我有这个CPP代码,使用AuthzReportSecurityEvent函数创建安全日志,我需要添加一个特定的信息到所说的日志,但我不知道如何创建“数据名称”字段和在线信息是严重有限的,我希望能够添加信息的日志的一部分。这是我到目前为止的代码,我从另一篇关于这个主题的文章中得到的:
#include <stdio.h>
#include <iostream>
#include <string>
#include <strsafe.h>
#include <windows.h>
#include <Authz.h>
#include <Ntsecapi.h>
#pragma comment(lib,"Authz.lib")
#pragma comment(lib,"Advapi32.lib")
BOOL SetPrivilege(
HANDLE hToken, // access token handle
LPCTSTR lpszPrivilege, // name of privilege to enable/disable
BOOL bEnablePrivilege // to enable or disable privilege
)
{
TOKEN_PRIVILEGES tp;
LUID luid;
if (!LookupPrivilegeValue(
NULL, // lookup privilege on local system
lpszPrivilege, // privilege to lookup
&luid)) // receives LUID of privilege
{
printf("LookupPrivilegeValue error: %u\n", GetLastError());
return FALSE;
}
tp.PrivilegeCount = 1;
tp.Privileges[0].Luid = luid;
if (bEnablePrivilege)
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
else
tp.Privileges[0].Attributes = 0;
// Enable the privilege or disable all privileges.
if (!AdjustTokenPrivileges(
hToken,
FALSE,
&tp,
sizeof(TOKEN_PRIVILEGES),
(PTOKEN_PRIVILEGES)NULL,
(PDWORD)NULL))
{
printf("AdjustTokenPrivileges error: %u\n", GetLastError());
return FALSE;
}
if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)
{
printf("The token does not have the specified privilege. \n");
return FALSE;
}
printf("Get the specified privilege! \n");
return TRUE;
}
int main(int argc, const char* argv[])
{
// Declare and initialize variables.
BOOL bResult = TRUE;
DWORD event_id = 4624;
AUTHZ_SECURITY_EVENT_PROVIDER_HANDLE hEventProvider = NULL;
PAUDIT_PARAMS p;
std::string Source_Name = "Test security audit";
std::wstring ws;
std::string pbuf = "What is your purpose ?";
std::wstring ws_buf;
int return_code = 0;
int i = 0;
// Register the audit provider.
HANDLE token;
HANDLE hevent_source;
ws.assign(Source_Name.begin(), Source_Name.end());
ws_buf.assign(pbuf.begin(), pbuf.end());
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &token))
return FALSE;
SetPrivilege(token, L"SeAuditPrivilege", true);
AUTHZ_SOURCE_SCHEMA_REGISTRATION ar;
memset(&ar, 0, sizeof(ar));
ar.dwFlags = AUTHZ_ALLOW_MULTIPLE_SOURCE_INSTANCES;
ar.szEventSourceName = &ws[0];
ar.szEventMessageFile = &ws_buf[0];
ar.szEventSourceXmlSchemaFile = NULL;
ar.szEventAccessStringsFile = &ws_buf[0];
ar.szExecutableImagePath = NULL;
AuthzInstallSecurityEventSource(0, &ar);
bResult = AuthzRegisterSecurityEventSource(0, ws.c_str(), &hEventProvider);
int err = GetLastError();
if (!bResult)
{
printf("AuthzRegisterSecurityEventSource failed, error is %d\n", err);
return_code = -1;
}
SID id;
if (hEventProvider)
{
// Generate the audit.
while (i < 10) {
bResult = AuthzReportSecurityEvent(
APF_AuditSuccess,
hEventProvider,
event_id,
NULL,
3,
APT_String, L"Jay Hamlin",
APT_String, L"March 21, 1960",
APT_Ulong, 45);
int err1 = GetLastError();
if (!bResult)
{
printf("AuthzReportSecurityEvent failed, error is %d\n", err1);
return_code = -2;
break;
}
i++;
}
AuthzUnregisterSecurityEventSource(0, &hEventProvider);
AuthzUninstallSecurityEventSource(0, &ws[0]);
}
std::cout << "Exit : " << return_code << std::endl;
getchar();
}
我尝试了AuthzReportSecurityEventFromParams函数,但几乎没有关于如何使用它的文档,我不知道它是否是一个更好的选择
1条答案
按热度按时间i86rm4rw1#
就
AuthzReportSecurityEvent
而言,该函数不支持指定变量参数的名称。此外,根据https://learn.microsoft.com/en-us/answers/questions/93571/how-can-i-write-windows-security-log-using-authzre,这是设计。没有指定事件数据名称的入口。