/// <nodoc /> public static ProcessExecutionMonitoringReportedEvent ToProcessExecutionMonitoringReportedEvent(this ProcessExecutionMonitoringReportedEventData data, uint workerID, PathTable pathTable, NameExpander nameExpander) { var processExecutionMonitoringReportedEvent = new ProcessExecutionMonitoringReportedEvent { WorkerID = workerID, PipID = data.PipId.Value }; processExecutionMonitoringReportedEvent.ReportedProcesses.AddRange( data.ReportedProcesses.Select(rp => rp.ToReportedProcess())); processExecutionMonitoringReportedEvent.ReportedFileAccesses.AddRange( data.ReportedFileAccesses.Select(reportedFileAccess => reportedFileAccess.ToReportedFileAccess(pathTable, nameExpander))); processExecutionMonitoringReportedEvent.AllowlistedReportedFileAccesses.AddRange( data.AllowlistedReportedFileAccesses.Select( allowListReportedFileAccess => allowListReportedFileAccess.ToReportedFileAccess(pathTable, nameExpander))); foreach (var processDetouringStatus in data.ProcessDetouringStatuses) { processExecutionMonitoringReportedEvent.ProcessDetouringStatuses.Add(new Xldb.Proto.ProcessDetouringStatusData() { ProcessID = processDetouringStatus.ProcessId, ReportStatus = processDetouringStatus.ReportStatus, ProcessName = processDetouringStatus.ProcessName, StartApplicationName = processDetouringStatus.StartApplicationName, StartCommandLine = processDetouringStatus.StartCommandLine, NeedsInjection = processDetouringStatus.NeedsInjection, IsCurrent64BitProcess = processDetouringStatus.IsCurrent64BitProcess, IsCurrentWow64Process = processDetouringStatus.IsCurrentWow64Process, IsProcessWow64 = processDetouringStatus.IsProcessWow64, NeedsRemoteInjection = processDetouringStatus.NeedsRemoteInjection, Job = processDetouringStatus.Job, DisableDetours = processDetouringStatus.DisableDetours, CreationFlags = processDetouringStatus.CreationFlags, Detoured = processDetouringStatus.Detoured, Error = processDetouringStatus.Error, CreateProcessStatusReturn = processDetouringStatus.CreateProcessStatusReturn }); } return(processExecutionMonitoringReportedEvent); }
/// <nodoc /> public static ProcessExecutionMonitoringReportedEvent ToProcessExecutionMonitoringReportedEvent(this ProcessExecutionMonitoringReportedEventData data, uint workerID, PathTable pathTable) { var processExecutionMonitoringReportedEvent = new ProcessExecutionMonitoringReportedEvent { WorkerID = workerID, PipID = data.PipId.Value }; processExecutionMonitoringReportedEvent.ReportedProcesses.AddRange( data.ReportedProcesses.Select(rp => rp.ToReportedProcess())); processExecutionMonitoringReportedEvent.ReportedFileAccesses.AddRange( data.ReportedFileAccesses.Select(reportedFileAccess => reportedFileAccess.ToReportedFileAccess(pathTable))); processExecutionMonitoringReportedEvent.WhitelistedReportedFileAccesses.AddRange( data.WhitelistedReportedFileAccesses.Select( whiteListReportedFileAccess => whiteListReportedFileAccess.ToReportedFileAccess(pathTable))); foreach (var processDetouringStatus in data.ProcessDetouringStatuses) { processExecutionMonitoringReportedEvent.ProcessDetouringStatuses.Add(new ProcessDetouringStatusData() { ProcessID = processDetouringStatus.ProcessId, ReportStatus = processDetouringStatus.ReportStatus, ProcessName = processDetouringStatus.ProcessName, StartApplicationName = processDetouringStatus.StartApplicationName, StartCommandLine = processDetouringStatus.StartCommandLine, NeedsInjection = processDetouringStatus.NeedsInjection, Job = processDetouringStatus.Job, DisableDetours = processDetouringStatus.DisableDetours, CreationFlags = processDetouringStatus.CreationFlags, Detoured = processDetouringStatus.Detoured, Error = processDetouringStatus.Error }); } return(processExecutionMonitoringReportedEvent); }