public AuditLogRecord(AuditEventRecordAdapter eventData)
{
this.UserId = eventData.record.LogonUserSid;
this.CreationTime = eventData.CreationTime;
this.Operation = eventData.AuditOperation.ToString();
this.eventDetails = new List <KeyValuePair <string, string> >(eventData.InternalGetEventDetails());
}
protected virtual IEnumerable <KeyValuePair <string, string> > InternalGetEventDetails()
{
yield return(this.MakePair("Operation", this.AuditOperation));
yield return(this.MakePair("OperationResult", this.Result));
yield return(this.MakePair("LogonType", this.record.LogonType));
yield return(this.MakePair("ExternalAccess", this.ExternalAccess));
yield return(this.MakePair("UtcTime", this.CreationTime.ToString("s")));
yield return(this.MakePair("InternalLogonType", AuditEventRecordAdapter.GetInternalLogonType(this.record.InternalLogonType)));
yield return(this.MakePair("MailboxGuid", this.record.MailboxGuid));
yield return(this.MakePair("MailboxOwnerUPN", this.record.MailboxOwnerUPN));
KeyValuePair <string, string> p;
if (!string.IsNullOrEmpty(this.record.MailboxOwnerSid))
{
yield return(this.MakePair("MailboxOwnerSid", this.record.MailboxOwnerSid));
if (this.TryMakePair("MailboxOwnerMasterAccountSid", this.record.MailboxOwnerMasterAccountSid, out p))
{
yield return(p);
}
}
if (this.TryMakePair("LogonUserSid", this.record.LogonUserSid, out p))
{
yield return(p);
}
if (this.TryMakePair("LogonUserDisplayName", this.record.LogonUserDisplayName, out p))
{
yield return(p);
}
if (this.TryMakePair("ClientInfoString", this.record.ClientInfoString, out p))
{
yield return(p);
}
yield return(this.MakePair("ClientIPAddress", this.record.ClientIPAddress));
if (this.TryMakePair("ClientMachineName", this.record.ClientMachineName, out p))
{
yield return(p);
}
if (this.TryMakePair("ClientProcessName", this.record.ClientProcessName, out p))
{
yield return(p);
}
if (this.TryMakePair("ClientVersion", this.record.ClientVersion, out p))
{
yield return(p);
}
if (this.TryMakePair("OriginatingServer", this.record.OriginatingServer, out p))
{
yield return(p);
}
yield break;
}
