$days = 5 $obj = @() $fw = Get-WinEvent "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall" foreach ($temp_fw in $fw) { if ($temp_fw.id -eq 2097) { # 2004 $type = "Added Rule" } elseif ($temp_fw.id -eq 2006) { $type = "Deleted Rule" } $port = $temp_fw.Properties[7] | select -ExpandProperty value $name = $temp_fw.Properties[1] | select -ExpandProperty value $obj += [PSCustomObject]@{ Time = $temp_fw.TimeCreated; Type = $type; Port = $port; Name = $name} } $obj | Where-Object time -gt (Get-Date).AddDays(-$days)