diff --git a/wela-extractor/src/main.rs b/wela-extractor/src/main.rs index f2edee63..5927eed6 100644 --- a/wela-extractor/src/main.rs +++ b/wela-extractor/src/main.rs @@ -88,6 +88,7 @@ fn parse_yaml(doc: Yaml, eid_subcategory_pair: &Vec<(String, String)>) -> Option })); } else if let Some(tags) = doc["tags"].as_vec() { if !tags.contains(&Yaml::from_str("sysmon")) { + extract_event_ids(&doc, &mut event_ids); subcategories.insert("00000000-0000-0000-0000-000000000000".to_string()); let event_ids: Vec = event_ids.into_iter().collect(); let subcategories: Vec = subcategories.into_iter().collect();