Skip to content

Home

Jump to bottom
Mikhail Deynekin edited this page Jan 3, 2026 · 2 revisions

1st-RDPMon Documentation

License: MIT PowerShell 7.5+ Windows LiteDB

🚀 Welcome to 1st-RDPMon

1st-RDPMon is an enterprise-grade PowerShell security analyzer for Remote Desktop Protocol (RDP) authentication monitoring. This powerful tool provides comprehensive analysis of RDP login events, threat detection, and automated IP banning mechanisms with multi-format reporting capabilities.

📋 Key Features

  • Real-time RDP Event Analysis: Monitor and analyze Windows RDP authentication logs
  • LiteDB Integration: Persistent data storage for historical analysis and trend detection
  • Threat Classification: Automatic categorization of login attempts (Attack/Legit/Unknown)
  • Multiple Export Formats: Table, JSON, CSV, XML, HTML, YAML, Markdown
  • Interactive HTML Reports: Professional visual reports with filtering and drill-down capabilities
  • IP Banning Automation: Manual and automated firewall rule management
  • Advanced Filtering: CIDR notation, wildcard matching, time-based queries
  • Performance Optimized: Efficiently handles large-scale datasets

📚 Documentation Structure

🏁 Getting Started

  1. Installation Guide - Prerequisites, deployment methods, and setup verification
  2. Quick Start Tutorial - Your first RDP analysis in 5 minutes
  3. Basic Examples - Console analysis, exports, and common tasks

⚙️ Core Concepts

  1. Architecture Overview - System design, components, and data flow
  2. Database Structure - LiteDB schema, collections, and relationships
  3. Output Formats - Available export formats and customization options
  4. Backup & Recovery - Data protection, export, and emergency procedures

🔧 Usage & Configuration

  1. Command Reference - Complete parameter listing and syntax
  2. Filtering Guide - Type filtering, IP patterns, time ranges
  3. Pattern Matching - IP, username, and connection classification
  4. Environment Setup - Execution policy, privileges, permissions

🛡️ Advanced Topics

  1. IP Banning Mechanisms - Firewall integration and blocklist management
  2. Performance Tuning - Optimization for large datasets
  3. Security Hardening - Read-only access, audit trails, compliance
  4. Enterprise Deployment - Automation, scheduled tasks, SIEM integration

📖 Reference & Support

  1. FAQ - Frequently asked questions and best practices
  2. Troubleshooting - Common issues and solutions
  3. Error Codes - Exit codes and error message catalog
  4. Compatibility Matrix - System requirements and version support

🤝 Community

  1. Contributing Guide - Code standards and contribution process
  2. Code of Conduct - Community guidelines
  3. Support Channels - Where to get help

🎯 Quick Navigation

Beginner? Start here → Installation Guide → Quick Start Tutorial

Need help? → FAQ → Troubleshooting

Looking for details? → Command Reference → Database Structure

Advanced user? → Performance Tuning → Enterprise Deployment

📦 System Requirements

  • Operating System: Windows 7 SP1 or later (Windows 10/11 recommended)
  • PowerShell: Version 7.5 or higher
  • RAM: Minimum 2GB (4GB+ for large datasets)
  • Storage: 500MB free space for database and reports
  • LiteDB: Version 5.0 or later
  • Administrator privileges: Required for RDP event log access

⚡ Getting Started Quickly

Installation (One-liner)

Add-Type -Path 'C:\path\to\LiteDB.dll'; & '1st-RDPMon.ps1'

First Analysis

# Analyze RDP events from the last 24 hours
$result = & .\1st-RDPMon.ps1 -Days 1

# Display results in table format
$result | Format-Table -AutoSize

# Export to HTML report
$result | Export-Html -Path './report.html'

📝 Version Information

Component Version Status
1st-RDPMon Latest Active
PowerShell 7.5+ Required
LiteDB 5.0+ Required
Windows 7 SP1+ Supported

🔗 Quick Links

📄 License

This project is licensed under the MIT License. See the LICENSE file in the main repository for details.

Last Updated: January 2026

Maintainer: Mikhail Dvonetkin

Clone this wiki locally