mirror of
https://github.com/microsoft/krabsetw
synced 2026-06-06 16:14:32 +00:00
Kyle Reed
14f78f54c2
* collection_view adapter null_string was expecting null terminated strings determine the actual string length like we're doing for std::string and std::wstring parsing Signed-off-by: Kyle Reed <kallanreed@outlook.com> * Rename basic_string -> generic_string to prevent confusion Signed-off-by: Kyle Reed <kallanreed@outlook.com>
105 lines
4.8 KiB
C++
105 lines
4.8 KiB
C++
// Copyright (c) Microsoft. All rights reserved.
|
|
// Licensed under the MIT license. See LICENSE file in the project root for full license information.
|
|
|
|
#pragma once
|
|
|
|
#include <krabs.hpp>
|
|
|
|
#include <string>
|
|
|
|
#include "../NativePtr.hpp"
|
|
#include "Predicate.hpp"
|
|
#include <msclr\marshal.h>
|
|
#include <msclr\marshal_cppstd.h>
|
|
|
|
using namespace System;
|
|
using namespace System::Runtime::InteropServices;
|
|
namespace adapt = krabs::predicates::adapters;
|
|
|
|
namespace O365 { namespace Security { namespace ETW {
|
|
|
|
/// <summary>
|
|
/// Fluent filters for ANSI String properties
|
|
/// </summary>
|
|
public ref class AnsiString abstract sealed {
|
|
public:
|
|
/// <summary>
|
|
/// Accept event if ANSI string property equals the specified string
|
|
/// </summary>
|
|
/// <param name="name">represents the property name</param>
|
|
/// <param name="value">represents the value to match on</param>
|
|
/// <returns>a predicate that accepts an event if the value matches the specified string</returns>
|
|
static Predicate^ Is(String^ name, String^ value)
|
|
{
|
|
return gcnew Predicate(krabs::predicates::property_equals<adapt::generic_string<char>>(
|
|
msclr::interop::marshal_as<std::wstring>(name),
|
|
msclr::interop::marshal_as<std::string>(value)));
|
|
}
|
|
|
|
/// <summary>
|
|
/// Accept event if ANSI string property equals (case invariant) the specified string
|
|
/// </summary>
|
|
/// <param name="name">represents the property name</param>
|
|
/// <param name="value">represents the value to match on</param>
|
|
/// <returns>a predicate that accepts an event if the value matches (case invariant) the specified string</returns>
|
|
static Predicate^ IEquals(String^ name, String^ value)
|
|
{
|
|
return gcnew Predicate(krabs::predicates::property_iequals<adapt::generic_string<char>>(
|
|
msclr::interop::marshal_as<std::wstring>(name),
|
|
msclr::interop::marshal_as<std::string>(value)));
|
|
}
|
|
|
|
/// <summary>
|
|
/// Accept event if ANSI string property contains the specified string
|
|
/// </summary>
|
|
/// <param name="name">represents the property name</param>
|
|
/// <param name="value">represents the value to match on</param>
|
|
/// <returns>a predicate that accepts an event if the value contains the specified string</returns>
|
|
static Predicate^ Contains(String^ name, String^ value)
|
|
{
|
|
return gcnew Predicate(krabs::predicates::property_contains<adapt::generic_string<char>>(
|
|
msclr::interop::marshal_as<std::wstring>(name),
|
|
msclr::interop::marshal_as<std::string>(value)));
|
|
}
|
|
|
|
/// <summary>
|
|
/// Accept event if ANSI string property contains (case invariant) the specified string
|
|
/// </summary>
|
|
/// <param name="name">represents the property name</param>
|
|
/// <param name="value">represents the value to match on</param>
|
|
/// <returns>a predicate that accepts an event if the value contains (case invariant) the specified string</returns>
|
|
static Predicate^ IContains(String^ name, String^ value)
|
|
{
|
|
return gcnew Predicate(krabs::predicates::property_icontains<adapt::generic_string<char>>(
|
|
msclr::interop::marshal_as<std::wstring>(name),
|
|
msclr::interop::marshal_as<std::string>(value)));
|
|
}
|
|
|
|
/// <summary>
|
|
/// Accept event if ANSI string property starts with the specified string
|
|
/// </summary>
|
|
/// <param name="name">represents the property name</param>
|
|
/// <param name="value">represents the value to match on</param>
|
|
/// <returns>a predicate that accepts an event if the value starts with the specified string</returns>
|
|
static Predicate^ StartsWith(String^ name, String^ value)
|
|
{
|
|
return gcnew Predicate(krabs::predicates::property_starts_with<adapt::generic_string<char>>(
|
|
msclr::interop::marshal_as<std::wstring>(name),
|
|
msclr::interop::marshal_as<std::string>(value)));
|
|
}
|
|
|
|
/// <summary>
|
|
/// Accept event if ANSI string property starts with (case invariant) the specified string
|
|
/// </summary>
|
|
/// <param name="name">represents the property name</param>
|
|
/// <param name="value">represents the value to match on</param>
|
|
/// <returns>a predicate that accepts an event if the value starts with (case invariant) the specified string</returns>
|
|
static Predicate^ IStartsWith(String^ name, String^ value)
|
|
{
|
|
return gcnew Predicate(krabs::predicates::property_istarts_with<adapt::generic_string<char>>(
|
|
msclr::interop::marshal_as<std::wstring>(name),
|
|
msclr::interop::marshal_as<std::string>(value)));
|
|
}
|
|
};
|
|
} } }
|