'Alan dot Kaplan at VA dot Gov
'6/7/2010, 7/28/10
'Creates a filter to be used by ISA server to capture all traffic to an IP during an interval of time.
'Tested only with ISA 2004 Standalone Cached mode
'You can run this interactively or from commandline, example:
'CreateDestinationAndTimeFilter /start:"6/7/2010 7:00:00 AM" /end:"6/7/2010 5:30:00 PM" /IP:192.168.100.65

Option Explicit

dim quote
quote=chr(34)
Dim scriptpath
dim sDate, sTime, strStart, StrStartValue
Dim eDate, eTime, strEnd, strEndValue, strIP
Dim strText, strTxtFileName, objTXTFile
Dim bTimeFormat, bTimeFormatokay

dim wshShell
Set wshShell = WScript.CreateObject("WScript.Shell")

If WScript.Arguments.Named.Count <> 3 Then 
	PromptArgs
Else
	strStart = WScript.Arguments.Named("Start")
	strEnd = WScript.Arguments.Named("End")
	eDate = FormatDateTime(CDate(strEnd),vbShortDate)
	strIP = WScript.Arguments.Named("IP")
End If 

StrStartValue = GetDbl(cDate(strStart))
strEndValue = GetDbl(cDate(strEnd))

'get path name, ending in \
scriptpath = Left(Wscript.ScriptFullName, InStrRev(Wscript.ScriptFullName, "\"))
'this will create a file called DestinationAndTimeFilter.xml"
dim fso
Set fso = CreateObject("Scripting.FileSystemObject")

'set objTXTFile = fso.opentextfile(strTXTfilename, 8, true)
strText = "<Query><Filter FilterType=""LogViewer"" AdminVersion=""2""><FilterExpression>"& _
"<Criteria Name=""Log Record Type"" Value=""23""/><Condition Name=""Equals"" Value=""1""/>" & _
"<Value ValueType=""5"" Name=""Web Proxy Filter"" Value=""1""/></FilterExpression><FilterExpression>" & _
"<Criteria Name=""Log Time"" Value=""18""/><Condition Name=""On or After"" Value=""16""/>" & _
"<Value ValueType=""2"" Name=" & quote & strStart & quote & " Value=" & quote & strStartValue & quote &"/>" & _
"</FilterExpression><FilterExpression><Criteria Name=""Destination IP"" Value=""9""/>" & _
"<Condition Name=""Equals"" Value=""1""/><Value ValueType=""4"" Value=" & quote & strIP & quote &"/>" & _
"</FilterExpression><FilterExpression><Criteria Name=""Log Time"" Value=""18""/>" & _
"<Condition Name=""On or Before"" Value=""32""/>" & _
"<Value ValueType=""2"" Name=" & quote & strEnd & quote & " Value="& quote & strEndValue & quote & "/></FilterExpression></Filter><Columns>" & _
"<IsaList SortColumnId=""9328"" SortDirection=""0""><Column Id=""9343"" Width=""100"" Visible=""0""/><Column Id=""9303"" Width=""100"" Visible=""0""/>" & _
"<Column Id=""9304"" Width=""100"" Visible=""0""/><Column Id=""9305"" Width=""100"" Visible=""0""/><Column Id=""9306"" Width=""100"" Visible=""0""/>" & _
"<Column Id=""9307"" Width=""100"" Visible=""0""/><Column Id=""9308"" Width=""100"" Visible=""0""/><Column Id=""9311"" Width=""100"" Visible=""0""/>" & _
"<Column Id=""9316"" Width=""100"" Visible=""0""/><Column Id=""9317"" Width=""100"" Visible=""0""/><Column Id=""9320"" Width=""100"" Visible=""0""/>" & _
"<Column Id=""9321"" Width=""100"" Visible=""0""/><Column Id=""9341"" Width=""100"" Visible=""0""/><Column Id=""9323"" Width=""100"" Visible=""0""/>" & _
"<Column Id=""9342"" Width=""100"" Visible=""0""/><Column Id=""9325"" Width=""100"" Visible=""0""/><Column Id=""9326"" Width=""100"" Visible=""0""/>" & _
"<Column Id=""9327"" Width=""100"" Visible=""0""/><Column Id=""9329"" Width=""100"" Visible=""0""/><Column Id=""9331"" Width=""100"" Visible=""0""/>" & _
"<Column Id=""9332"" Width=""100"" Visible=""0""/><Column Id=""9333"" Width=""100"" Visible=""0""/><Column Id=""9334"" Width=""100"" Visible=""0""/>" & _
"<Column Id=""9344"" Width=""100"" Visible=""0""/><Column Id=""9335"" Width=""100"" Visible=""0""/><Column Id=""9339"" Width=""100"" Visible=""0""/>" & _
"<Column Id=""9336"" Width=""91"" Visible=""0""/><Column Id=""9328"" Width=""125"" Visible=""-1""/><Column Id=""9309"" Width=""90"" Visible=""-1""/>" & _
"<Column Id=""9330"" Width=""90"" Visible=""-1""/><Column Id=""9310"" Width=""173"" Visible=""-1""/><Column Id=""9322"" Width=""50"" Visible=""-1""/>" & _
"<Column Id=""9324"" Width=""151"" Visible=""-1""/><Column Id=""9301"" Width=""90"" Visible=""-1""/><Column Id=""9302"" Width=""155"" Visible=""-1""/>" & _
"<Column Id=""9318"" Width=""100"" Visible=""-1""/><Column Id=""9319"" Width=""100"" Visible=""-1""/><Column Id=""9312"" Width=""100"" Visible=""-1""/>" & _
"<Column Id=""9313"" Width=""100"" Visible=""-1""/></IsaList></Columns></Query>" & VbCrLf 

strTXTfilename=scriptpath & Month(cDate(edate)) & "_" & Day(cDate(edate)) & "_" & Year(cDate(edate))& "_" & replace(strip,".","_") & "_DestinationAndTimeFilter.xml"
If fso.FileExists(strtxtfilename) Then fso.DeleteFile(strTxtFileName)

Set objTxtFile = fso.CreateTextFile(strTXTFileName)
objTXTFile.writeline (strText)
objTXTFile.close

wshShell.Popup "Wrote " & strTxtFileName, 5,"Filter Created"

Function GetDbl (strDateTime)
	GetDbl = CDbl(CDate(strDateTime))
End Function 

Sub OkayTimeFormat(strTime)
	Dim arrCount, charCount
	arrCount = Split(strTime,":")
	CharCount = UBound(arrCount)
	arrCount = Empty
	
	If (charCount< 2) Or (instr(strTime,"M") = 0) Then  
		wshshell.popup "Time must include seconds and AM/PM, example: 2:35:00 PM"
		bTimeFormatokay = False
	Else
		bTimeFormatokay  = True
	End If 
End Sub  

Sub PromptArgs
	sTime = Time
	eTime = DateAdd("h", 1, time)
	Dim bTimeFormatokay 
	
	sDate = InputBox("Enter the date you want to start the log search in the format below:","Start Date", FormatDateTime(Date-7, vbShortDate )) 
	if sDate = "" Then WScript.Quit
	
	bTimeFormatokay = True
	Do
		sTime = InputBox("Enter the time you want to start the log search in the format below:","Start Time", FormatDateTime(Time, vbLongTime )) 
		If sTime = "" Then WScript.Quit
		OkayTimeFormat(sTime)
	Loop While  bTimeFormatokay= False
	
	strStart = sDate & Space(1) & sTime
	
	bTimeFormatokay = True
	Do 
		eDate = InputBox("Enter the date you want to end the log search in the format below:","End Date", sDate) 
		If eDate = "" Then WScript.Quit
		OkayTimeFormat (eTime)
	Loop While bTimeFormatokay = False
	
	eTime = InputBox("Enter the time you want to end searching in the format below:","End Time", Time) 
	If eTime = "" Then WScript.Quit
	
	strEnd= eDate & Space(1) & eTime
	
	
	strIP = InputBox("What is the destination IP to filter","IP")
	If strIP = "" Then WScript.Quit
End Sub