Add filtering by primitive types (#45)

* Add filtering by primitive types

Add filtering by Boolean, Int16, Int32, and Int64.

* Remove boolean filter and add unit tests

* Fix test errors and add unsigned types

* Remove all filters except UInt32

O365.Security.Native.ETW/Filtering/Fluent.hpp

@@ -90,5 +90,18 @@ namespace O365 { namespace Security { namespace ETW {
         {
             return Predicate::make_predicate<krabs::predicates::process_id_is>(processId);
         }
+
+		/// <summary>
+		/// Used to verify that an event was emitted with a specific UInt32 property.
+		/// </summary>
+		/// <param name="propertyName">the name of the property to match on</param>
+		/// <param name="value">the value of the property to match on</param>
+		/// <returns>a predicate that matches events of the specified UInt32 property</returns>
+		static Predicate ^IsUInt32(String ^propertyName, UInt32 value)
+		{
+			return gcnew Predicate(krabs::predicates::property_is<UInt32>(
+				msclr::interop::marshal_as<std::wstring>(propertyName),
+				value));
+		}
     };
 } } }

tests/ManagedETWTests/EtwTestsCS.csproj

@@ -75,7 +75,9 @@
     <Compile Include="describe_Proxy.cs" />
     <Compile Include="Events\ImageLoadEvent.cs" />
     <Compile Include="Events\PowerShellEvent.cs" />
+    <Compile Include="Events\LogonEvent.cs" />
     <Compile Include="Events\WinINetEvent.cs" />
+    <Compile Include="Filtering\describe_Fluent.cs" />
     <Compile Include="Filtering\describe_AnsiString.cs" />
     <Compile Include="Filtering\describe_Predicate.cs" />
     <Compile Include="Properties\AssemblyInfo.cs" />

tests/ManagedETWTests/Events/LogonEvent.cs

@@ -0,0 +1,31 @@
+// Copyright (c) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+using System;
+using O365.Security.ETW.Testing;
+
+namespace EtwTestsCS.Events
+{
+    public static class LogonEvent
+    {
+        public readonly static string TargetUserName = "TargetUserName";
+        public readonly static string LogonType = "LogonType";
+
+        public readonly static Guid ProviderId = Guid.Parse("199FE037-2B82-40A9-82AC-E1D46C792B99");
+        public readonly static int EventId = 301;
+        public readonly static int Version = 0;
+
+        public static SynthRecord CreateRecord(
+            string username,
+            uint logonType)
+        {
+            using (var rb = new RecordBuilder(ProviderId, EventId, Version))
+            {
+                rb.AddUnicodeString(TargetUserName, username);
+                rb.AddValue(LogonType, logonType);
+
+                return rb.PackIncomplete();
+            }
+        }
+    }
+}

tests/ManagedETWTests/Filtering/describe_Fluent.cs

@@ -0,0 +1,39 @@
+// Copyright (c) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+using System;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+
+using O365.Security.ETW;
+
+namespace EtwTestsCS.Filtering
+{
+    using Events;
+
+    [TestClass]
+    public class describe_Fluent
+    {
+        // IsUInt32
+        [TestMethod]
+        public void when_int32_values_are_same_is_should_match()
+        {
+            UInt32 data = 5;
+            var query = data;
+            var record = LogonEvent.CreateRecord(String.Empty, data);
+            var predicate = Filter.IsUInt32(LogonEvent.LogonType, query);
+
+            Assert.IsTrue(predicate.Test(record));
+        }
+
+        [TestMethod]
+        public void when_int32_values_are_not_same_is_should_not_match()
+        {
+            UInt32 data = 0;
+            UInt32 query = 1;
+            var record = LogonEvent.CreateRecord(String.Empty, data);
+            var predicate = Filter.IsUInt32(LogonEvent.LogonType, query);
+
+            Assert.IsFalse(predicate.Test(record));
+        }
+    }
+}