scripting.rocksStart learning
CoursesPowerShellCyber SecurityLesson 10
03 / INCIDENT TRIAGE WORKFLOWS · LESSON 10

Add context to network observations

Enrich exported connection observations with process context without making live network requests.

12 min · learn at your pace

Work from observations

The supplied connection export records destination addresses and process identities. You are analysing observations already collected, not opening connections or scanning hosts. The addresses use documentation-only ranges. A shared advanced path will cover building a TCP port scanner after the role courses.

First select exact destination-address matches from the supplied indicator list. Treat addresses as complete fields; 203.0.113.20 must not match 203.0.113.200 merely because one is a substring of the other.

Enrich the selected records

Join each selected connection to the process export using both Computer and ProcessGuid. Keep the connection even when no matching process exists. Unknown is a more honest image value than an invented process name or a silently dropped observation.

Get-Content '/home/user/connections.json' -Raw |
    ConvertFrom-Json |
    Select-Object Computer, DestinationIp, DestinationPort

An observed destination port does not tell you whether the application was safe, whether a handshake completed, or what data was exchanged. Likewise, an empty export does not establish that no network activity occurred: collection may have been disabled or incomplete.

Your output is a short review queue with source record IDs and process context. It deliberately avoids declaring a host compromised. Preserve that distinction when naming fields and writing summaries for other people.

Try an example.ps1
Get-Content '/home/user/ip-indicators.json' -Raw | ConvertFrom-Json
YOUR TURN

Put it into practice.

Select connections whose DestinationIp exactly matches ip-indicators.json Addresses. Emit RecordId, Computer, DestinationIp, and Image joined from processes.json using Computer plus ProcessGuid. Retain matches with missing process records as Image Unknown. Do not perform network requests.

See an explained solution
One way to solve it.ps1
$processes = @(Get-Content '/home/user/processes.json' -Raw | ConvertFrom-Json -DateKind String)
$connections = @(Get-Content '/home/user/connections.json' -Raw | ConvertFrom-Json)
$indicators = (Get-Content '/home/user/ip-indicators.json' -Raw | ConvertFrom-Json).Addresses
foreach ($connection in $connections) {
    if ($connection.DestinationIp -in $indicators) {
        $process = $processes | Where-Object { $_.Computer -eq $connection.Computer -and $_.ProcessGuid -eq $connection.ProcessGuid }
        [pscustomobject]@{ RecordId=$connection.RecordId; Computer=$connection.Computer; DestinationIp=$connection.DestinationIp; Image=$(if ($process) { $process.Image } else { 'Unknown' }) }
    }
}

Exact indicator membership removes the lookalike address. The join adds process names where evidence exists and keeps N03 visible with Unknown context.