This is about … .
DNS Cache
There are several ways to retrieve this information manually.
- ipconfig /displaydns
Win32_DnsCachefrom WMI repo (Kansa can collect this data)
Kansa can be used for stacking this data.
Stacking, purely manually (no grouping):
Get-ChildItem -Filter "*-DNSCache.csv" | ForEach-Object { Import-Csv $_.FullName } | Export-Csv -Path "DNSCacheStack.csv" -NoTypeInformation
Stacking, purely manual, with grouping (basically, the same results as with Get-LogparserStack.ps1 but the case is ignored):
$csvFiles = Get-ChildItem -Path ".\*DNSCache.csv"
$result = @()
foreach ($csvFile in $csvFiles) {
$data = Import-Csv -Path $csvFile.FullName
$result += $data
}
$groupedData = $result | Group-Object -Property Name | Select-Object Count, Name, @{Name="PC"; Expression={$_.Group.'PSComputerName'}} # the column contains spaces but the script will see no spaces, so, it's not a typo
$groupedData | Export-Csv -Path "result2.csv" -NoTypeInformation
Stacking, Kansa script:
.\Get-LogparserStack.ps1 -FilePattern *DNSCache.csv -Delimiter "," -Direction asc -OutFile DNSCache-stack.csv
You can now use Timeline Explorer or another tool to analyse the data.
To acieve the same on a macOS machine:
awk -F',' 'NR>1{print $1","$2}' *.csv | sort | uniq -c | awk '{print $1","$2","$3}' > merged.csv
And the Python code to do the same (ChatGPT):
import csv
import os
from collections import Counter
# Iterate over all the CSV files in the current directory and extract the objects
objects = []
for filename in os.listdir():
if filename.endswith('.csv'):
with open(filename, 'r') as file:
reader = csv.reader(file)
objects += list(map(lambda row: (row[0], row[1]), list(reader)[1:]))
# Use Counter to count the occurrences of each object
object_counts = Counter(objects)
# Write the merged CSV file
with open('merged.csv', 'w', newline='') as file:
writer = csv.writer(file)
# Write the header row
writer.writerow(['count', 'Name', 'IP'])
# Iterate over the Counter items and write each object as a row in the CSV
for object, count in object_counts.items():
writer.writerow([count, *object])