Windows Real Time Network Logging

# Define the output file and temporary log file for monitoring
$logFile = "C:\NetworkLogs\active_network_logs.txt"
$tempLogFile = "C:\NetworkLogs\temp_network_logs.txt"

# Create a directory for the log file if it doesn't exist
if (!(Test-Path "C:\NetworkLogs")) {
    New-Item -Path "C:\NetworkLogs" -ItemType Directory
}

# Start logging
$header = "===== Active Network Logs Dump - $(Get-Date) ====="
$header | Out-File $logFile
Write-Host $header

# 1. Dump all active incoming and outgoing TCP/UDP connections using netstat
$netstatHeader = "--- Active Incoming and Outgoing Network Connections (NetStat) ---"
$netstatHeader | Out-File $logFile -Append
Write-Host $netstatHeader
netstat -an | Tee-Object -FilePath $logFile -Append

# 2. Log active TCP/UDP connections using Get-NetTCPConnection
$tcpHeader = "--- Detailed Active TCP/UDP Connections (PowerShell Cmdlet) ---"
$tcpHeader | Out-File $logFile -Append
Write-Host $tcpHeader
Get-NetTCPConnection | Format-List | Tee-Object -FilePath $logFile -Append

# 3. Capture real-time connection events using Windows Firewall event logs
$firewallHeader = "--- Real-Time Connection Events from Firewall Logs ---"
$firewallHeader | Out-File $logFile -Append
Write-Host $firewallHeader
$firewallLogs = Get-WinEvent -LogName "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall" -MaxEvents 100
$firewallLogs | Format-List | Tee-Object -FilePath $logFile -Append

# 4. Log any blocked/allowed incoming/outgoing connections from firewall (audit entries)
$firewallAuditHeader = "--- Windows Firewall: Blocked/Allowed Network Events ---"
$firewallAuditHeader | Out-File $logFile -Append
Write-Host $firewallAuditHeader
Get-WinEvent -LogName "Security" -FilterXPath "*[System[(EventID=5156 or EventID=5157)]]" | Format-List | Tee-Object -FilePath $logFile -Append

# 5. Monitor IP addresses, ports, and status of active connections using netstat periodically
function Monitor-NetworkTraffic {
    while ($true) {
        $monitorHeader = "===== Monitoring Active Connections at $(Get-Date) ====="
        $monitorHeader | Out-File $tempLogFile
        Write-Host $monitorHeader
        netstat -an | Tee-Object -FilePath $tempLogFile -Append

        # Append temp log to the main log file
        Get-Content $tempLogFile | Out-File $logFile -Append

        # Print the contents of the temp log to the console
        Get-Content $tempLogFile | Write-Host

        Start-Sleep -Seconds 30  # Monitor every 30 seconds
    }
}

# Start real-time monitoring of network traffic
Start-Job -ScriptBlock { Monitor-NetworkTraffic }

# Final log message
$endMessage = "===== End of Initial Network Logs Dump ====="
$endMessage | Out-File $logFile -Append
Write-Host $endMessage

# Open the log file
Invoke-Item $logFile