diff --git a/src/detections/configs.rs b/src/detections/configs.rs index 883d7858..ff6f3ac9 100644 --- a/src/detections/configs.rs +++ b/src/detections/configs.rs @@ -32,6 +32,8 @@ lazy_static! { pub static ref TERM_SIZE: Option<(Width, Height)> = terminal_size(); pub static ref TARGET_EXTENSIONS: HashSet = get_target_extensions(CONFIG.read().unwrap().args.evtx_file_ext.as_ref()); + pub static ref EXCLUDE_STATUS: HashSet = + convert_option_vecs_to_hs(CONFIG.read().unwrap().args.exclude_status.as_ref()); } pub struct ConfigReader<'a> { @@ -211,6 +213,10 @@ pub struct Config { /// Specify additional target file extensions (ex: evtx_data) (ex: evtx1 evtx2) #[clap(long = "target-file-ext", multiple_values = true)] pub evtx_file_ext: Option>, + + /// Exclude by status level (ex: expreimental test) + #[clap(long = "exclude-status", multiple_values = true)] + pub exclude_status: Option>, } impl ConfigReader<'_> { @@ -461,12 +467,17 @@ pub fn load_pivot_keywords(path: &str) { /// --target-file-extで追加された拡張子から、調査対象ファイルの拡張子セットを返す関数 pub fn get_target_extensions(arg: Option<&Vec>) -> HashSet { - let mut target_file_extensions: HashSet = - arg.unwrap_or(&Vec::new()).iter().cloned().collect(); + let mut target_file_extensions: HashSet = convert_option_vecs_to_hs(arg); target_file_extensions.insert(String::from("evtx")); target_file_extensions } +/// Option>の内容をHashSetに変換する関数 +pub fn convert_option_vecs_to_hs(arg: Option<&Vec>) -> HashSet { + let ret: HashSet = arg.unwrap_or(&Vec::new()).iter().cloned().collect(); + ret +} + #[derive(Debug, Clone)] pub struct EventInfo { pub evttitle: String, diff --git a/src/yaml.rs b/src/yaml.rs index 49c1ba12..d47468e3 100644 --- a/src/yaml.rs +++ b/src/yaml.rs @@ -2,9 +2,9 @@ extern crate serde_derive; extern crate yaml_rust; use crate::detections::configs; +use crate::detections::configs::EXCLUDE_STATUS; use crate::detections::print::AlertMessage; -use crate::detections::print::ERROR_LOG_STACK; -use crate::detections::print::QUIET_ERRORS_FLAG; +use crate::detections::print::{ERROR_LOG_STACK, QUIET_ERRORS_FLAG}; use crate::filter::RuleExclude; use hashbrown::HashMap; use std::ffi::OsStr; @@ -237,6 +237,18 @@ impl ParseYaml { } } + let status = &yaml_doc["status"].as_str(); + if let Some(s) = status { + if EXCLUDE_STATUS.contains(&s.to_string()) { + let entry = self + .rule_load_cnt + .entry("excluded".to_string()) + .or_insert(0); + *entry += 1; + return Option::None; + } + } + self.rulecounter.insert( yaml_doc["ruletype"].as_str().unwrap_or("Other").to_string(), self.rulecounter