CSEC_PUBLIC/hayabusa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

changed treat of suffix in data #487

Browse Source
This commit is contained in:
DustInDark
2022-06-09 01:16:27 +09:00
parent 7332a774be
commit 4f0bd67ca9
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/detections/print.rs
+4 -4
View File
@@ -177,11 +177,11 @@ impl Message {
Some(cap) => cap.get(1).map_or(-1, |a| a.as_str().parse().unwrap_or(-1)), Some(cap) => cap.get(1).map_or(-1, |a| a.as_str().parse().unwrap_or(-1)),
None => -1, None => -1,
}; };
if suffix >= 0 { if suffix >= 1 {
tmp_event_record = tmp_event_record tmp_event_record = tmp_event_record
.get("Data") .get("Data")
.unwrap() .unwrap()
.get(suffix as usize) .get((suffix - 1) as usize)
.unwrap_or(tmp_event_record); .unwrap_or(tmp_event_record);
} }
let hash_value = get_serde_number_to_string(tmp_event_record); let hash_value = get_serde_number_to_string(tmp_event_record);
@@ -614,7 +614,7 @@ mod tests {
assert_eq!( assert_eq!(
message.parse_message( message.parse_message(
&event_record, &event_record,
"commandline:%CommandLine% data:%Data[1]%".to_owned() "commandline:%CommandLine% data:%Data[2]%".to_owned()
), ),
expected, expected,
); );
@@ -647,7 +647,7 @@ mod tests {
assert_eq!( assert_eq!(
message.parse_message( message.parse_message(
&event_record, &event_record,
"commandline:%CommandLine% data:%Data[-1]%".to_owned() "commandline:%CommandLine% data:%Data[0]%".to_owned()
), ),
expected, expected,
); );