private ASRARFTypes.ARF.Notify GenerateARF(ASRARFTypes.ARF.Notify ARF)
{
ARF.NotificationMessage = new ASRARFTypes.ARF.NotifyNotificationMessage();
ARF.NotificationMessage.Topic = new ASRARFTypes.ARF.NotifyNotificationMessageTopic();
ARF.NotificationMessage.Topic.Value = ACASConstants.ARFTopic;
ARF.NotificationMessage.Topic.Dialect = ACASConstants.Topic_Dialect;
ARF.NotificationMessage.ProducerReference = new ASRARFTypes.ARF.NotifyNotificationMessageProducerReference();
ARF.NotificationMessage.ProducerReference.Address = this.SecurityCenterAddress;
ARF.NotificationMessage.ProducerReference.Metadata = new ASRARFTypes.ARF.Metadata();
ARF.NotificationMessage.ProducerReference.Metadata.MessageID = this.SecurityCenterAddress;
ARF.NotificationMessage.ProducerReference.Metadata.taggedString = new ASRARFTypes.ARF.taggedString();
ARF.NotificationMessage.ProducerReference.Metadata.taggedString.name = this.DataPublisher;
ARF.NotificationMessage.ProducerReference.Metadata.taggedString.value = this.DataPublisherVer;
ARF.NotificationMessage.Message = new ASRARFTypes.ARF.NotifyNotificationMessageMessage();
ARF.NotificationMessage.Message.AssessmentReport = new ASRARFTypes.ARF.AssessmentReportReportObject[this.ACASResults.Report.ReportHost.Length];
for (var x = 0; x < this.ACASResults.Report.ReportHost.Length; x++)
{
ARF.NotificationMessage.Message.AssessmentReport[x] = new ASRARFTypes.ARF.AssessmentReportReportObject();
ARF.NotificationMessage.Message.AssessmentReport[x].device = new ASRARFTypes.ARF.AssessmentReportReportObjectDevice();
ARF.NotificationMessage.Message.AssessmentReport[x].device.timestamp = DateTime.Now;
ARF.NotificationMessage.Message.AssessmentReport[x].device.device_ID = new ASRARFTypes.ARF.device_ID();
ARF.NotificationMessage.Message.AssessmentReport[x].device.device_ID.resource = this.SecurityCenterAddress;
var fqdn_Properties = this.ACASResults.Report.ReportHost[x].HostProperties.FirstOrDefault(hp => hp.name == "host-fqdn");
var netBiosname = this.ACASResults.Report.ReportHost[x].HostProperties.FirstOrDefault(hp => hp.name == "netbios-name");
var DNSname = this.ACASResults.Report.ReportHost[x].HostProperties.FirstOrDefault(hp => hp.name == "hostname");
ARF.NotificationMessage.Message.AssessmentReport[x].device.device_ID.record_identifier = GetRecordIdentifier(this.ACASResults.Report.ReportHost[x]);
ARF.NotificationMessage.Message.AssessmentReport[x].device.identifiers = new ASRARFTypes.ARF.identifiersFQDN[2];
if (netBiosname != null)
{
ARF.NotificationMessage.Message.AssessmentReport[x].device.identifiers[0] = new ASRARFTypes.ARF.identifiersFQDN()
{
host_name = netBiosname.Value, source = "NetBIOS", realm = ""
}
}
;
if (DNSname != null)
{
ARF.NotificationMessage.Message.AssessmentReport[x].device.identifiers[1] = new ASRARFTypes.ARF.identifiersFQDN()
{
host_name = DNSname.Value, source = "DNS", realm = ""
}
}
;
ARF.NotificationMessage.Message.AssessmentReport[x].device.operational_attributes = new ASRARFTypes.ARF.operational_attributes();
ARF.NotificationMessage.Message.AssessmentReport[x].device.operational_attributes.resource = this.SecurityCenterAddress;
ARF.NotificationMessage.Message.AssessmentReport[x].device.operational_attributes.record_identifier = "";
ARF.NotificationMessage.Message.AssessmentReport[x].device.configuration = new ASRARFTypes.ARF.configuration();
ARF.NotificationMessage.Message.AssessmentReport[x].device.configuration.network_configuration = new ASRARFTypes.ARF.configurationNetwork_configuration();
var hostIp = this.ACASResults.Report.ReportHost[x].HostProperties.FirstOrDefault(hp => hp.name == "host-ip");
ARF.NotificationMessage.Message.AssessmentReport[x].device.configuration.network_configuration.network_interface_ID = hostIp != null ? hostIp.Value : null;
ARF.NotificationMessage.Message.AssessmentReport[x].device.configuration.network_configuration.host_network_data = new ASRARFTypes.ARF.configurationNetwork_configurationHost_network_data();
ARF.NotificationMessage.Message.AssessmentReport[x].device.configuration.network_configuration.host_network_data.connection_ip = new ASRARFTypes.ARF.configurationNetwork_configurationHost_network_dataConnection_ip();
ARF.NotificationMessage.Message.AssessmentReport[x].device.configuration.network_configuration.host_network_data.connection_ip.IPv4 = hostIp != null ? hostIp.Value : null;
var macaddress = this.ACASResults.Report.ReportHost[x].HostProperties.FirstOrDefault(hp => hp.name == "mac-address");
ARF.NotificationMessage.Message.AssessmentReport[x].device.configuration.network_configuration.host_network_data.connection_mac_address = macaddress != null ? macaddress.Value : null;
ARF.NotificationMessage.Message.AssessmentReport[x].device.configuration.cpe_inventory = new ASRARFTypes.ARF.configurationCpe_inventory();
ARF.NotificationMessage.Message.AssessmentReport[x].device.configuration.cpe_inventory.cpe_record = new ASRARFTypes.ARF.configurationCpe_inventoryCpe_record();
ARF.NotificationMessage.Message.AssessmentReport[x].device.configuration.cpe_inventory.cpe_record.platformName = new ASRARFTypes.ARF.platformName();
ARF.NotificationMessage.Message.AssessmentReport[x].device.configuration.cpe_inventory.cpe_record.platformName.assessedName = new ASRARFTypes.ARF.platformNameAssessedName();
var cpe0 = this.ACASResults.Report.ReportHost[x].HostProperties.FirstOrDefault(hp => hp.name == "cpe-0");
ARF.NotificationMessage.Message.AssessmentReport[x].device.configuration.cpe_inventory.cpe_record.platformName.assessedName.name = cpe0 != null ? cpe0.Value : null;
ARF.NotificationMessage.Message.AssessmentReport[x].device.taggedString = new ASRARFTypes.ARF.taggedString[5];
var plugin_output_scan = this.ACASResults.Report.ReportHost[x].ReportItem.FirstOrDefault(ri => ri.pluginID == 19506);
if (plugin_output_scan != null)
{
for (var opi = 0; opi < plugin_output_scan.ItemsElementName.Length; opi++)
{
if (plugin_output_scan.ItemsElementName[opi] == ACASType.ItemsChoiceType.plugin_output)
{
ARF.NotificationMessage.Message.AssessmentReport[x].device.taggedString[0] = new ASRARFTypes.ARF.taggedString()
{
name = "LastCredScanPluginVers", value = ExtractPluginValue(plugin_output_scan.Items[opi], "Plugin feed version")
};
}
}
}
var lastscandate = FindLastScanDate(this.ACASResults.Report.ReportHost[x].HostProperties);
if (lastscandate != null)
{
ARF.NotificationMessage.Message.AssessmentReport[x].device.taggedString[2] = new ASRARFTypes.ARF.taggedString()
{
name = "LastCredScan", value = lastscandate
}
}
;
ARF.NotificationMessage.Message.AssessmentReport[x].device.taggedString[1] = new ASRARFTypes.ARF.taggedString()
{
name = "ScanPolicy", value = this.ACASResults.Report.ReportHost[x].HostProperties.FirstOrDefault(hp => hp.name == "policy-used").Value
};
var biosuuid = this.ACASResults.Report.ReportHost[x].HostProperties.FirstOrDefault(hp => hp.name == "bios-uuid");
if (biosuuid != null)
{
ARF.NotificationMessage.Message.AssessmentReport[x].device.taggedString[3] = new ASRARFTypes.ARF.taggedString()
{
name = "BIOSGUID", value = biosuuid.Value
}
}
;
var mcafeeAgentGUID = this.ACASResults.Report.ReportHost[x].HostProperties.FirstOrDefault(hp => hp.name == "mcafee-epo-guid");
if (mcafeeAgentGUID != null)
{
ARF.NotificationMessage.Message.AssessmentReport[x].device.taggedString[4] = new ASRARFTypes.ARF.taggedString()
{
name = "McAfeeAgentGUID", value = mcafeeAgentGUID.Value
}
}
;
}
return(ARF);
}
public AssesmentReport(ASRARFTypes.ARF.Notify ARF, ASRARFTypes.ASR.Notify ASR)
{
this.ARF = ARF;
this.ASR = ASR;
}
