private void ResolveDisplayNames(MailboxAuditLogEvent auditRecord) { if (!string.IsNullOrEmpty(auditRecord.LogonUserSid) && string.IsNullOrEmpty(auditRecord.LogonUserDisplayName)) { auditRecord.LogonUserDisplayName = this.GetDisplayNameFromSid(auditRecord.LogonUserSid); } }
private MailboxAuditLogRecord ReadAuditLogRecord(ObjectId itemId, ExDateTime creationTime, string content) { MailboxAuditLogRecordId identity = new MailboxAuditLogRecordId(itemId); string mailboxResolvedName = MailboxAuditLogSearchWorker.ResolveMailboxOwnerName(this.mailboxUser); MailboxAuditLogEvent mailboxAuditLogEvent = AuditLogParseSerialize.ParseMailboxAuditRecord(identity, content, mailboxResolvedName, this.mailboxUser.Guid.ToString(), new DateTime?(creationTime.UniversalTime.ToLocalTime())); this.ResolveDisplayNames(mailboxAuditLogEvent); return(mailboxAuditLogEvent); }
public static MailboxAuditLogEvent ParseMailboxAuditRecord(MailboxAuditLogRecordId identity, string eventLog, string mailboxResolvedName, string guid, DateTime?lastAccessed) { MailboxAuditLogEvent mailboxAuditLogEvent = new MailboxAuditLogEvent(identity, mailboxResolvedName, guid, lastAccessed); using (StringReader stringReader = new StringReader(eventLog)) { PropertyParseSchema[] array = AuditLogParseSerialize.MailboxAuditLogRecordParseSchema; string[] array2 = new string[2]; string text; while ((text = stringReader.ReadLine()) != null) { if (text.Contains(".SourceItemId")) { MultiValuedProperty <MailboxAuditLogSourceItem> multiValuedProperty = mailboxAuditLogEvent[MailboxAuditLogEventSchema.SourceItems] as MultiValuedProperty <MailboxAuditLogSourceItem>; string itemId = text.Substring(text.IndexOf(":") + 1).Trim(); if ((text = stringReader.ReadLine()) == null) { MailboxAuditLogSourceItem item = MailboxAuditLogSourceItem.Parse(itemId, null, null); multiValuedProperty.Add(item); break; } array2[0] = text; text = stringReader.ReadLine(); array2[1] = text; string itemSubject = null; string itemFolderPathName = null; foreach (string text2 in array2) { if (text2 == null) { break; } if (text2.Contains(".SourceItemSubject")) { itemSubject = text2.Substring(text2.IndexOf(":") + 1).Trim(); } if (text2.Contains(".SourceItemFolderPathName")) { itemFolderPathName = text2.Substring(text2.IndexOf(":") + 1).Trim(); } } MailboxAuditLogSourceItem item2 = MailboxAuditLogSourceItem.Parse(itemId, itemSubject, itemFolderPathName); ((MultiValuedProperty <MailboxAuditLogSourceItem>)mailboxAuditLogEvent[MailboxAuditLogEventSchema.SourceItems]).Add(item2); if (text == null) { break; } } else if (text.Contains(".SourceFolderId")) { MultiValuedProperty <MailboxAuditLogSourceFolder> multiValuedProperty2 = mailboxAuditLogEvent[MailboxAuditLogEventSchema.SourceFolders] as MultiValuedProperty <MailboxAuditLogSourceFolder>; string folderId = text.Substring(text.IndexOf(":") + 1).Trim(); if ((text = stringReader.ReadLine()) == null) { MailboxAuditLogSourceFolder item3 = MailboxAuditLogSourceFolder.Parse(folderId, null); multiValuedProperty2.Add(item3); break; } string folderPathName = text.Substring(text.IndexOf(":") + 1).Trim(); MailboxAuditLogSourceFolder item4 = MailboxAuditLogSourceFolder.Parse(folderId, folderPathName); multiValuedProperty2.Add(item4); } else { PropertyParseSchema[] array4 = array; int j = 0; while (j < array4.Length) { PropertyParseSchema propertyParseSchema = array4[j]; if (text.StartsWith(propertyParseSchema.Label, StringComparison.OrdinalIgnoreCase) && text[propertyParseSchema.Label.Length] == ':') { object obj = propertyParseSchema.PropertyParser(text.Substring(propertyParseSchema.Label.Length + 1).Trim()); if (obj != null) { mailboxAuditLogEvent[propertyParseSchema.Property] = obj; break; } break; } else { j++; } } } } } return(mailboxAuditLogEvent); }
public NonOwnerAccessDetailRow(MailboxAuditLogEvent logEvent) : base(logEvent) { this.MailboxAuditLogEvent = logEvent; }
internal NonOwnerAccessDetailRow(Identity id, MailboxAuditLogEvent searchResult) : base(id, searchResult) { this.MailboxAuditLogEvent = searchResult; }
protected override void RenderChanges() { PowerShellResults <NonOwnerAccessDetailRow> powerShellResults = base.Results as PowerShellResults <NonOwnerAccessDetailRow>; if (powerShellResults != null && powerShellResults.Output.Length > 0 && powerShellResults.Succeeded) { Table table = new Table(); table.CssClass = "PropertyForm"; int num = 0; while (num < powerShellResults.Output.Length && num < 500) { NonOwnerAccessDetailRow nonOwnerAccessDetailRow = powerShellResults.Output[num]; MailboxAuditLogEvent mailboxAuditLogEvent = nonOwnerAccessDetailRow.MailboxAuditLogEvent; table.Rows.Add(base.GetDetailRowForTable(Strings.TimeOfOperation, mailboxAuditLogEvent.LastAccessed.Value.ToUniversalTime().UtcToUserDateTimeString())); table.Rows.Add(base.GetDetailRowForTable(Strings.OperationPerformedBy, mailboxAuditLogEvent.LogonUserDisplayName)); table.Rows.Add(base.GetDetailRowForTable(Strings.LogonType, this.GetLocalizedLogonType(mailboxAuditLogEvent.LogonType))); table.Rows.Add(base.GetDetailRowForTable(Strings.OperationType, this.GetLocalizedAction(mailboxAuditLogEvent.Operation))); if (mailboxAuditLogEvent.Operation.Equals(Enum.GetName(typeof(MailboxAuditOperations), MailboxAuditOperations.Move), StringComparison.InvariantCultureIgnoreCase) || mailboxAuditLogEvent.Operation.Equals(Enum.GetName(typeof(MailboxAuditOperations), MailboxAuditOperations.MoveToDeletedItems), StringComparison.InvariantCultureIgnoreCase) || mailboxAuditLogEvent.Operation.Equals(Enum.GetName(typeof(MailboxAuditOperations), MailboxAuditOperations.SoftDelete), StringComparison.InvariantCultureIgnoreCase) || mailboxAuditLogEvent.Operation.Equals(Enum.GetName(typeof(MailboxAuditOperations), MailboxAuditOperations.HardDelete), StringComparison.InvariantCultureIgnoreCase)) { List <string> list = new List <string>(); List <string> list2 = new List <string>(); if (mailboxAuditLogEvent.SourceFolders.Added.Length > 0) { foreach (MailboxAuditLogSourceFolder mailboxAuditLogSourceFolder in mailboxAuditLogEvent.SourceFolders.Added) { if (!list2.Contains(this.FixFolderPathName(mailboxAuditLogSourceFolder.SourceFolderPathName))) { list.Add(this.FixFolderPathName(mailboxAuditLogSourceFolder.SourceFolderPathName)); } } list2.Add(this.FixFolderPathName(mailboxAuditLogEvent.FolderPathName)); } else { foreach (MailboxAuditLogSourceItem mailboxAuditLogSourceItem in mailboxAuditLogEvent.SourceItems.Added) { list.Add(mailboxAuditLogSourceItem.SourceItemSubject); list2.Add(this.FixFolderPathName(mailboxAuditLogSourceItem.SourceItemFolderPathName)); } } string information = string.Join(Strings.Separator, list.ToArray()); string information2 = string.Join(Strings.Separator, list2.ToArray()); table.Rows.Add(base.GetDetailRowForTable(Strings.ItemSubject, information)); table.Rows.Add(base.GetDetailRowForTable(Strings.SourceFolder, information2)); if (mailboxAuditLogEvent.Operation.Equals(Enum.GetName(typeof(MailboxAuditOperations), MailboxAuditOperations.Move), StringComparison.InvariantCultureIgnoreCase)) { string information3 = this.FixFolderPathName(mailboxAuditLogEvent.DestFolderPathName); table.Rows.Add(base.GetDetailRowForTable(Strings.DestinationFolder, information3)); } } else if (mailboxAuditLogEvent.Operation.Equals(Enum.GetName(typeof(MailboxAuditOperations), MailboxAuditOperations.FolderBind), StringComparison.InvariantCultureIgnoreCase)) { table.Rows.Add(base.GetDetailRowForTable(Strings.FolderName, this.FixFolderPathName(mailboxAuditLogEvent.FolderPathName))); } else { table.Rows.Add(base.GetDetailRowForTable(Strings.ItemSubject, mailboxAuditLogEvent.ItemSubject)); if (mailboxAuditLogEvent.Operation.Equals(Enum.GetName(typeof(MailboxAuditOperations), MailboxAuditOperations.Create), StringComparison.InvariantCultureIgnoreCase)) { table.Rows.Add(base.GetDetailRowForTable(Strings.FolderName, this.FixFolderPathName(mailboxAuditLogEvent.FolderPathName))); } } table.Rows.Add(base.GetDetailRowForTable(Strings.OperationStatus, this.GetLocalizedStatus(mailboxAuditLogEvent.OperationResult))); table.Rows.Add(base.GetEmptyRowForTable()); num++; } this.detailsPane.Controls.Add(table); } }