/// <summary>
/// Formatter to handle Login Failure events.
/// </summary>
/// <param name="auditedEvent">The audited event</param>
/// <returns>SyslogMessage representing the event.</returns>
private SyslogMessage LoginFailureFormatter(AuditedEventDTO auditedEvent)
{
var loginDetails = FormatLoginFailureDto(auditedEvent.Details);
var message =
$"CEF:0|Apprenda|CloudPlatform|{PlatformVersion}|-|{auditedEvent.Operation}|CIT3|outcome={auditedEvent.EventTypeDescription()} {loginDetails}";
return(auditedEvent.ToSyslogMessage(Facility.SecurityOrAuthorizationMessages1, Severity.Notice, message));
}
private SyslogMessage RegistrySetValueDetailFormatter(AuditedEventDTO auditedEvent)
{
if (auditedEvent == null)
{
return(null);
}
var details = JsonConvert.DeserializeObject <DetailsObject>(auditedEvent.Details);
var detail = $"cs1={details.OriginalValue.StripNewLines()} cs2={details.NewValue.StripNewLines()}";
var message = $"CEF:0|Apprenda|CloudPlatform|{PlatformVersion}|-|{auditedEvent.Operation}|PR1|outcome={auditedEvent.EventTypeDescription()} {detail}";
return(auditedEvent.ToSyslogMessage(message));
}
/// <summary>
/// Formats an AuditedEventDTO that contains a ReportCard in the Details field.
/// </summary>
/// <param name="auditedEvent">The audited event to format</param>
/// <returns>SyslogMessage representing the provided event</returns>
protected SyslogMessage DefaultReportCardCefFormatter(AuditedEventDTO auditedEvent)
{
if (auditedEvent == null)
{
return(null);
}
var details = JsonConvert.DeserializeObject <DetailsObject>(auditedEvent.Details);
var messageDetail = string.Empty;
var reportCard = JsonConvert.DeserializeObject <ReportCard>(details.Details, new JsonSerializerSettings
{
Error = (unused, discarded) => messageDetail = $"{details.Details}",
});
if (reportCard != null)
{
messageDetail = $" {string.Join(";", reportCard.ErrorMessages.ToArray())}";
}
return(auditedEvent.ToSyslogMessage($"CEF:0|Apprenda|CloudPlatform|{PlatformVersion}|-|{auditedEvent.Operation}|Unknown|outcome={auditedEvent.EventTypeDescription()} {messageDetail}"));
}