Add Exchange IIS service telemetry

src/OCSentinelCli/Models.cs

@@ -13,6 +13,12 @@ internal sealed record AttackEvent
     public string Username { get; init; } = string.Empty;
 
     public string Source { get; init; } = string.Empty;
+
+    public string Service { get; init; } = string.Empty;
+
+    public int? DestinationPort { get; init; }
+
+    public string Endpoint { get; init; } = string.Empty;
 }
 
 internal sealed record AggregatedAttack
@@ -33,6 +39,12 @@ internal sealed record AggregatedAttack
 
     public List<string> Sources { get; init; } = [];
 
+    public List<string> Services { get; init; } = [];
+
+    public List<int> DestinationPorts { get; init; } = [];
+
+    public List<string> Endpoints { get; init; } = [];
+
     public static AggregatedAttack FromGroup(IGrouping<string, AttackEvent> group)
     {
         List<AttackEvent> ordered = group.OrderBy(static attack => attack.Timestamp).ToList();
@@ -48,7 +60,10 @@ internal sealed record AggregatedAttack
             RateLabel = FormatRate(ordered.Count, firstSeen, lastSeen),
             Targets = ordered.Select(static attack => attack.Target).Distinct(StringComparer.OrdinalIgnoreCase).Order().ToList(),
             Usernames = ordered.Select(static attack => attack.Username).Distinct(StringComparer.OrdinalIgnoreCase).Order().ToList(),
-            Sources = ordered.Select(static attack => attack.Source).Distinct(StringComparer.OrdinalIgnoreCase).Order().ToList()
+            Sources = ordered.Select(static attack => attack.Source).Distinct(StringComparer.OrdinalIgnoreCase).Order().ToList(),
+            Services = ordered.Select(static attack => attack.Service).Where(static service => !string.IsNullOrWhiteSpace(service)).Distinct(StringComparer.OrdinalIgnoreCase).Order().ToList(),
+            DestinationPorts = ordered.Select(static attack => attack.DestinationPort).Where(static port => port.HasValue).Select(static port => port!.Value).Distinct().Order().ToList(),
+            Endpoints = ordered.Select(static attack => attack.Endpoint).Where(static endpoint => !string.IsNullOrWhiteSpace(endpoint)).Distinct(StringComparer.OrdinalIgnoreCase).Order().ToList()
         };
     }