CSEC_PUBLIC/hayabusa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #728 from Yamato-Security/feature/463-statistics-add-channel

Browse Source 
Feature/463 statistics add channel
This commit is contained in:
DustInDark
2022-10-05 20:18:50 +09:00
committed by GitHub
parent 9be55a76c7 da3ae2e650
commit 2427d9507b
7 changed files with 48 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
CHANGELOG-Japanese.md
View File

@@ -1,5 +1,11 @@
# 変更点
## 1.7.1 [2022/xx/xx]
**バグ修正:**
- より正確な結果を出力するために、チャンネルとEIDの情報を`rules/config/channel_eid_info.txt`に基づいてチェックするようにした。 (#463) (@garigariganzy)
## 1.7.0 [2022/09/29]
**新機能:**

6
CHANGELOG.md
View File

@@ -1,5 +1,11 @@
# Changes
## 1.7.1 [2022/xx/xx]
**Bug Fixes:**
- Hayabusa now checks Channel and EID information based on `rules/config/channel_eid_info.txt` to provide more accurate results. (#463) (@garigariganzy)
## 1.7.0 [2022/09/29]
**New Features:**

34
Cargo.lock generated
View File

@@ -310,26 +310,24 @@ dependencies = [
[[package]]
name = "crossbeam-epoch"
version = "0.9.10"
version = "0.9.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "045ebe27666471bb549370b4b0b3e51b07f56325befa4284db65fc89c02511b1"
checksum = "f916dfc5d356b0ed9dae65f1db9fc9770aa2851d2662b988ccf4fe3516e86348"
dependencies = [
"autocfg",
"cfg-if",
"crossbeam-utils",
"memoffset",
"once_cell",
"scopeguard",
]
[[package]]
name = "crossbeam-utils"
version = "0.8.11"
version = "0.8.12"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "51887d4adc7b564537b15adcfb307936f8075dfcd5f00dde9a9f1d29383682bc"
checksum = "edbafec5fa1f196ca66527c1b12c2ec4745ca14b50f1ad8f9f6f720b55d11fac"
dependencies = [
"cfg-if",
"once_cell",
]
[[package]]
@@ -746,7 +744,7 @@ dependencies = [
[[package]]
name = "hayabusa"
version = "1.7.0"
version = "1.7.1-dev"
dependencies = [
"base64",
"bytesize",
@@ -999,9 +997,9 @@ checksum = "6c8af84674fe1f223a982c933a0ee1086ac4d4052aa0fb8060c12c6ad838e754"
[[package]]
name = "jemalloc-sys"
version = "0.5.1+5.3.0-patched"
version = "0.5.2+5.3.0-patched"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b7c2b313609b95939cb0c5a5c6917fb9b7c9394562aa3ef44eb66ffa51736432"
checksum = "134163979b6eed9564c98637b710b40979939ba351f59952708234ea11b5f3f8"
dependencies = [
"cc",
"fs_extra",
@@ -1063,9 +1061,9 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
[[package]]
name = "libc"
version = "0.2.133"
version = "0.2.134"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c0f80d65747a3e43d1596c7c5492d95d5edddaabd45a7fcdb02b95f644164966"
checksum = "329c933548736bc49fd575ee68c89e8be4d260064184389a5b77517cddd99ffb"
[[package]]
name = "libgit2-sys"
@@ -1436,9 +1434,9 @@ checksum = "dbf0c48bc1d91375ae5c3cd81e3722dff1abcf81a30960240640d223f59fe0e5"
[[package]]
name = "proc-macro2"
version = "1.0.45"
version = "1.0.46"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3edcd08cf4fea98d1ae6c9ddd3b8ccb1acac7c3693d62625969a7daa04a2ae36"
checksum = "94e2ef8dbfc347b10c094890f778ee2e36ca9bb4262e86dc99cd217e35f3470b"
dependencies = [
"unicode-ident",
]
@@ -1834,7 +1832,7 @@ checksum = "48dfff04aade74dd495b007c831cd6f4e0cee19c344dd9dc0884c0289b70a786"
dependencies = [
"log",
"termcolor",
"time 0.3.14",
"time 0.3.15",
]
[[package]]
@@ -1863,9 +1861,9 @@ dependencies = [
[[package]]
name = "smallvec"
version = "1.9.0"
version = "1.10.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2fd0db749597d91ff862fd1d55ea87f7855a744a8425a64695b6fca237d1dad1"
checksum = "a507befe795404456341dfab10cef66ead4c041f62b8b11bbb92bffe5d0953e0"
[[package]]
name = "socket2"
@@ -2074,9 +2072,9 @@ dependencies = [
[[package]]
name = "time"
version = "0.3.14"
version = "0.3.15"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3c3f9a28b618c3a6b9251b6908e9c99e04b9e5c02e6581ccbb67d59c34ef7f9b"
checksum = "d634a985c4d4238ec39cacaed2e7ae552fbd3c476b552c1deac3021b7d7eaf0c"
dependencies = [
"itoa 1.0.3",
"libc",

2
Cargo.toml
View File

@@ -1,6 +1,6 @@
[package]
name = "hayabusa"
version = "1.7.0"
version = "1.7.1-dev"
authors = ["Yamato Security @SecurityYamato"]
edition = "2021"

2
rules

Submodule rules updated: 28c1de3279...a8c2008331

25
src/detections/configs.rs
View File

@@ -269,11 +269,11 @@ impl ConfigReader<'_> {
args: parse.clone(),
headless_help: String::default(),
event_timeline_config: load_eventcode_info(
utils::check_setting_path(&parse.config, "event_id_info.txt", false)
utils::check_setting_path(&parse.config, "channel_eid_info.txt", false)
.unwrap_or_else(|| {
utils::check_setting_path(
&CURRENT_EXE_PATH.to_path_buf(),
"rules/config/event_id_info.txt",
"rules/config/channel_eid_info.txt",
true,
)
.unwrap()
@@ -555,7 +555,7 @@ impl EventInfo {
}
#[derive(Debug, Clone)]
pub struct EventInfoConfig {
eventinfo: HashMap<String, EventInfo>,
eventinfo: HashMap<(String, String), EventInfo>,
}
impl Default for EventInfoConfig {
@@ -570,8 +570,9 @@ impl EventInfoConfig {
eventinfo: HashMap::new(),
}
}
pub fn get_event_id(&self, eventid: &str) -> Option<&EventInfo> {
self.eventinfo.get(eventid)
pub fn get_event_id(&self, channel: &str, eventid: &str) -> Option<&EventInfo> {
self.eventinfo
.get(&(channel.to_string(), eventid.to_string()))
}
}
@@ -586,19 +587,21 @@ fn load_eventcode_info(path: &str) -> EventInfoConfig {
// event_id_info.txtが読み込めなかったらエラーで終了とする。
read_result.unwrap().into_iter().for_each(|line| {
if line.len() != 2 {
if line.len() != 3 {
return;
}
let empty = &"".to_string();
let eventcode = line.get(0).unwrap_or(empty);
let event_title = line.get(1).unwrap_or(empty);
let channel = line.get(0).unwrap_or(empty);
let eventcode = line.get(1).unwrap_or(empty);
let event_title = line.get(2).unwrap_or(empty);
infodata = EventInfo {
evttitle: event_title.to_string(),
};
config
.eventinfo
.insert(eventcode.to_owned(), infodata.to_owned());
config.eventinfo.insert(
(channel.to_owned(), eventcode.to_owned()),
infodata.to_owned(),
);
});
config
}

7
src/timeline/timelines.rs
View File

@@ -139,16 +139,17 @@ impl Timeline {
// 件数の割合を算出
let rate: f32 = **event_cnt as f32 / self.stats.total as f32;
let fmted_channel = channel.replace('\"', "");
// イベント情報取得(eventtitleなど)
let conf = CONFIG
.read()
.unwrap()
.event_timeline_config
.get_event_id(event_id)
.get_event_id(&fmted_channel, event_id)
.is_some();
// event_id_info.txtに登録あるものは情報設定
// 出力メッセージ1行作成
let fmted_channel = channel.replace('\"', "");
let ch = CH_CONFIG
.get(fmted_channel.to_lowercase().as_str())
.unwrap_or(&fmted_channel)
@@ -163,7 +164,7 @@ impl Timeline {
.read()
.unwrap()
.event_timeline_config
.get_event_id(event_id)
.get_event_id(&fmted_channel, event_id)
.unwrap()
.evttitle
.to_string(),