src/Agent.Windows/Security/SecurityAudit.cs


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

using System.Text.Json;

namespace Agent.Windows.Security;

public sealed record SecurityAuditEvent(DateTimeOffset Timestamp, Guid TaskId, string Event, string Outcome,
    IReadOnlyDictionary<string, string> Data, Guid? SessionId = null, string? ErrorCode = null);

public interface ISecurityAuditSink
{
    void Write(SecurityAuditEvent auditEvent);
}

public sealed class JsonLinesSecurityAuditSink(string path) : ISecurityAuditSink
{
    private readonly object _sync = new();
    private static readonly JsonSerializerOptions Json = new(JsonSerializerDefaults.Web);
    public void Write(SecurityAuditEvent auditEvent)
    {
        string? directory = Path.GetDirectoryName(Path.GetFullPath(path));
        if (directory is not null) Directory.CreateDirectory(directory);
        string line = JsonSerializer.Serialize(auditEvent, Json);
        lock (_sync) File.AppendAllText(path, line + Environment.NewLine);
    }
}

public sealed class MemorySecurityAuditSink : ISecurityAuditSink
{
    private readonly List<SecurityAuditEvent> _events = [];
    public IReadOnlyList<SecurityAuditEvent> Events => _events;
    public void Write(SecurityAuditEvent auditEvent) => _events.Add(auditEvent);
}