Exemplo n.º 1
0
        public static System.Collections.Generic.IEnumerable <string> bundleEcsMessageListsJson(string newClientContent, ILogger log)
        {
            foreach (List <DenormalizedRecord> messageList in denormalizedRecords(newClientContent, null, log))
            {
                foreach (DenormalizedRecord denormalizedRecord in messageList)
                {
                    EcsAll ecsAll          = new EcsAll(denormalizedRecord);
                    var    outgoingEcsJson = JsonConvert.SerializeObject(ecsAll, new JsonSerializerSettings
                    {
                        NullValueHandling = NullValueHandling.Ignore
                    });

                    yield return(outgoingEcsJson);
                }
            }
        }
Exemplo n.º 2
0
    public void denormalizedRecordToEcsTest()
    {
        DenormalizedRecord denormalizedRecordV2 = EcsTest.createDenormalizedRecordV2();

        EcsAll ecsAll = EcsFactory.createEcsAll(denormalizedRecordV2);

        var outgoingJson = JsonConvert.SerializeObject(ecsAll, new JsonSerializerSettings
        {
            NullValueHandling = NullValueHandling.Ignore,
            Formatting        = Newtonsoft.Json.Formatting.Indented,
        });

        output.WriteLine(outgoingJson);
        Assert.Equal(denormalizedRecordV2.time, ecsAll.@timestamp);
        Assert.Equal("AzureNetworkWatcherNSGFlowLogsConnector", ecsAll.agent.name);
        Assert.Equal(denormalizedRecordV2.nsgRuleName, ecsAll.rule.name);
        Assert.Equal("1.0.0", ecsAll.ecs.version);
        Assert.Equal(denormalizedRecordV2.mac, ecsAll.client.mac);
        Assert.Equal(denormalizedRecordV2.category, ecsAll.ecsevent.category);
        Assert.Equal(denormalizedRecordV2.operationName, ecsAll.ecsevent.action);
        Assert.Equal("allowed", ecsAll.ecsevent.outcome);
        Assert.Equal("nsg.access", ecsAll.ecsevent.dataset);
        Assert.Equal("2020-01-10T16:32:42.0000000Z", ecsAll.ecsevent.start);
        Assert.Equal(denormalizedRecordV2.resourceId, ecsAll.resource.id);
        Assert.Equal("F087A016-314D-482C-93F1-88665DAFBA23", ecsAll.resource.subscription);
        Assert.Equal("AKS-AGENTPOOL-14244569-NSG", ecsAll.resource.nsg);
        Assert.Equal("10.244.0.40", ecsAll.source.address);
        Assert.Equal("10.244.0.40", ecsAll.source.ip);
        Assert.Equal("10.244.1.68", ecsAll.destination.address);
        Assert.Equal("10.244.1.68", ecsAll.destination.ip);
        Assert.Equal(36098, ecsAll.source.port);
        Assert.Equal(25227, ecsAll.destination.port);
        Assert.Equal(3, ecsAll.source.packets);
        Assert.Equal(2, ecsAll.destination.packets);
        Assert.Equal(206, ecsAll.source.bytes);
        Assert.Equal(140, ecsAll.destination.bytes);
        Assert.Equal("tcp", ecsAll.network.transport);
        Assert.Equal("inbound", ecsAll.network.direction);
        Assert.Equal("transport", ecsAll.network.protocol);
        Assert.Equal(5, ecsAll.network.packets);
        Assert.Equal(346, ecsAll.network.bytes);
        Assert.Equal("E", ecsAll.network.flowstate);
    }
Exemplo n.º 3
0
    public static EcsAll createEcsAll(DenormalizedRecord denormalizedRecord)
    {
        EcsAll ecsAll = new EcsAll(denormalizedRecord);

        return(ecsAll);
    }