diff --git a/CHANGELOG-Japanese.md b/CHANGELOG-Japanese.md index 87180caa..e9398d53 100644 --- a/CHANGELOG-Japanese.md +++ b/CHANGELOG-Japanese.md @@ -11,6 +11,7 @@ - 結果概要に各レベルで検知した上位5つのルールを表示するようにした。 (#667) (@hitenkoku) - 結果概要を出力しないようにするために `--no-summary` オプションを追加した。 (#672) (@hitenkoku) - 結果概要の表示を短縮させた。 (#675 #678) (@hitenkoku) +- channel_abbreviations.txtによるChannelフィールドのチェックを大文字小文字の区別をなくした。 (#685) (@hitenkoku) **バグ修正:** diff --git a/CHANGELOG.md b/CHANGELOG.md index 4b02f742..cd145245 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ - Added top alerts to results summary. (#667) (@hitenkoku) - Added `--no-summary` option to not display the results summary. (#672) (@hitenkoku) - Made the results summary more compact. (#675 #678) (@hitenkoku) +- Made Channel field in channel_abbreviations.txt case-insensitive. (#685) (@hitenkoku) **Bug Fixes:** diff --git a/src/afterfact.rs b/src/afterfact.rs index 076e5578..4bf61ee6 100644 --- a/src/afterfact.rs +++ b/src/afterfact.rs @@ -795,7 +795,7 @@ mod tests { ( "%Channel%".to_owned(), mock_ch_filter - .get("Security") + .get(&"Security".to_ascii_lowercase()) .unwrap_or(&String::default()) .to_string(), ), diff --git a/src/detections/detection.rs b/src/detections/detection.rs index 2f4e6207..75e801de 100644 --- a/src/detections/detection.rs +++ b/src/detections/detection.rs @@ -264,7 +264,10 @@ impl Detection { "%Channel%" => { profile_converter.insert( "%Channel%".to_string(), - CH_CONFIG.get(ch_str).unwrap_or(ch_str).to_string(), + CH_CONFIG + .get(&ch_str.to_ascii_lowercase()) + .unwrap_or(ch_str) + .to_string(), ); } "%Level%" => { diff --git a/src/detections/message.rs b/src/detections/message.rs index e3a3d235..fa374282 100644 --- a/src/detections/message.rs +++ b/src/detections/message.rs @@ -105,10 +105,10 @@ pub fn create_output_filter_config(path: &str) -> HashMap { return; } - let tag_full_str = line[0].trim(); + let tag_full_str = line[0].trim().to_ascii_lowercase(); let tag_replace_str = line[1].trim(); - ret.insert(tag_full_str.to_owned(), tag_replace_str.to_owned()); + ret.insert(tag_full_str, tag_replace_str.to_owned()); }); ret } @@ -599,7 +599,7 @@ mod tests { let actual = create_output_filter_config("test_files/config/channel_abbreviations.txt"); let actual2 = create_output_filter_config("test_files/config/channel_abbreviations.txt"); let expected: HashMap = HashMap::from([ - ("Security".to_string(), "Sec".to_string()), + ("Security".to_ascii_lowercase(), "Sec".to_string()), ("xxx".to_string(), "yyy".to_string()), ]); _check_hashmap_element(&expected, actual);