Audit and align v1 runtime design

1 files changed, 10 insertions, 8 deletions

diff --git a/src/Agent.Windows/Network/TaskNetworkPolicy.cs b/src/Agent.Windows/Network/TaskNetworkPolicy.cs
index 59b2602..bc4d291 100644
--- a/src/Agent.Windows/Network/TaskNetworkPolicy.cs
+++ b/src/Agent.Windows/Network/TaskNetworkPolicy.cs
@@ -13,16 +13,18 @@ public sealed class TaskNetworkPolicy : IDisposable
     private readonly SecurityIdentifier _appContainerSid;
     private readonly Guid _loopbackEntryId;
     private readonly bool _loopbackAdded;
+    private readonly Guid? _sessionId;
     private bool _disposed;
 
     private TaskNetworkPolicy(WfpDynamicSession session, TaskResourceJournal journal, ISecurityAuditSink audit, Guid entryId,
-        SecurityIdentifier appContainerSid, Guid loopbackEntryId, bool loopbackAdded)
+        SecurityIdentifier appContainerSid, Guid loopbackEntryId, bool loopbackAdded, Guid? sessionId)
     {
         _session = session; _journal = journal; _audit = audit; _entryId = entryId;
         _appContainerSid = appContainerSid; _loopbackEntryId = loopbackEntryId; _loopbackAdded = loopbackAdded;
+        _sessionId = sessionId;
     }
 
-    public static TaskNetworkPolicy Apply(TaskResourceJournal journal, SecurityIdentifier appContainerSid, IReadOnlyList<NetworkEndpoint> allowances, ISecurityAuditSink audit)
+    public static TaskNetworkPolicy Apply(TaskResourceJournal journal, SecurityIdentifier appContainerSid, IReadOnlyList<NetworkEndpoint> allowances, ISecurityAuditSink audit, Guid? sessionId = null)
     {
         bool originallyExempt = LoopbackExemption.Contains(appContainerSid);
         Guid loopbackEntryId = journal.Prepare("network.loopback_exemption", appContainerSid.Value,
@@ -39,13 +41,13 @@ public sealed class TaskNetworkPolicy : IDisposable
             journal.MarkApplied(loopbackEntryId, new Dictionary<string, string> { ["added"] = loopbackAdded.ToString() });
             IReadOnlyList<ulong> ids = session.ApplyDefaultBlock(appContainerSid, allowances);
             journal.MarkApplied(entryId, new Dictionary<string, string> { ["filter_ids"] = string.Join(',', ids) });
-            audit.Write(new(DateTimeOffset.UtcNow, journal.TaskId, "wfp.apply", "applied", new Dictionary<string, string>
+            audit.Write(new(DateTimeOffset.UtcNow, journal.TaskId, "network.rule.apply", "applied", new Dictionary<string, string>
             {
                 ["ipv4_ipv6_default_block"] = "true", ["filter_count"] = ids.Count.ToString(), ["session"] = "dynamic"
-            }));
+            }, SessionId: sessionId));
             audit.Write(new(DateTimeOffset.UtcNow, journal.TaskId, "network.loopback.apply", loopbackAdded ? "added" : "preserved",
-                new Dictionary<string, string> { ["app_container_sid"] = appContainerSid.Value }));
-            return new(session, journal, audit, entryId, appContainerSid, loopbackEntryId, loopbackAdded);
+                new Dictionary<string, string> { ["app_container_sid"] = appContainerSid.Value }, SessionId: sessionId));
+            return new(session, journal, audit, entryId, appContainerSid, loopbackEntryId, loopbackAdded, sessionId);
         }
         catch
         {
@@ -65,9 +67,9 @@ public sealed class TaskNetworkPolicy : IDisposable
         _journal.MarkCleaned(_entryId);
         if (_loopbackAdded) LoopbackExemption.Remove(_appContainerSid);
         _journal.MarkCleaned(_loopbackEntryId);
-        _audit.Write(new(DateTimeOffset.UtcNow, _journal.TaskId, "wfp.remove", "removed", new Dictionary<string, string> { ["residual_filters"] = "0" }));
+        _audit.Write(new(DateTimeOffset.UtcNow, _journal.TaskId, "network.rule.remove", "removed", new Dictionary<string, string> { ["residual_filters"] = "0" }, SessionId: _sessionId));
         _audit.Write(new(DateTimeOffset.UtcNow, _journal.TaskId, "network.loopback.remove", "removed",
-            new Dictionary<string, string> { ["residual_exemptions"] = LoopbackExemption.Contains(_appContainerSid) ? "preexisting" : "0" }));
+            new Dictionary<string, string> { ["residual_exemptions"] = LoopbackExemption.Contains(_appContainerSid) ? "preexisting" : "0" }, SessionId: _sessionId));
         _disposed = true;
     }
 }