public async Task <List <InteractiveLogon> > InteractiveLogins()
{
try
{
var signIns = await GraphServiceHelper.GetSignIns(_graphClient, _httpContext);
var interactiveLogOns = new List <InteractiveLogon>();
signIns
.Where(_ => _.ClientAppUsed?.Equals("Mobile Apps and Desktop clients",
StringComparison.OrdinalIgnoreCase) == true)
.Where(_ => _.ResourceDisplayName?.Equals("Windows Azure Active Directory",
StringComparison.OrdinalIgnoreCase) == true)
.Where(_ => _.CreatedDateTime.HasValue &&
_.CreatedDateTime.Value.UtcDateTime.IsNotOlderThan(10.Days()))
.ForEach(_ =>
{
interactiveLogOns.Add(
new InteractiveLogon(
_.DeviceDetail,
_.Location,
_.UserId,
_.CreatedDateTime.GetValueOrDefault().UtcDateTime,
_.UserDisplayName));
});
interactiveLogOns.DistinctBy(_ => new { _.UserId, _.DeviceId });
interactiveLogOns.
Where(_ => _.UserId != null &&
_.UserDisplayName != null &&
_.DeviceDisplayName != null).
ForEach(_ =>
{
BloodHoundHelper.InteractiveLogOns(_);
if (Startup.IsCosmosDbGraphEnabled)
{
CosmosDbGraphHelper.InteractiveLogOns(_, _deviceObjectIdToDeviceId);
}
});
return(interactiveLogOns);
}
catch (Exception ex)
{
_logger.Error(ex, $"{nameof(InteractiveLogins)} {ex.Message} {ex.InnerException}");
return(null);
}
}
