CSEC_PUBLIC/hayabusa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

changed treat of suffix in data #487

Browse Source
This commit is contained in:
DustInDark
2022-06-09 01:16:27 +09:00
parent 7332a774be
commit 4f0bd67ca9
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/detections/print.rs
View File

@@ -177,11 +177,11 @@ impl Message {
Some(cap) => cap.get(1).map_or(-1, |a| a.as_str().parse().unwrap_or(-1)),
None => -1,
};
if suffix >= 0 {
if suffix >= 1 {
tmp_event_record = tmp_event_record
.get("Data")
.unwrap()
.get(suffix as usize)
.get((suffix - 1) as usize)
.unwrap_or(tmp_event_record);
}
let hash_value = get_serde_number_to_string(tmp_event_record);
@@ -614,7 +614,7 @@ mod tests {
assert_eq!(
message.parse_message(
&event_record,
"commandline:%CommandLine% data:%Data[1]%".to_owned()
"commandline:%CommandLine% data:%Data[2]%".to_owned()
),
expected,
);
@@ -647,7 +647,7 @@ mod tests {
assert_eq!(
message.parse_message(
&event_record,
"commandline:%CommandLine% data:%Data[-1]%".to_owned()
"commandline:%CommandLine% data:%Data[0]%".to_owned()
),
expected,
);