1 files changed, 29 insertions, 0 deletions
diff --git a/src/Agent.Windows/Security/SecurityAudit.cs b/src/Agent.Windows/Security/SecurityAudit.cs
new file mode 100644
index 0000000..8858c2b
--- /dev/null
+++ b/src/Agent.Windows/Security/SecurityAudit.cs
@@ -0,0 +1,29 @@
+using System.Text.Json;
+
+namespace Agent.Windows.Security;
+
+public sealed record SecurityAuditEvent(DateTimeOffset Timestamp, Guid TaskId, string Event, string Outcome, IReadOnlyDictionary<string, string> Data);
+
+public interface ISecurityAuditSink
+{
+    void Write(SecurityAuditEvent auditEvent);
+}
+
+public sealed class JsonLinesSecurityAuditSink(string path) : ISecurityAuditSink
+{
+    private readonly object _sync = new();
+    public void Write(SecurityAuditEvent auditEvent)
+    {
+        string? directory = Path.GetDirectoryName(Path.GetFullPath(path));
+        if (directory is not null) Directory.CreateDirectory(directory);
+        string line = JsonSerializer.Serialize(auditEvent);
+        lock (_sync) File.AppendAllText(path, line + Environment.NewLine);
+    }
+}
+
+public sealed class MemorySecurityAuditSink : ISecurityAuditSink
+{
+    private readonly List<SecurityAuditEvent> _events = [];
+    public IReadOnlyList<SecurityAuditEvent> Events => _events;
+    public void Write(SecurityAuditEvent auditEvent) => _events.Add(auditEvent);
+}