowerFGT'

    )

    Clear-Host

    Write-Host "================ $Title ================"

   

    Write-Host "1: Installation module PowerFGT"

    Write-Host "2: Connexion PowerFGT"

    Write-Host "3: Affichage aide module PowerFGT"

    Write-Host "4: Affichage des stratégies firewall"

    Write-Host "5: Affichage des adresses firewall"

    Write-Host "6: Affichage des interfaces"

    Write-Host "7: Informations API"

    Write-Host "8: Journaux"

    Write-Host "9: Recherche de journaux préconfigurés"

    Write-Host "10: Deconnexion PowerFGT"

    Write-Host "Q: Quitter."

    return

}

 

function Saisie-Connect-FGT

{

$Ip_fgt = Read-Host ("Adresse Ip Fortigate ?")

# Import the module

Import-Module PowerFGT

return $Ip_fgt

}

 

Show-Menu

 

$selection = Read-Host "Choisir l'option"

 

 

  switch ($selection)

{

     '1' {

# Automated installation (Powershell 5 or later):

    Install-Module PowerFGT

}

     '2' {

Write-host ""

Write-host "-----------------------------------------------------------"

Write-host -ForegroundColor Green " Connexion PowerFGT"

Write-host "-----------------------------------------------------------"

Write-host ""

 

$Ip_fgt = Saisie-Connect-FGT

# Connect to the FortiGate Firewall

Connect-FGT $Ip_fgt

}

 

     '3' {

# Get commands in the module

Write-host ""

Write-host "-----------------------------------------------------------"

Write-host -ForegroundColor Green "Affichage aide module PowerFGT"

Write-host "-----------------------------------------------------------"

Write-host ""

 

$(Get-Command -Module PowerFGT).Name

}

 

     '4' {

Write-host ""

Write-host "-----------------------------------------------------------"

Write-host -ForegroundColor Green "Affichage des stratégies firewall"

Write-host "-----------------------------------------------------------"

Write-host ""

 

Get-FGTFirewallPolicy | Select-Object name,policyid | Sort-Object policyid

}

 

 

     '5' {

Write-host ""

Write-host "-----------------------------------------------------------"

Write-host -ForegroundColor Green "Affichage des adresses firewall"

Write-host "-----------------------------------------------------------"

Write-host ""

 

Get-FGTFirewallAddress | Format-Table

}

 

 

     '6' {

Write-host ""

Write-host "-----------------------------------------------------------"

Write-host -ForegroundColor Green "Affichage des interfaces"

Write-host "-----------------------------------------------------------"

Write-host ""

 

Get-FGTSystemInterface | Format-Table

}

 

     '7' {

 

Write-host ""

Write-host "-----------------------------------------------------------"

Write-host -ForegroundColor Green "Informations API"

Write-host "-----------------------------------------------------------"

Write-host ""

$schema_list = Read-Host ("Afficher le schéma Api (o/n)")

 

if ($schema_list -eq "o")

{

 

$schema_api = Invoke-FGTRestMethod -method "get" -uri "api/v2/cmdb/?action=schema"

foreach ($line in $schema_api.results)

{

$path = $line.path

$name = $line.name

Write-Host "Path : $path / Name : $name"

}

}

 

$path_api = Read-Host ("Saisir le path ? (exemple : system)")

$nom_api = Read-Host ("Saisir le nom ? (exemple : global)")

(Invoke-FGTRestMethod -method "get" -uri "api/v2/cmdb/$path_api/$nom_api").results

}

 

     '8' {

Write-host ""

Write-host "-----------------------------------------------------------"

Write-host -ForegroundColor Green "Journaux"

Write-host "-----------------------------------------------------------"

Write-host ""

 

Write-host "10 connexions en cours"

Get-FGTLogTraffic -type memory -subtype forward -rows 10 | Select-Object date,time,level,vd,srcip,srcname,srcintf,dstip,dstport,srccountry,dstcountry,action,policyname,service,app,apprisk,duration,sentbyte,rcvdbyte,utmaction,osname,unauthuser,unauthusersource,srcmac | ft * -wrap -AutoSize

 

Write-host "Liste des informations filtrables :"

Write-host "

date        

time        

subtype     

level       

vd          

srcip       

srcport     

srcintf     

srcintfrole 

dstip       

dstport     

dstintf     

dstintfrole 

srccountry  

dstcountry  

sessionid   

proto       

action      

policyid    

policytype  

policyname  

service     

trandisp    

app         

appcat      

apprisk     

applist     

duration    

sentbyte    

rcvdbyte    

sentpkt     

rcvdpkt     

utmaction   

countapp    

mastersrcmac

srcmac      

"

$filtre = Read-Host "Choisissez un filtre"

 

 

Write-Host "Afficher les 100 derniers journaux "

Write-host "-----"

Write-host -ForegroundColor Cyan "Affichage des informations par groupe : "

Write-host "-----"

 

$resultat = @()

# Affichage des 100 derniers journaux (groupe)

Get-FGTLogTraffic -type memory -subtype forward -rows 100 | select-object $filtre | Group-Object -Property $filtre -NoElement | Where-Object Name -ne "" | Sort-Object -Property @{Expression = "Count"; Descending = $true}

 

Write-host "-----"

# Affichage des 100 derniers journaux avec le filtre

$resultat = Get-FGTLogTraffic -type memory -subtype forward -rows 100  | Where-Object $filtre -ne $null | Select-Object date,time,$filtre | ft * -wrap -AutoSize

$resultat

 

 

}

     '9' {

Write-host ""

Write-host "-----------------------------------------------------------"

Write-host -ForegroundColor Green "Recherche de journaux préconfigurés"

Write-host "-----------------------------------------------------------"

Write-host ""

 

    Write-Host "1: 1000 derniers forward deny"

    Write-Host "2: 1000 derniers forward deny avec un port TCP de destination"

    Write-Host "3: 1000 derniers forward deny avec une adresse IP source"

    Write-Host "4: 1000 derniers forward deny avec une adresse mac source"

    Write-Host "5: 1000 derniers forward deny avec une adresse IP de destination"

 

 

$selection_journal = Read-Host "Choisir l'option"

 

if ($selection_journal -eq 1)

{

Write-host "Recherche 1000 derniers forward deny regroupés"

 

$(Get-FGTLogTraffic -type memory -subtype forward -rows 1000).srcintf |  Group-Object  -NoElement | Where-Object Name -ne "" | Sort-Object -Property @{Expression = "Count"; Descending = $true}

 

Write-host "------------------------"

Write-host "Affichage des entrées"

Write-host "------------------------"

 

Get-FGTLogTraffic -type memory -subtype forward -rows 1000  | Where-Object action -eq deny | Select-Object date,time,level,vd,srcip,srcname,srcintf,dstip,dstport,srccountry,dstcountry,action,policyname,service,app,apprisk,duration,sentbyte,rcvdbyte,utmaction,osname,unauthuser,unauthusersource,srcmac | ft * -wrap -AutoSize

#Get-FGTLogTraffic -type fortianalyzer -subtype forward  -rows 1000 -since 7d  | Select-Object date,time,level,vd,app,apprisk,osname,srcname,srcip,srcport,dstip,dstport,action,policyname,service,unauthuser | Where-Object action -eq deny | ft *

$continue = "0"

$continue = Read-Host "Afficher en continue avec ctrl + c pour arréter (o/n) "

if ($continue -eq "o")

{

while (1) {

Get-FGTLogTraffic -type memory -subtype forward -rows 1000  | Where-Object action -eq deny | Select-Object date,time,level,vd,srcip,srcname,srcintf,dstip,dstport,srccountry,dstcountry,action,policyname,service,app,apprisk,duration,sentbyte,rcvdbyte,utmaction,osname,unauthuser,unauthusersource,srcmac | ft * -wrap -AutoSize

sleep 5}

}

}

 

elseif ($selection_journal -eq 2)

{

Write-host "Recherche 1000 derniers forward deny par port de destination regroupés"

(Get-FGTLogTraffic -type memory -subtype forward -rows 1000   | Where-Object action -eq deny).dstport | group -NoElement

 

$prt_dest = Read-host "Port de Destination"

Write-host "------------------------"

Write-host "Affichage des entrées avec le port de destination $prt_dest "

Write-host "------------------------"

Get-FGTLogTraffic -type memory -subtype forward -rows 1000 -dstport $prt_dest | Where-Object action -eq deny  | Select-Object date,time,level,vd,srcip,srcname,srcintf,dstip,dstport,srccountry,dstcountry,action,policyname,service,app,apprisk,duration,sentbyte,rcvdbyte,utmaction,osname,unauthuser,unauthusersource,srcmac | ft * -wrap -AutoSize

$continue = "0"

$continue = Read-Host "Afficher en continue avec ctrl + c pour arréter (o/n) "

if ($continue -eq "o")

{

while (1) {

Get-FGTLogTraffic -type memory -subtype forward -rows 1000 -dstport $prt_dest | Where-Object action -eq deny  | Select-Object date,time,level,vd,srcip,srcname,srcintf,dstip,dstport,srccountry,dstcountry,action,policyname,service,app,apprisk,duration,sentbyte,rcvdbyte,utmaction,osname,unauthuser,unauthusersource,srcmac | ft * -wrap -AutoSize

sleep 5}

}

}

 

elseif ($selection_journal -eq 3)

{

Write-host "Recherche 1000 derniers forward deny par adresse source regroupés"

(Get-FGTLogTraffic -type memory -subtype forward -rows 1000   | Where-Object action -eq deny).srcip | group -NoElement

 

$src_ip = Read-host "Adresse IP source"

Write-host "------------------------"

Write-host "Affichage des entrées avec l'adresse source $src_ip"

Write-host "------------------------"

Get-FGTLogTraffic -type memory -subtype forward -rows 1000 -srcip $src_ip  | Where-Object action -eq deny | Select-Object date,time,level,vd,srcip,srcname,srcintf,dstip,dstport,srccountry,dstcountry,action,policyname,service,app,apprisk,duration,sentbyte,rcvdbyte,utmaction,osname,unauthuser,unauthusersource,srcmac | ft * -wrap -AutoSize

$continue = "0"

$continue = Read-Host "Afficher en continue avec ctrl + c pour arréter (o/n) "

if ($continue -eq "o")

{

while (1) {

Get-FGTLogTraffic -type memory -subtype forward -rows 1000 -srcip $src_ip  | Where-Object action -eq deny | Select-Object date,time,level,vd,srcip,srcname,srcintf,dstip,dstport,srccountry,dstcountry,action,policyname,service,app,apprisk,duration,sentbyte,rcvdbyte,utmaction,osname,unauthuser,unauthusersource,srcmac | ft * -wrap -AutoSize

sleep 5}

}

}

 

elseif ($selection_journal -eq 4)

{

Write-host "Recherche 1000 derniers forward par adresse source mac regroupés"

(Get-FGTLogTraffic -type memory -subtype forward -rows 1000   | Where-Object action -eq deny).srcmac | group -NoElement

 

$srcmac = Read-host "Adresse source mac"

Write-host "------------------------"

Write-host "Affichage des entrées avec l'adresse source mac $srcmac"

Write-host "------------------------"

Get-FGTLogTraffic -type memory -subtype forward -rows 1000 | Where-Object action -eq deny | Where-Object srcmac -eq $srcmac | Select-Object date,time,level,vd,srcip,srcname,srcintf,dstip,dstport,srccountry,dstcountry,action,policyname,service,app,apprisk,duration,sentbyte,rcvdbyte,utmaction,osname,unauthuser,unauthusersource,srcmac | ft * -wrap -AutoSize

$continue = "0"

$continue = Read-Host "Afficher en continue avec ctrl + c pour arréter (o/n) "

if ($continue -eq "o")

{

while (1) {

Get-FGTLogTraffic -type memory -subtype forward -rows 1000 | Where-Object action -eq deny | Where-Object srcmac -eq $srcmac | Select-Object date,time,level,vd,srcip,srcname,srcintf,dstip,dstport,srccountry,dstcountry,action,policyname,service,app,apprisk,duration,sentbyte,rcvdbyte,utmaction,osname,unauthuser,unauthusersource,srcmac | ft * -wrap -AutoSize

sleep 5}

}

}

 

elseif ($selection_journal -eq 5)

{

Write-host "Recherche 1000 derniers forward deny par adresse de destination regroupés"

(Get-FGTLogTraffic -type memory -subtype forward -rows 1000   | Where-Object action -eq deny).dstip | group -NoElement

$dest_ip = Read-host "Adresse IP destination"

Get-FGTLogTraffic -type memory -subtype forward -rows 1000 -dstip $dest_ip  | Where-Object action -eq deny | Select-Object date,time,level,vd,srcip,srcname,srcintf,dstip,dstport,srccountry,dstcountry,action,policyname,service,app,apprisk,duration,sentbyte,rcvdbyte,utmaction,osname,unauthuser,unauthusersource,srcmac | ft * -wrap -AutoSize

$continue = "0"

$continue = Read-Host "Afficher en continue avec ctrl + c pour arréter (o/n) "

if ($continue -eq "o")

{

while (1) {

Get-FGTLogTraffic -type memory -subtype forward -rows 1000 -dstip $dest_ip  | Where-Object action -eq deny | Select-Object date,time,level,vd,srcip,srcname,srcintf,dstip,dstport,srccountry,dstcountry,action,policyname,service,app,apprisk,duration,sentbyte,rcvdbyte,utmaction,osname,unauthuser,unauthusersource,srcmac | ft * -wrap -AutoSize

sleep 5}

}

}

 

 

 

else

{

Write-host "Aucune option"

}

 

 

}

 

 

     '10' {

Write-host ""

Write-host "-----------------------------------------------------------"

Write-host -ForegroundColor Green "Deconnexion PowerFGT"

Write-host "-----------------------------------------------------------"

Write-host ""

 

Disconnect-FGT

}

     'q' {

     exit

     }

 

}

 

[alagoutte]

Bonjour @Cocoking77

Interresing idea

I think, you need to edit for fix synthase (you can use ``` for add code)

[Ced-g-77]

J'ai mis quelques idées de filtres, bonne journée.
Cédric

[alagoutte]

Top !

[Ced-g-77]

Thanks for the tips, during my changes you did it quicker .
Regards,
Cédric