Added Security Center, Unittest, builds and refactored

[UncleBats]

• Added security center so it will work in the same way for the new continuous export to the event hub.
• Refactored into more flow orientated structure, compared to the previous technical structure.
• Replaced the dependent HOME environmental variable with the FunctionAppDirectory from the function context. (HOME environmental existed on the hosted build server so tests would fail otherwise)
• Added some simple translation unit-test to be sure I didn't knock anything over
• Added YAML build pipeline
• Fixed some bugs and unused code

[msftclas]

All CLA requirements met.

[sebastus]

Thanks very much for the contribution, @ErickSegaar. As it's changing/adding quite a number of files, it'll take a bit to review it all. Any recommendations on the best way to proceed through it all?

[UncleBats]

@sebastus My thoughts on the matter are the following:

• Refactored into event hub processing eg (activity, diagnostic, metrics). Shouldn't be changed much, naming is consistent with original except added the type
• Changed the way the categories.json worked. There was code depending on a HOME variable, that gave some trouble with debugging and testing local and using the build server. Didn't like having specific code just for testing in the solution so changed it in SplunkEventMessages Ctor
• Added SecurityCenterLogs based upon the Diagnostic logs (didn't change your deployment template (using a terraform option instead of the azure template, should add additional security hub in the infra)
• Fixed the Metrics to use the metrics classes instead of the Diagnostic classes ( var azMonMsg = new AzMonDiagnosticLog(expandoRecord); ==> var azMonMsg = new Metric(expandoRecord);)
• Added the Yaml build
• I am running the total solution now with 2.7 mil events a minute works like a charm, haven't done anything with the Windows and Linux VM so didn't test that.
• Sorry for the big dump, had a lot of trouble with the HOME variable in the end and basically squashed my commits, could have better only squashed the changes for the variable. Wrote a little Down the rabbit hole blog on it to :).

[sebastus]

Erick - would you contact me offline? golive@microsoft.com.