Use Update() method instead of exposing the internal fields on EventR…

…ecordMetadata
microsoft · Nov 12, 2024 · 5b9e81e · 5b9e81e
1 parent 2c19173
commit 5b9e81e
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 4 deletions.
diff --git a/Microsoft.O365.Security.Native.ETW/EventRecordMetadata.hpp b/Microsoft.O365.Security.Native.ETW/EventRecordMetadata.hpp
@@ -17,15 +17,22 @@ namespace Microsoft { namespace O365 { namespace Security { namespace ETW {
     /// </summary>
     public ref class EventRecordMetadata : public IEventRecordMetadata
     {
+    protected:
+        const EVENT_RECORD* record_;
+        const EVENT_HEADER* header_;
+
     internal:
         EventRecordMetadata(const EVENT_RECORD& record)
             : record_(&record)
             , header_(&record.EventHeader) { }
 
         EventRecordMetadata() { }
 
-        const EVENT_RECORD* record_;
-        const EVENT_HEADER* header_;
+        virtual void Update(const EVENT_RECORD& record)
+        {
+            record_ = &record;
+            header_ = &record.EventHeader;
+        }
 
     public:
         // For container ID's, we are expecting format "00000000-0000-0000-0000-0000000000000", 

diff --git a/Microsoft.O365.Security.Native.ETW/RawProvider.hpp b/Microsoft.O365.Security.Native.ETW/RawProvider.hpp
@@ -168,8 +168,7 @@ namespace Microsoft { namespace O365 { namespace Security { namespace ETW {
 
     inline void RawProvider::EventNotification(const EVENT_RECORD &record)
     {
-        data_->record_ = &record;
-        data_->header_ = &record.EventHeader;
+        data_->Update(record);
 
         OnEvent(data_);
     }