Limit uploaded event details

config/ocsentinel-settings.example.json

@@ -1,5 +1,6 @@
 {
   "warningEventThreshold": 10,
+  "maxReportedEvents": 1000,
   "criticalEventThreshold": 30,
   "warningUniqueIpThreshold": 5,
   "criticalUniqueIpThreshold": 12,

src/OCSentinelCli/AttackScanner.cs

@@ -53,6 +53,14 @@ internal sealed class AttackScanner
 
         attacks.Sort(static (left, right) => left.Timestamp.CompareTo(right.Timestamp));
 
+        int totalEventCount = attacks.Count;
+        int maxReportedEvents = Math.Clamp(configuration.MaxReportedEvents, 100, 5000);
+        List<AttackEvent> reportedEvents = attacks
+            .OrderByDescending(static attack => attack.Timestamp)
+            .Take(maxReportedEvents)
+            .OrderBy(static attack => attack.Timestamp)
+            .ToList();
+
         List<AggregatedAttack> topSources = attacks
             .GroupBy(static attack => attack.SourceIp)
             .Select(group => AggregatedAttack.FromGroup(group))
@@ -81,7 +89,9 @@ internal sealed class AttackScanner
             GeneratedAtUtc = generatedAtUtc,
             ClientVersion = BuildMetadata.Version,
             LookbackDays = options.LookbackDays,
-            TotalEvents = attacks.Count,
+            TotalEvents = totalEventCount,
+            ReportedEventCount = reportedEvents.Count,
+            EventsTruncated = reportedEvents.Count < totalEventCount,
             UniqueIpCount = uniqueIpCount,
             AlertState = correlationAssessment.FinalAlertState,
             AlertReason = correlationAssessment.CorrelationReason == "No CVE correlation applied." ? baseAlertReason : correlationAssessment.CorrelationReason,
@@ -95,7 +105,7 @@ internal sealed class AttackScanner
                 FinishedAtUtc = generatedAtUtc,
                 UploadAttempted = false
             },
-            Events = attacks,
+            Events = reportedEvents,
             TopSources = topSources,
             Errors = errors
         };

src/OCSentinelCli/Configuration.cs

@@ -6,6 +6,8 @@ internal sealed record ScannerConfiguration
 {
     public int WarningEventThreshold { get; init; } = 10;
 
+    public int MaxReportedEvents { get; init; } = 1000;
+
     public int CriticalEventThreshold { get; init; } = 30;
 
     public int WarningUniqueIpThreshold { get; init; } = 5;

src/OCSentinelCli/Models.cs

@@ -107,6 +107,10 @@ internal sealed record ScanResult
 
     public int TotalEvents { get; init; }
 
+    public int ReportedEventCount { get; init; }
+
+    public bool EventsTruncated { get; init; }
+
     public int UniqueIpCount { get; init; }
 
     public string AlertState { get; init; } = "ok";

src/OCSentinelCli/OCSentinelCli.csproj

@@ -9,10 +9,10 @@
     <RootNamespace>OCSentinelCli</RootNamespace>
     <Product>OfficeCom Sentinel</Product>
     <Company>OfficeCom</Company>
-    <Version>1.5.0-beta.6</Version>
+    <Version>1.5.0-beta.7</Version>
     <AssemblyVersion>1.5.0.0</AssemblyVersion>
     <FileVersion>1.5.0.0</FileVersion>
-    <InformationalVersion>1.5.0-beta.6</InformationalVersion>
+    <InformationalVersion>1.5.0-beta.7</InformationalVersion>
   </PropertyGroup>
 
   <ItemGroup>