Table of Contents

C# Script Filters

C# Script filters enable you to program your own filters using the C# language. The C# script editor is implemented using Roslyn, an open-source component. The Roslyn editor supports line numbers, color coding and auto-suggest.

Supported Log Types
Azure AD Audit Log
Event Log
Syslog
Text Log
SNMP Trap

How to configure C# script filters:

  • From the Menu Bar select File | New. The Create New Object View displays.
  • Select Filter. The New Filter view displays.
  • Use the Name text box to specify a unique name.
  • From the Type drop-down select the type of object to create the filter for.
  • From the Sub type drop-down select C# Script. The C# Script Filter View displays.
  • Each function signature includes an interface to the object type (e.g. IGraphAuditLogEntry, IEventLogEntry, ISyslogEntry. ITextLogEntry and ISnmpTrapEntry).
  • Use the C# Script editor to program your filter.
  • Use the Compile button to verify the script compiles without any errors.
    Alert Compile errors are displayed at the bottom of the screen and include the line and column numbers each error occurred. All compile errors must be resolved.

Sample C# Script Event Log Filter:

Interface Reference

Azure AD Audit Log Entries

    namespace CornerBowl
    {
        public interface IGraphAuditLogEntry
        {
            string Log { get; }
            DateTime DateTime { get; }
            string Status { get; }
            string CorrelationId { get; }
            string MetaData { get; }
            string Message { get; }
            string Service { get; }
            string Category { get; }
            string Activity { get; }
            string User { get; }
            string IP { get; }
            string Application { get; }
            string Location { get; }
            string RiskType { get; }
            string RiskState { get; }
            string DetectionTimingType { get; }
            string RiskDetail { get; }
            string TokenIssuerType { get; }
        }
    }

Event Log Entries

    namespace CornerBowl
    {
        public interface IEventLogEntry
        {
            string Log { get; }
            EventLogEntryType Level { get; }
            string Source { get; }
            string Category { get; }
            uint EventIdentifier { get; }
            int EventId { get; }
            string User { get; }
            byte[] Data { get; }
            ushort CategoryId { get; }
            string[] InsertionStrings { get; }
            uint RecordNumber { get; }
            string Message { get; }
            DateTime DateTime { get; }
        }
    }

Syslog Entries

    namespace CornerBowl
    {
        public interface ISyslogEntry
        {
            string Log { get; }
            Priority Priority { get; }
            Facility Facility { get; }
            string Application { get; }
            string ProcessId { get; }
            string MessageId { get; }
            string Data { get; }
            string Message { get; }
            DateTime DateTime { get; }
        }
    }

Text Log Entries

    namespace CornerBowl
    {
        public interface ITextLogEntry
        {
            string Log { get; }
            string Message { get; }
            DateTime DateTime { get; }
        }
    }

SNMP Traps

    namespace CornerBowl
    {
        public interface ISnmpTrapEntry
        {
            string TrapOid { get; }
            string Oid { get; }
            SnmpDataTypes DataType { get; }
            string Value { get; }
            DateTime DateTime { get; }
        }
    }

Related Topics

Simple Filters

Complex Filters

Filters