Rule does not generate

$regex2 = [regex] "Сетевой адрес источника:\t(\d+\.\d+\.\d+\.\d+)";
$MyIp = "192.168.1.111";
$deny_count = 5;
$deny_rule_name = "MY BLACKLIST"
###################### Config ######################
$fw=New-object -comObject HNetCfg.FwPolicy2; 
$RuleCHK=$fw.rules | where-object {$_.name –eq $deny_rule_name}
if(!$RuleCHK){ $deny_rule_name + " rule does not generate."; exit; }
$blacklist = @();
$list ="";
$startTime = (get-date);
"-----------------------------"
"log searching Start : " + $startTime;
"-----------------------------"
$ips = get-eventlog Security | Where-Object {$_.EventID -eq 4625 } | foreach {
$m = $regex2.Match($_.Message); $ip = $m.Groups[1].Value; $ip; } | Sort-Object | Tee-Object -Variable list | Get-Unique
if($list.length -gt 0) {
foreach ( $attack_ip in $list)
{
if($attack_ip){
$myrule = $fw.Rules | where {$_.Name -eq $deny_rule_name} | select -First 1; 
if (-not ($blacklist -contains $attack_ip))
{
$attack_count = ($list | Select-String $attack_ip -SimpleMatch | Measure-Object).count;
if ($attack_count -ge $deny_count) {
if (-not ($myrule.RemoteAddresses -match $attack_ip) -and -not ($attack_ip -like $MyIp))
{
"Found RDP attacking IP on 3389: " + $attack_ip + ", with count: " + $attack_count;
$blacklist = $blacklist + $attack_ip;
"Adding this IP into firewall blocklist: " + $attack_ip;
$myrule.RemoteAddresses+=(", "+$attack_ip);
netsh.exe advfirewall firewall add rule name="$deny_rule_name" dir=in action=block localip=any remoteip="$attack_ip" profile="any"
interfacetype="any"
#echo $attack_ip >> C:\BlackListIP.txt
} else {
$attack_ip + " : Already registered IP"
}
}
}
}
}
$answer = read-host "`ndo you want delete security event log, yes or no"
if ($answer -like "*y*" -and -not $Verbose) {
Clear-EventLog -LogName Security
cls
"Security event log has been deleted"
}
else {
# "`nScript terminated.`nPlease use your testing VM instead.`n" ; exit
}
}else{
"Ошибка аутентификации. Журнал событий отсутствует.."
}
$endTime = (get-date);
"-----------------------------"
" Общее время : " + ($endTime — $startTime ) ;
"…Done…"
"-----------------------------"

$TimeInterval = 10 #minutes
$MaxCount = 5
$FirewallRuleName = "MY BLACKLIST"
$rule = "Windows Inbound Firewall Rule: `"$FirewallRuleName`""
 
function Write-Log ($str) { "$((Get-Date).ToString()) $str" | ac 'C:\Temp\BLACKLIST.txt' -Encoding Unicode}
 
$Events = Get-WinEvent -EA SilentlyContinue -FilterHashtable @{`
    LogName = “Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational”;`
    StartTime = (Get-Date).AddMinutes(-$TimeInterval);`
    Level = 3;`
    ID = 140}
 
$FirewallRule = Get-NetFirewallRule -Direction Inbound -Enabled True -Action Block | ? DisplayName -eq $FirewallRuleName
 
foreach ($item in $Events | select @{N='IPString';E={([xml]$_.ToXml()).Event.EventData.Data.InnerText}} | group IPString | ? Count -ge $MaxCount)
{
       
    $IP = $item.Name
    
    Write-Log "Обнаружено $($item.Count) попыток RDP-входа (с неправильным логином или паролем) на сервере: $env:COMPUTERNAME с IP: $IP"
            
    if ($FirewallRule)
    {
        $RemoteAddress = @(($FirewallRule | Get-NetFirewallAddressFilter).RemoteAddress)
        
        if ($RemoteAddress -contains $IP)
        {
            "IP: $IP уже есть в $rule" | ac $LogFile -Encoding Unicode
        }
        else
        {
            $RemoteAddress += $IP
            $FirewallRule | Set-NetFirewallRule -RemoteAddress $RemoteAddress
            Write-Log "IP: $IP добавлен в $rule"
        }
    }
    else
    {
        Write-Log "IP: $IP не заблокирован, т.к. $rule - не найдено!"
    }    
       
}

get-eventlog Security -after (Get-Date).AddMinutes(-10)| Where-Object {$_.EventID -eq 4625}

$TimeInterval = 10 # min
'server1','server2' | % {Get-WinEvent -Comp $_ -EA SilentlyContinue -FilterHashtable @{`
    LogName = “Security”;`
    StartTime = (Get-Date).AddMinutes(-$TimeInterval);`
    ID = 4625}
} | select TimeCreated,
           MachineName,
           Id,
           TaskDisplayName,
           KeywordsDisplayNames,
           @{N='IP';E={(([xml]$_.ToXml()).event.EventData.Data | ? Name -eq 'IpAddress').'#text'}},
           @{N='TargetUserName';E={(([xml]$_.ToXml()).event.EventData.Data | ? Name -eq 'TargetUserName').'#text'}},
           @{N='WorkstationName';E={(([xml]$_.ToXml()).event.EventData.Data | ? Name -eq 'WorkstationName').'#text'}} | ft -a

 $ips = Get-WinEvent -FilterHashtable @{LogName = "Security";ID = 4625;StartTime = (Get-Date).AddMinutes(-800)} | foreach {
$_.Properties[19].Value } | Where {$_ -as [IPAddress] } | Sort-Object | Tee-Object -Variable list | Get-Unique