kcenon::pacs::security::atna_audit_logger Class Reference

RFC 3881 XML audit message generator. More...

#include <atna_audit_logger.h>

Collaboration diagram for kcenon::pacs::security::atna_audit_logger:

Static Public Member Functions
static std::string	to_xml (const atna_audit_message &message)
	Serialize an audit message to RFC 3881 XML.
static atna_audit_message	build_application_activity (const std::string &source_id, const std::string &app_name, bool is_start, atna_event_outcome outcome=atna_event_outcome::success)
	Build Application Activity audit message (start/stop)
static atna_audit_message	build_dicom_instances_accessed (const std::string &source_id, const std::string &user_id, const std::string &user_ip, const std::string &study_uid, const std::string &patient_id="", atna_event_outcome outcome=atna_event_outcome::success)
	Build DICOM Instances Accessed audit message (C-FIND, QIDO-RS)
static atna_audit_message	build_dicom_instances_transferred (const std::string &source_id, const std::string &source_ae, const std::string &source_ip, const std::string &dest_ae, const std::string &dest_ip, const std::string &study_uid, const std::string &patient_id="", bool is_import=true, atna_event_outcome outcome=atna_event_outcome::success)
	Build DICOM Instances Transferred audit message (C-STORE, C-MOVE)
static atna_audit_message	build_study_deleted (const std::string &source_id, const std::string &user_id, const std::string &user_ip, const std::string &study_uid, const std::string &patient_id="", atna_event_outcome outcome=atna_event_outcome::success)
	Build Study Deleted audit message.
static atna_audit_message	build_security_alert (const std::string &source_id, const std::string &user_id, const std::string &user_ip, const std::string &alert_description, atna_event_outcome outcome=atna_event_outcome::serious_failure)
	Build Security Alert audit message.
static atna_audit_message	build_user_authentication (const std::string &source_id, const std::string &user_id, const std::string &user_ip, bool is_login, atna_event_outcome outcome=atna_event_outcome::success)
	Build User Authentication audit message (login/logout)
static atna_audit_message	build_query (const std::string &source_id, const std::string &user_id, const std::string &user_ip, const std::string &query_data, const std::string &patient_id="", atna_event_outcome outcome=atna_event_outcome::success)
	Build Query audit message (C-FIND, QIDO-RS)
static atna_audit_message	build_export (const std::string &source_id, const std::string &user_id, const std::string &user_ip, const std::string &dest_id, const std::string &study_uid, const std::string &patient_id="", atna_event_outcome outcome=atna_event_outcome::success)
	Build Export audit message (media/network export)

Static Private Member Functions
static std::string	xml_escape (const std::string &str)
static std::string	format_datetime (std::chrono::system_clock::time_point tp)
static std::string	format_coded_value_attrs (const atna_coded_value &cv)

Detailed Description

RFC 3881 XML audit message generator.

Generates well-formed XML audit messages compliant with DICOM PS3.15 Annex A.5 / RFC 3881.

Definition at line 423 of file atna_audit_logger.h.

Member Function Documentation

build_application_activity()

atna_audit_message kcenon::pacs::security::atna_audit_logger::build_application_activity ( const std::string & source_id, const std::string & app_name, bool is_start, atna_event_outcome outcome = atna_event_outcome::success )

staticnodiscard

Build Application Activity audit message (start/stop)

Parameters

source_id	Audit source identifier
app_name	Application name
is_start	true for application start, false for stop
outcome	Event outcome

Returns

Complete audit message

Definition at line 156 of file atna_audit_logger.cpp.

                                {
 
    atna_audit_message msg;
    msg.event_id = atna_event_ids::application_activity;
    msg.event_type_codes.push_back(
        is_start ? atna_event_types::application_start
                 : atna_event_types::application_stop);
    msg.event_action = atna_event_action::execute;
    msg.event_date_time = std::chrono::system_clock::now();
    msg.event_outcome = outcome;
 
    atna_active_participant ap;
    ap.user_id = app_name;
    ap.user_is_requestor = false;
    ap.role_id_codes.push_back(atna_role_ids::application);
    msg.active_participants.push_back(std::move(ap));
 
    msg.audit_source.audit_source_id = source_id;
 
    return msg;
}

References kcenon::pacs::security::atna_audit_message::active_participants, kcenon::pacs::security::atna_role_ids::application, kcenon::pacs::security::atna_event_ids::application_activity, kcenon::pacs::security::atna_event_types::application_start, kcenon::pacs::security::atna_event_types::application_stop, kcenon::pacs::security::atna_audit_message::audit_source, kcenon::pacs::security::atna_audit_source::audit_source_id, kcenon::pacs::security::atna_audit_message::event_action, kcenon::pacs::security::atna_audit_message::event_date_time, kcenon::pacs::security::atna_audit_message::event_id, kcenon::pacs::security::atna_audit_message::event_outcome, kcenon::pacs::security::atna_audit_message::event_type_codes, and kcenon::pacs::security::execute.

build_dicom_instances_accessed()

atna_audit_message kcenon::pacs::security::atna_audit_logger::build_dicom_instances_accessed ( const std::string & source_id, const std::string & user_id, const std::string & user_ip, const std::string & study_uid, const std::string & patient_id = "", atna_event_outcome outcome = atna_event_outcome::success )

staticnodiscard

Build DICOM Instances Accessed audit message (C-FIND, QIDO-RS)

Parameters

source_id	Audit source identifier
user_id	User/AE Title that performed the access
user_ip	Source IP address
study_uid	Study Instance UID accessed
patient_id	Patient ID (if available)
outcome	Event outcome

Returns

Complete audit message

Definition at line 182 of file atna_audit_logger.cpp.

                                {
 
    atna_audit_message msg;
    msg.event_id = atna_event_ids::dicom_instances_accessed;
    msg.event_action = atna_event_action::read;
    msg.event_date_time = std::chrono::system_clock::now();
    msg.event_outcome = outcome;
 
    atna_active_participant ap;
    ap.user_id = user_id;
    ap.user_is_requestor = true;
    ap.network_access_point_id = user_ip;
    ap.network_access_point_type = atna_network_access_type::ip_address;
    msg.active_participants.push_back(std::move(ap));
 
    msg.audit_source.audit_source_id = source_id;
 
    // Study object
    if (!study_uid.empty()) {
        atna_participant_object obj;
        obj.object_type = atna_object_type::system_object;
        obj.object_role = atna_object_role::report;
        obj.object_id_type_code = atna_object_id_types::study_instance_uid;
        obj.object_id = study_uid;
        msg.participant_objects.push_back(std::move(obj));
    }
 
    // Patient object
    if (!patient_id.empty()) {
        atna_participant_object patient_obj;
        patient_obj.object_type = atna_object_type::person;
        patient_obj.object_role = atna_object_role::patient;
        patient_obj.object_id_type_code = atna_object_id_types::patient_number;
        patient_obj.object_id = patient_id;
        msg.participant_objects.push_back(std::move(patient_obj));
    }
 
    return msg;
}

References kcenon::pacs::security::atna_audit_message::active_participants, kcenon::pacs::security::atna_audit_message::audit_source, kcenon::pacs::security::atna_audit_source::audit_source_id, kcenon::pacs::security::atna_event_ids::dicom_instances_accessed, kcenon::pacs::security::atna_audit_message::event_action, kcenon::pacs::security::atna_audit_message::event_date_time, kcenon::pacs::security::atna_audit_message::event_id, kcenon::pacs::security::atna_audit_message::event_outcome, kcenon::pacs::security::ip_address, kcenon::pacs::security::atna_participant_object::object_id, kcenon::pacs::security::atna_participant_object::object_id_type_code, kcenon::pacs::security::atna_participant_object::object_role, kcenon::pacs::security::atna_participant_object::object_type, kcenon::pacs::security::atna_audit_message::participant_objects, kcenon::pacs::security::patient, kcenon::pacs::security::atna_object_id_types::patient_number, kcenon::pacs::security::person, kcenon::pacs::security::read, kcenon::pacs::security::report, kcenon::pacs::security::atna_object_id_types::study_instance_uid, and kcenon::pacs::security::system_object.

build_dicom_instances_transferred()

atna_audit_message kcenon::pacs::security::atna_audit_logger::build_dicom_instances_transferred ( const std::string & source_id, const std::string & source_ae, const std::string & source_ip, const std::string & dest_ae, const std::string & dest_ip, const std::string & study_uid, const std::string & patient_id = "", bool is_import = true, atna_event_outcome outcome = atna_event_outcome::success )

staticnodiscard

Build DICOM Instances Transferred audit message (C-STORE, C-MOVE)

Parameters

source_id	Audit source identifier
source_ae	Source AE Title
source_ip	Source IP address
dest_ae	Destination AE Title
dest_ip	Destination IP address
study_uid	Study Instance UID
patient_id	Patient ID (if available)
is_import	true if receiving (import), false if sending (export)
outcome	Event outcome

Returns

Complete audit message

Definition at line 228 of file atna_audit_logger.cpp.

                                {
 
    atna_audit_message msg;
    msg.event_id = atna_event_ids::dicom_instances_transferred;
    msg.event_action = is_import ? atna_event_action::create
                                 : atna_event_action::read;
    msg.event_date_time = std::chrono::system_clock::now();
    msg.event_outcome = outcome;
 
    // Source participant
    atna_active_participant src;
    src.user_id = source_ae;
    src.user_is_requestor = !is_import;
    src.network_access_point_id = source_ip;
    src.network_access_point_type = atna_network_access_type::ip_address;
    src.role_id_codes.push_back(atna_role_ids::source);
    msg.active_participants.push_back(std::move(src));
 
    // Destination participant
    atna_active_participant dst;
    dst.user_id = dest_ae;
    dst.user_is_requestor = is_import;
    dst.network_access_point_id = dest_ip;
    dst.network_access_point_type = atna_network_access_type::ip_address;
    dst.role_id_codes.push_back(atna_role_ids::destination);
    msg.active_participants.push_back(std::move(dst));
 
    msg.audit_source.audit_source_id = source_id;
 
    // Study object
    if (!study_uid.empty()) {
        atna_participant_object obj;
        obj.object_type = atna_object_type::system_object;
        obj.object_role = atna_object_role::report;
        obj.object_id_type_code = atna_object_id_types::study_instance_uid;
        obj.object_id = study_uid;
        msg.participant_objects.push_back(std::move(obj));
    }
 
    // Patient object
    if (!patient_id.empty()) {
        atna_participant_object patient_obj;
        patient_obj.object_type = atna_object_type::person;
        patient_obj.object_role = atna_object_role::patient;
        patient_obj.object_id_type_code = atna_object_id_types::patient_number;
        patient_obj.object_id = patient_id;
        msg.participant_objects.push_back(std::move(patient_obj));
    }
 
    return msg;
}

References kcenon::pacs::security::atna_audit_message::active_participants, kcenon::pacs::security::atna_audit_message::audit_source, kcenon::pacs::security::atna_audit_source::audit_source_id, kcenon::pacs::security::create, kcenon::pacs::security::atna_role_ids::destination, kcenon::pacs::security::atna_event_ids::dicom_instances_transferred, kcenon::pacs::security::atna_audit_message::event_action, kcenon::pacs::security::atna_audit_message::event_date_time, kcenon::pacs::security::atna_audit_message::event_id, kcenon::pacs::security::atna_audit_message::event_outcome, kcenon::pacs::security::ip_address, kcenon::pacs::security::atna_active_participant::network_access_point_id, kcenon::pacs::security::atna_active_participant::network_access_point_type, kcenon::pacs::security::atna_participant_object::object_id, kcenon::pacs::security::atna_participant_object::object_id_type_code, kcenon::pacs::security::atna_participant_object::object_role, kcenon::pacs::security::atna_participant_object::object_type, kcenon::pacs::security::atna_audit_message::participant_objects, kcenon::pacs::security::patient, kcenon::pacs::security::atna_object_id_types::patient_number, kcenon::pacs::security::person, kcenon::pacs::security::read, kcenon::pacs::security::report, kcenon::pacs::security::atna_active_participant::role_id_codes, kcenon::pacs::security::atna_role_ids::source, kcenon::pacs::security::atna_object_id_types::study_instance_uid, kcenon::pacs::security::system_object, kcenon::pacs::security::atna_active_participant::user_id, and kcenon::pacs::security::atna_active_participant::user_is_requestor.

Referenced by kcenon::pacs::security::atna_service_auditor::audit_instance_stored().

Here is the caller graph for this function:

build_export()

atna_audit_message kcenon::pacs::security::atna_audit_logger::build_export ( const std::string & source_id, const std::string & user_id, const std::string & user_ip, const std::string & dest_id, const std::string & study_uid, const std::string & patient_id = "", atna_event_outcome outcome = atna_event_outcome::success )

staticnodiscard

Build Export audit message (media/network export)

Parameters

source_id	Audit source identifier
user_id	User/AE Title that exported data
user_ip	Source IP address
dest_id	Destination identifier
study_uid	Study Instance UID
patient_id	Patient ID
outcome	Event outcome

Returns

Complete audit message

Definition at line 438 of file atna_audit_logger.cpp.

                                {
 
    atna_audit_message msg;
    msg.event_id = atna_event_ids::data_export;
    msg.event_action = atna_event_action::read;
    msg.event_date_time = std::chrono::system_clock::now();
    msg.event_outcome = outcome;
 
    // Exporter
    atna_active_participant exporter;
    exporter.user_id = user_id;
    exporter.user_is_requestor = true;
    exporter.network_access_point_id = user_ip;
    exporter.network_access_point_type = atna_network_access_type::ip_address;
    exporter.role_id_codes.push_back(atna_role_ids::source);
    msg.active_participants.push_back(std::move(exporter));
 
    // Destination
    atna_active_participant dest;
    dest.user_id = dest_id;
    dest.user_is_requestor = false;
    dest.role_id_codes.push_back(atna_role_ids::destination);
    msg.active_participants.push_back(std::move(dest));
 
    msg.audit_source.audit_source_id = source_id;
 
    // Study object
    if (!study_uid.empty()) {
        atna_participant_object obj;
        obj.object_type = atna_object_type::system_object;
        obj.object_role = atna_object_role::report;
        obj.object_id_type_code = atna_object_id_types::study_instance_uid;
        obj.object_id = study_uid;
        msg.participant_objects.push_back(std::move(obj));
    }
 
    // Patient object
    if (!patient_id.empty()) {
        atna_participant_object patient_obj;
        patient_obj.object_type = atna_object_type::person;
        patient_obj.object_role = atna_object_role::patient;
        patient_obj.object_id_type_code = atna_object_id_types::patient_number;
        patient_obj.object_id = patient_id;
        msg.participant_objects.push_back(std::move(patient_obj));
    }
 
    return msg;
}

References kcenon::pacs::security::atna_audit_message::active_participants, kcenon::pacs::security::atna_audit_message::audit_source, kcenon::pacs::security::atna_audit_source::audit_source_id, kcenon::pacs::security::atna_event_ids::data_export, kcenon::pacs::security::atna_role_ids::destination, kcenon::pacs::security::atna_audit_message::event_action, kcenon::pacs::security::atna_audit_message::event_date_time, kcenon::pacs::security::atna_audit_message::event_id, kcenon::pacs::security::atna_audit_message::event_outcome, kcenon::pacs::security::ip_address, kcenon::pacs::security::atna_active_participant::network_access_point_id, kcenon::pacs::security::atna_active_participant::network_access_point_type, kcenon::pacs::security::atna_participant_object::object_id, kcenon::pacs::security::atna_participant_object::object_id_type_code, kcenon::pacs::security::atna_participant_object::object_role, kcenon::pacs::security::atna_participant_object::object_type, kcenon::pacs::security::atna_audit_message::participant_objects, kcenon::pacs::security::patient, kcenon::pacs::security::atna_object_id_types::patient_number, kcenon::pacs::security::person, kcenon::pacs::security::read, kcenon::pacs::security::report, kcenon::pacs::security::atna_active_participant::role_id_codes, kcenon::pacs::security::atna_role_ids::source, kcenon::pacs::security::atna_object_id_types::study_instance_uid, kcenon::pacs::security::system_object, kcenon::pacs::security::atna_active_participant::user_id, and kcenon::pacs::security::atna_active_participant::user_is_requestor.

build_query()

atna_audit_message kcenon::pacs::security::atna_audit_logger::build_query ( const std::string & source_id, const std::string & user_id, const std::string & user_ip, const std::string & query_data, const std::string & patient_id = "", atna_event_outcome outcome = atna_event_outcome::success )

staticnodiscard

Build Query audit message (C-FIND, QIDO-RS)

Parameters

source_id	Audit source identifier
user_id	User/AE Title that performed the query
user_ip	Source IP address
query_data	The query parameters (will be encoded)
patient_id	Patient ID from query (if available)
outcome	Event outcome

Returns

Complete audit message

Definition at line 393 of file atna_audit_logger.cpp.

                                {
 
    atna_audit_message msg;
    msg.event_id = atna_event_ids::query;
    msg.event_action = atna_event_action::execute;
    msg.event_date_time = std::chrono::system_clock::now();
    msg.event_outcome = outcome;
 
    atna_active_participant ap;
    ap.user_id = user_id;
    ap.user_is_requestor = true;
    ap.network_access_point_id = user_ip;
    ap.network_access_point_type = atna_network_access_type::ip_address;
    ap.role_id_codes.push_back(atna_role_ids::source);
    msg.active_participants.push_back(std::move(ap));
 
    msg.audit_source.audit_source_id = source_id;
 
    // Query object
    atna_participant_object query_obj;
    query_obj.object_type = atna_object_type::system_object;
    query_obj.object_role = atna_object_role::query;
    query_obj.object_id_type_code = atna_object_id_types::sop_class_uid;
    query_obj.object_query = query_data;
    msg.participant_objects.push_back(std::move(query_obj));
 
    // Patient object
    if (!patient_id.empty()) {
        atna_participant_object patient_obj;
        patient_obj.object_type = atna_object_type::person;
        patient_obj.object_role = atna_object_role::patient;
        patient_obj.object_id_type_code = atna_object_id_types::patient_number;
        patient_obj.object_id = patient_id;
        msg.participant_objects.push_back(std::move(patient_obj));
    }
 
    return msg;
}

References kcenon::pacs::security::atna_audit_message::active_participants, kcenon::pacs::security::atna_audit_message::audit_source, kcenon::pacs::security::atna_audit_source::audit_source_id, kcenon::pacs::security::atna_audit_message::event_action, kcenon::pacs::security::atna_audit_message::event_date_time, kcenon::pacs::security::atna_audit_message::event_id, kcenon::pacs::security::atna_audit_message::event_outcome, kcenon::pacs::security::execute, kcenon::pacs::security::ip_address, kcenon::pacs::security::atna_participant_object::object_id, kcenon::pacs::security::atna_participant_object::object_id_type_code, kcenon::pacs::security::atna_participant_object::object_query, kcenon::pacs::security::atna_participant_object::object_role, kcenon::pacs::security::atna_participant_object::object_type, kcenon::pacs::security::atna_audit_message::participant_objects, kcenon::pacs::security::patient, kcenon::pacs::security::atna_object_id_types::patient_number, kcenon::pacs::security::person, kcenon::pacs::security::atna_event_ids::query, kcenon::pacs::security::query, kcenon::pacs::security::atna_object_id_types::sop_class_uid, kcenon::pacs::security::atna_role_ids::source, and kcenon::pacs::security::system_object.

Referenced by kcenon::pacs::security::atna_service_auditor::audit_query().

Here is the caller graph for this function:

build_security_alert()

atna_audit_message kcenon::pacs::security::atna_audit_logger::build_security_alert ( const std::string & source_id, const std::string & user_id, const std::string & user_ip, const std::string & alert_description, atna_event_outcome outcome = atna_event_outcome::serious_failure )

staticnodiscard

Build Security Alert audit message.

Parameters

source_id	Audit source identifier
user_id	User/system that triggered the alert
user_ip	Source IP address
alert_description	Description of the security alert
outcome	Event outcome

Returns

Complete audit message

Definition at line 333 of file atna_audit_logger.cpp.

                                {
 
    atna_audit_message msg;
    msg.event_id = atna_event_ids::security_alert;
    msg.event_action = atna_event_action::execute;
    msg.event_date_time = std::chrono::system_clock::now();
    msg.event_outcome = outcome;
 
    atna_active_participant ap;
    ap.user_id = user_id;
    ap.user_is_requestor = true;
    ap.network_access_point_id = user_ip;
    ap.network_access_point_type = atna_network_access_type::ip_address;
    msg.active_participants.push_back(std::move(ap));
 
    msg.audit_source.audit_source_id = source_id;
 
    // Alert description as participant object
    atna_participant_object obj;
    obj.object_type = atna_object_type::system_object;
    obj.object_role = atna_object_role::security_resource;
    obj.object_id = source_id;
    obj.object_name = alert_description;
    msg.participant_objects.push_back(std::move(obj));
 
    return msg;
}

References kcenon::pacs::security::atna_audit_message::active_participants, kcenon::pacs::security::atna_audit_message::audit_source, kcenon::pacs::security::atna_audit_source::audit_source_id, kcenon::pacs::security::atna_audit_message::event_action, kcenon::pacs::security::atna_audit_message::event_date_time, kcenon::pacs::security::atna_audit_message::event_id, kcenon::pacs::security::atna_audit_message::event_outcome, kcenon::pacs::security::execute, kcenon::pacs::security::ip_address, kcenon::pacs::security::atna_participant_object::object_id, kcenon::pacs::security::atna_participant_object::object_name, kcenon::pacs::security::atna_participant_object::object_role, kcenon::pacs::security::atna_participant_object::object_type, kcenon::pacs::security::atna_audit_message::participant_objects, kcenon::pacs::security::atna_event_ids::security_alert, kcenon::pacs::security::security_resource, and kcenon::pacs::security::system_object.

Referenced by kcenon::pacs::security::atna_service_auditor::audit_security_alert().

Here is the caller graph for this function:

build_study_deleted()

atna_audit_message kcenon::pacs::security::atna_audit_logger::build_study_deleted ( const std::string & source_id, const std::string & user_id, const std::string & user_ip, const std::string & study_uid, const std::string & patient_id = "", atna_event_outcome outcome = atna_event_outcome::success )

staticnodiscard

Build Study Deleted audit message.

Parameters

source_id	Audit source identifier
user_id	User/AE Title that deleted the study
user_ip	Source IP address
study_uid	Deleted Study Instance UID
patient_id	Patient ID
outcome	Event outcome

Returns

Complete audit message

Definition at line 289 of file atna_audit_logger.cpp.

                                {
 
    atna_audit_message msg;
    msg.event_id = atna_event_ids::dicom_study_deleted;
    msg.event_action = atna_event_action::delete_action;
    msg.event_date_time = std::chrono::system_clock::now();
    msg.event_outcome = outcome;
 
    atna_active_participant ap;
    ap.user_id = user_id;
    ap.user_is_requestor = true;
    ap.network_access_point_id = user_ip;
    ap.network_access_point_type = atna_network_access_type::ip_address;
    msg.active_participants.push_back(std::move(ap));
 
    msg.audit_source.audit_source_id = source_id;
 
    // Study object
    atna_participant_object obj;
    obj.object_type = atna_object_type::system_object;
    obj.object_role = atna_object_role::report;
    obj.object_id_type_code = atna_object_id_types::study_instance_uid;
    obj.object_id = study_uid;
    msg.participant_objects.push_back(std::move(obj));
 
    // Patient object
    if (!patient_id.empty()) {
        atna_participant_object patient_obj;
        patient_obj.object_type = atna_object_type::person;
        patient_obj.object_role = atna_object_role::patient;
        patient_obj.object_id_type_code = atna_object_id_types::patient_number;
        patient_obj.object_id = patient_id;
        msg.participant_objects.push_back(std::move(patient_obj));
    }
 
    return msg;
}

References kcenon::pacs::security::atna_audit_message::active_participants, kcenon::pacs::security::atna_audit_message::audit_source, kcenon::pacs::security::atna_audit_source::audit_source_id, kcenon::pacs::security::delete_action, kcenon::pacs::security::atna_event_ids::dicom_study_deleted, kcenon::pacs::security::atna_audit_message::event_action, kcenon::pacs::security::atna_audit_message::event_date_time, kcenon::pacs::security::atna_audit_message::event_id, kcenon::pacs::security::atna_audit_message::event_outcome, kcenon::pacs::security::ip_address, kcenon::pacs::security::atna_participant_object::object_id, kcenon::pacs::security::atna_participant_object::object_id_type_code, kcenon::pacs::security::atna_participant_object::object_role, kcenon::pacs::security::atna_participant_object::object_type, kcenon::pacs::security::atna_audit_message::participant_objects, kcenon::pacs::security::patient, kcenon::pacs::security::atna_object_id_types::patient_number, kcenon::pacs::security::person, kcenon::pacs::security::report, kcenon::pacs::security::atna_object_id_types::study_instance_uid, and kcenon::pacs::security::system_object.

build_user_authentication()

atna_audit_message kcenon::pacs::security::atna_audit_logger::build_user_authentication ( const std::string & source_id, const std::string & user_id, const std::string & user_ip, bool is_login, atna_event_outcome outcome = atna_event_outcome::success )

staticnodiscard

Build User Authentication audit message (login/logout)

Parameters

source_id	Audit source identifier
user_id	User that authenticated
user_ip	Source IP address
is_login	true for login, false for logout
outcome	Event outcome (success/failure)

Returns

Complete audit message

Definition at line 366 of file atna_audit_logger.cpp.

                                {
 
    atna_audit_message msg;
    msg.event_id = atna_event_ids::user_authentication;
    msg.event_type_codes.push_back(
        is_login ? atna_event_types::login : atna_event_types::logout);
    msg.event_action = atna_event_action::execute;
    msg.event_date_time = std::chrono::system_clock::now();
    msg.event_outcome = outcome;
 
    atna_active_participant ap;
    ap.user_id = user_id;
    ap.user_is_requestor = true;
    ap.network_access_point_id = user_ip;
    ap.network_access_point_type = atna_network_access_type::ip_address;
    msg.active_participants.push_back(std::move(ap));
 
    msg.audit_source.audit_source_id = source_id;
 
    return msg;
}

References kcenon::pacs::security::atna_audit_message::active_participants, kcenon::pacs::security::atna_audit_message::audit_source, kcenon::pacs::security::atna_audit_source::audit_source_id, kcenon::pacs::security::atna_audit_message::event_action, kcenon::pacs::security::atna_audit_message::event_date_time, kcenon::pacs::security::atna_audit_message::event_id, kcenon::pacs::security::atna_audit_message::event_outcome, kcenon::pacs::security::atna_audit_message::event_type_codes, kcenon::pacs::security::execute, kcenon::pacs::security::ip_address, kcenon::pacs::security::atna_event_types::login, kcenon::pacs::security::atna_event_types::logout, and kcenon::pacs::security::atna_event_ids::user_authentication.

Referenced by kcenon::pacs::security::atna_service_auditor::audit_authentication().

Here is the caller graph for this function:

format_coded_value_attrs()

std::string kcenon::pacs::security::atna_audit_logger::format_coded_value_attrs ( const atna_coded_value & cv )

staticnodiscardprivate

Definition at line 538 of file atna_audit_logger.cpp.

                                {
 
    std::ostringstream oss;
    oss << "csd-code=\"" << xml_escape(cv.code) << "\"";
 
    if (!cv.code_system_name.empty()) {
        oss << " codeSystemName=\"" << xml_escape(cv.code_system_name) << "\"";
    }
 
    if (!cv.display_name.empty()) {
        oss << " originalText=\"" << xml_escape(cv.display_name) << "\"";
    }
 
    return oss.str();
}

References xml_escape().

Referenced by to_xml().

Here is the call graph for this function:

Here is the caller graph for this function:

format_datetime()

std::string kcenon::pacs::security::atna_audit_logger::format_datetime ( std::chrono::system_clock::time_point tp )

staticnodiscardprivate

Definition at line 516 of file atna_audit_logger.cpp.

                                        {
 
    auto time_t_val = std::chrono::system_clock::to_time_t(tp);
    auto ms = std::chrono::duration_cast<std::chrono::milliseconds>(
        tp.time_since_epoch()) % 1000;
 
    std::tm tm_val{};
#if defined(_WIN32)
    gmtime_s(&tm_val, &time_t_val);
#else
    gmtime_r(&time_t_val, &tm_val);
#endif
 
    std::ostringstream oss;
    oss << std::put_time(&tm_val, "%Y-%m-%dT%H:%M:%S")
        << '.' << std::setfill('0') << std::setw(3) << ms.count()
        << "Z";
 
    return oss.str();
}

Referenced by to_xml().

Here is the caller graph for this function:

to_xml()

std::string kcenon::pacs::security::atna_audit_logger::to_xml ( const atna_audit_message & message )

staticnodiscard

Serialize an audit message to RFC 3881 XML.

Parameters

message

The audit message to serialize

Returns

Well-formed XML string

Definition at line 18 of file atna_audit_logger.cpp.

                                                                 {
    std::ostringstream xml;
 
    xml << "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n";
    xml << "<AuditMessage>\n";
 
    // -- EventIdentification --
    xml << "  <EventIdentification"
        << " EventActionCode=\""
        << static_cast<char>(msg.event_action) << "\""
        << " EventDateTime=\"" << format_datetime(msg.event_date_time) << "\""
        << " EventOutcomeIndicator=\""
        << static_cast<int>(msg.event_outcome) << "\">\n";
 
    xml << "    <EventID " << format_coded_value_attrs(msg.event_id) << "/>\n";
 
    for (const auto& etc : msg.event_type_codes) {
        xml << "    <EventTypeCode " << format_coded_value_attrs(etc)
            << "/>\n";
    }
 
    xml << "  </EventIdentification>\n";
 
    // -- ActiveParticipant(s) --
    for (const auto& ap : msg.active_participants) {
        xml << "  <ActiveParticipant"
            << " UserID=\"" << xml_escape(ap.user_id) << "\"";
 
        if (!ap.alternative_user_id.empty()) {
            xml << " AlternativeUserID=\""
                << xml_escape(ap.alternative_user_id) << "\"";
        }
 
        if (!ap.user_name.empty()) {
            xml << " UserName=\"" << xml_escape(ap.user_name) << "\"";
        }
 
        xml << " UserIsRequestor=\""
            << (ap.user_is_requestor ? "true" : "false") << "\"";
 
        if (!ap.network_access_point_id.empty()) {
            xml << " NetworkAccessPointID=\""
                << xml_escape(ap.network_access_point_id) << "\""
                << " NetworkAccessPointTypeCode=\""
                << static_cast<int>(ap.network_access_point_type) << "\"";
        }
 
        if (ap.role_id_codes.empty()) {
            xml << "/>\n";
        } else {
            xml << ">\n";
            for (const auto& role : ap.role_id_codes) {
                xml << "    <RoleIDCode "
                    << format_coded_value_attrs(role) << "/>\n";
            }
            xml << "  </ActiveParticipant>\n";
        }
    }
 
    // -- AuditSourceIdentification --
    xml << "  <AuditSourceIdentification"
        << " AuditSourceID=\""
        << xml_escape(msg.audit_source.audit_source_id) << "\"";
 
    if (!msg.audit_source.audit_enterprise_site_id.empty()) {
        xml << " AuditEnterpriseSiteID=\""
            << xml_escape(msg.audit_source.audit_enterprise_site_id) << "\"";
    }
 
    if (msg.audit_source.audit_source_type_codes.empty()) {
        xml << "/>\n";
    } else {
        xml << ">\n";
        for (auto type_code : msg.audit_source.audit_source_type_codes) {
            xml << "    <AuditSourceTypeCode code=\""
                << static_cast<int>(type_code) << "\"/>\n";
        }
        xml << "  </AuditSourceIdentification>\n";
    }
 
    // -- ParticipantObjectIdentification(s) --
    for (const auto& po : msg.participant_objects) {
        xml << "  <ParticipantObjectIdentification"
            << " ParticipantObjectTypeCode=\""
            << static_cast<int>(po.object_type) << "\""
            << " ParticipantObjectTypeCodeRole=\""
            << static_cast<int>(po.object_role) << "\"";
 
        if (!po.object_id.empty()) {
            xml << " ParticipantObjectID=\""
                << xml_escape(po.object_id) << "\"";
        }
 
        if (!po.object_name.empty()) {
            xml << " ParticipantObjectName=\""
                << xml_escape(po.object_name) << "\"";
        }
 
        bool has_children = !po.object_id_type_code.code.empty() ||
                            !po.object_query.empty() ||
                            !po.object_details.empty();
 
        if (!has_children) {
            xml << "/>\n";
        } else {
            xml << ">\n";
 
            if (!po.object_id_type_code.code.empty()) {
                xml << "    <ParticipantObjectIDTypeCode "
                    << format_coded_value_attrs(po.object_id_type_code)
                    << "/>\n";
            }
 
            if (!po.object_query.empty()) {
                xml << "    <ParticipantObjectQuery>"
                    << xml_escape(po.object_query)
                    << "</ParticipantObjectQuery>\n";
            }
 
            for (const auto& detail : po.object_details) {
                xml << "    <ParticipantObjectDetail"
                    << " type=\"" << xml_escape(detail.type) << "\""
                    << " value=\"" << xml_escape(detail.value) << "\"/>\n";
            }
 
            xml << "  </ParticipantObjectIdentification>\n";
        }
    }
 
    xml << "</AuditMessage>\n";
 
    return xml.str();
}

References kcenon::pacs::security::atna_audit_message::active_participants, kcenon::pacs::security::atna_audit_source::audit_enterprise_site_id, kcenon::pacs::security::atna_audit_message::audit_source, kcenon::pacs::security::atna_audit_source::audit_source_id, kcenon::pacs::security::atna_audit_source::audit_source_type_codes, kcenon::pacs::security::atna_audit_message::event_action, kcenon::pacs::security::atna_audit_message::event_date_time, kcenon::pacs::security::atna_audit_message::event_id, kcenon::pacs::security::atna_audit_message::event_outcome, kcenon::pacs::security::atna_audit_message::event_type_codes, format_coded_value_attrs(), format_datetime(), kcenon::pacs::security::atna_audit_message::participant_objects, and xml_escape().

Referenced by kcenon::pacs::security::atna_service_auditor::send_audit().

Here is the call graph for this function:

Here is the caller graph for this function:

xml_escape()

std::string kcenon::pacs::security::atna_audit_logger::xml_escape ( const std::string & str )

staticnodiscardprivate

Definition at line 498 of file atna_audit_logger.cpp.

                                                            {
    std::string result;
    result.reserve(str.size());
 
    for (char c : str) {
        switch (c) {
            case '&':  result += "&";  break;
            case '<':  result += "&lt;";   break;
            case '>':  result += "&gt;";   break;
            case '"':  result += "&quot;"; break;
            case '\'': result += "&apos;"; break;
            default:   result += c;        break;
        }
    }
 
    return result;
}

Referenced by format_coded_value_attrs(), and to_xml().

Here is the caller graph for this function:

---

The documentation for this class was generated from the following files:

• include/kcenon/pacs/security/atna_audit_logger.h
• src/security/atna_audit_logger.cpp