removed comment outted unnecessary line
This commit is contained in:
@@ -673,6 +673,7 @@ mod tests {
|
|||||||
},
|
},
|
||||||
expect_time,
|
expect_time,
|
||||||
&mut profile_converter,
|
&mut profile_converter,
|
||||||
|
false,
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
let expect =
|
let expect =
|
||||||
|
|||||||
@@ -330,6 +330,7 @@ impl Detection {
|
|||||||
detect_info,
|
detect_info,
|
||||||
time,
|
time,
|
||||||
&mut profile_converter,
|
&mut profile_converter,
|
||||||
|
false,
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -398,7 +399,6 @@ impl Detection {
|
|||||||
}
|
}
|
||||||
|
|
||||||
let detect_info = DetectInfo {
|
let detect_info = DetectInfo {
|
||||||
// filepath: "-".to_owned(),
|
|
||||||
rulepath: (&rule.rulepath).to_owned(),
|
rulepath: (&rule.rulepath).to_owned(),
|
||||||
level: rule.yaml["level"].as_str().unwrap_or("").to_owned(),
|
level: rule.yaml["level"].as_str().unwrap_or("").to_owned(),
|
||||||
computername: "-".to_owned(),
|
computername: "-".to_owned(),
|
||||||
@@ -414,6 +414,7 @@ impl Detection {
|
|||||||
detect_info,
|
detect_info,
|
||||||
agg_result.start_timedate,
|
agg_result.start_timedate,
|
||||||
&mut profile_converter,
|
&mut profile_converter,
|
||||||
|
true,
|
||||||
)
|
)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -133,17 +133,19 @@ pub fn insert(
|
|||||||
mut detect_info: DetectInfo,
|
mut detect_info: DetectInfo,
|
||||||
time: DateTime<Utc>,
|
time: DateTime<Utc>,
|
||||||
profile_converter: &mut HashMap<String, String>,
|
profile_converter: &mut HashMap<String, String>,
|
||||||
|
is_agg: bool,
|
||||||
) {
|
) {
|
||||||
let parsed_detail = parse_message(event_record, &output)
|
if !is_agg {
|
||||||
.chars()
|
let parsed_detail = parse_message(event_record, &output)
|
||||||
.filter(|&c| !c.is_control())
|
.chars()
|
||||||
.collect::<String>();
|
.filter(|&c| !c.is_control())
|
||||||
|
.collect::<String>();
|
||||||
detect_info.detail = if parsed_detail.is_empty() {
|
detect_info.detail = if parsed_detail.is_empty() {
|
||||||
"-".to_string()
|
"-".to_string()
|
||||||
} else {
|
} else {
|
||||||
parsed_detail
|
parsed_detail
|
||||||
};
|
};
|
||||||
|
}
|
||||||
let mut exist_detail = false;
|
let mut exist_detail = false;
|
||||||
PROFILES.as_ref().unwrap().iter().for_each(|(_k, v)| {
|
PROFILES.as_ref().unwrap().iter().for_each(|(_k, v)| {
|
||||||
if v.contains("%Details%") {
|
if v.contains("%Details%") {
|
||||||
|
|||||||
Reference in New Issue
Block a user