src/Agent.Windows/Security/SecurityAudit.cs


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

using System.Text.Json;

namespace Agent.Windows.Security;

public sealed record SecurityAuditEvent(DateTimeOffset Timestamp, Guid TaskId, string Event, string Outcome, IReadOnlyDictionary<string, string> Data);

public interface ISecurityAuditSink
{
    void Write(SecurityAuditEvent auditEvent);
}

public sealed class JsonLinesSecurityAuditSink(string path) : ISecurityAuditSink
{
    private readonly object _sync = new();
    public void Write(SecurityAuditEvent auditEvent)
    {
        string? directory = Path.GetDirectoryName(Path.GetFullPath(path));
        if (directory is not null) Directory.CreateDirectory(directory);
        string line = JsonSerializer.Serialize(auditEvent);
        lock (_sync) File.AppendAllText(path, line + Environment.NewLine);
    }
}

public sealed class MemorySecurityAuditSink : ISecurityAuditSink
{
    private readonly List<SecurityAuditEvent> _events = [];
    public IReadOnlyList<SecurityAuditEvent> Events => _events;
    public void Write(SecurityAuditEvent auditEvent) => _events.Add(auditEvent);
}