Amazon.KinesisTap.Windows/EventInfoFilters.cs
/// <summary>
/// Filter to exclude security event generated by KinesisTap itself
/// That is when the full path of EventData is our exe path.
/// </summary>
/// <param name="eventInfo"></param>
/// <returns>false if the event should be filtered out</returns>
Filter to exclude security event generated by KinesisTap itself
That is when the full path of EventData is our exe path.
Filter to exclude security event generated by KinesisTap itself That is when the full path of EventData is our exe path .
private static bool ExcludeKinesisTapSecurityEventsFilter(EventInfo eventInfo)
        {
            if ("Security".Equals(eventInfo.LogName))
            {
               if (eventInfo.EventData != null)
                {
                    string exeName = Utility.MainModulePath;
                    string exeNameNoRoot = exeName.Substring(Path.GetPathRoot(exeName).Length);
                    if (eventInfo.EventData.Any(o => (o as string)?.EndsWith(exeNameNoRoot, StringComparison.OrdinalIgnoreCase) ?? false)) return false;
                }
            }
            return true;
        }
private static bool ExcludeKinesisTapSecurityEventsFilter ( EventInfo eventInfo ) { if ( " " . Equals ( eventInfo . LogName ) ) { if ( eventInfo . EventData != null ) { string exeName = Utility . MainModulePath ; string exeNameNoRoot = exeName . Substring ( Path . GetPathRoot ( exeName ) . Length ) ; if ( eventInfo . EventData . Any ( o => ( o as string ) ? . EndsWith ( exeNameNoRoot , StringComparison . OrdinalIgnoreCase ) ?? false ) ) return false ; } } return true ; }
Filter to exclude security event generated by KinesisTap itself
That is when the full path of EventData is our exe path.
Filter to exclude security event generated by KinesisTap itself That is when the full path of EventData is our exe path .
//Sometimes we get \device\harddiskvolume1\...\kinesistap.exe
false if the event should be filtered out
false if the event should be filtered out
eventInfo
EventInfo
None