// Copyright (c) Microsoft. All rights reserved. // Licensed under the MIT license. See LICENSE file in the project root for full license information. #pragma once #include #include #include "../NativePtr.hpp" #include "Predicate.hpp" #include #include using namespace System; using namespace System::Runtime::InteropServices; namespace adapt = krabs::predicates::adapters; namespace O365 { namespace Security { namespace ETW { /// /// Fluent filters for ANSI String properties /// public ref class CountedString abstract sealed { public: /// /// Accept event if counted string property equals the specified string /// /// represents the property name /// represents the value to match on /// a predicate that accepts an event if the value matches the specified string static Predicate^ Is(String^ name, String^ value) { return gcnew Predicate(krabs::predicates::property_equals( msclr::interop::marshal_as(name), msclr::interop::marshal_as(value))); } /// /// Accept event if counted string property equals (case invariant) the specified string /// /// represents the property name /// represents the value to match on /// a predicate that accepts an event if the value matches (case invariant) the specified string static Predicate^ IEquals(String^ name, String^ value) { return gcnew Predicate(krabs::predicates::property_iequals( msclr::interop::marshal_as(name), msclr::interop::marshal_as(value))); } /// /// Accept event if counted string property contains the specified string /// /// represents the property name /// represents the value to match on /// a predicate that accepts an event if the value contains the specified string static Predicate^ Contains(String^ name, String^ value) { return gcnew Predicate(krabs::predicates::property_contains( msclr::interop::marshal_as(name), msclr::interop::marshal_as(value))); } /// /// Accept event if counted string property contains (case invariant) the specified string /// /// represents the property name /// represents the value to match on /// a predicate that accepts an event if the value contains (case invariant) the specified string static Predicate^ IContains(String^ name, String^ value) { return gcnew Predicate(krabs::predicates::property_icontains( msclr::interop::marshal_as(name), msclr::interop::marshal_as(value))); } /// /// Accept event if counted string property starts with the specified string /// /// represents the property name /// represents the value to match on /// a predicate that accepts an event if the value starts with the specified string static Predicate^ StartsWith(String^ name, String^ value) { return gcnew Predicate(krabs::predicates::property_starts_with( msclr::interop::marshal_as(name), msclr::interop::marshal_as(value))); } /// /// Accept event if counted string property starts with (case invariant) the specified string /// /// represents the property name /// represents the value to match on /// a predicate that accepts an event if the value starts with (case invariant) the specified string static Predicate^ IStartsWith(String^ name, String^ value) { return gcnew Predicate(krabs::predicates::property_istarts_with( msclr::interop::marshal_as(name), msclr::interop::marshal_as(value))); } }; } } }