public async Task TestForwardTracelogging() { ProviderGuid guid = null; Assert.IsTrue(ProviderGuid.TryParse("TL{8e805eb3-6a8f-4a1e-90fa-a831d94e54a1}", out guid)); var forwarder = Forwarder.Build(guid); var writer = new TestWriter(); writer.OnWrite += async(Dictionary <string, object> eventData) => { // Test if correctly parsed Assert.AreEqual(eventData["Test"], "Test"); }; await forwarder.Forward(new TestEventRecord { Id = 23, ProviderName = "TraceLogging", ProviderId = Guid.Parse("8e805eb3-6a8f-4a1e-90fa-a831d94e54a1"), Fields = new Dictionary <string, object> { { "Test", "Test" } }, // Add a property of type 1 => Unicode String Properties = new List <Property> { new Property("Test", 1) } }, writer); }
public async Task TestForwardManifest() { ProviderGuid guid = null; Assert.IsTrue(ProviderGuid.TryParse("Microsoft-Windows-WMI-Activity", out guid)); var forwarder = Forwarder.Build(guid); var writer = new TestWriter(); writer.OnWrite += async(Dictionary <string, object> eventData) => { // Test if correctly parsed Assert.AreEqual(eventData["Commandline"], "cmd.exe"); }; await forwarder.Forward(new TestEventRecord { Id = 23, ProviderName = "Microsoft-Windows-WMI-Activity", ProviderId = Guid.Parse("1418ef04-b0b4-4623-bf7e-d74ab47bbdaa"), Fields = new Dictionary <string, object> { { "Commandline", "cmd.exe" } } }, writer); }
public async Task TestForwardManifestWithFilterKo() { ProviderGuid guid = null; Assert.IsTrue(ProviderGuid.TryParse("Microsoft-Windows-WMI-Activity", out guid)); var forwarder = Forwarder.Build(guid); var writer = new TestWriter(); writer.OnWrite += async(Dictionary <string, object> eventData) => { // this code does not be reached throw new AssertFailedException(); }; forwarder.AddFilter("Commandline", "toto.exe"); await forwarder.Forward(new TestEventRecord { Id = 23, ProviderName = "Microsoft-Windows-WMI-Activity", ProviderId = Guid.Parse("1418ef04-b0b4-4623-bf7e-d74ab47bbdaa"), Fields = new Dictionary <string, object> { { "Commandline", "cmd.exe" } } }, writer); }
public void TestBuildTWPPForwarder() { ProviderGuid guid = null; Assert.IsTrue(ProviderGuid.TryParse("WPP{8e805eb3-6a8f-4a1e-90fa-a831d94e54a1}", out guid)); var forwarder = Forwarder.Build(guid); Assert.IsInstanceOfType(forwarder.Parser, typeof(NullParser)); }
public void TestBuildManifestForwarder() { ProviderGuid guid = null; Assert.IsTrue(ProviderGuid.TryParse("Microsoft-Windows-WMI-Activity", out guid)); var forwarder = Forwarder.Build(guid); Assert.IsInstanceOfType(forwarder.Parser, typeof(ManifestParser)); }