CSEC_PUBLIC/hayabusa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

cargo fmt --all

Browse Source
This commit is contained in:
HajimeTakai
2021-05-12 23:19:03 +09:00
parent e504a36d0a
commit 7cd0691764
1 changed files with 26 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
src/detections/detection.rs
View File

@@ -138,20 +138,21 @@ impl Detection {
rules: &Vec<RuleNode>, rules: &Vec<RuleNode>,
) -> Vec<EvtxRecordInfo> { ) -> Vec<EvtxRecordInfo> {
// evtx_parser.records_json()でevtxをxmlに変換するJobを作成 // evtx_parser.records_json()でevtxをxmlに変換するJobを作成
let handles: Vec<JoinHandle<Vec<err::Result<SerializedEvtxRecord<serde_json::Value>>>>> = evtx_parsers let handles: Vec<JoinHandle<Vec<err::Result<SerializedEvtxRecord<serde_json::Value>>>>> =
.into_iter() evtx_parsers
.map(|mut evtx_parser| { .into_iter()
return spawn(async move { .map(|mut evtx_parser| {
let mut parse_config = ParserSettings::default(); return spawn(async move {
parse_config = parse_config.separate_json_attributes(true); let mut parse_config = ParserSettings::default();
parse_config = parse_config.num_threads(utils::get_thread_num()); parse_config = parse_config.separate_json_attributes(true);
parse_config = parse_config.num_threads(utils::get_thread_num());
evtx_parser = evtx_parser.with_configuration(parse_config); evtx_parser = evtx_parser.with_configuration(parse_config);
let values = evtx_parser.records_json_value().collect(); let values = evtx_parser.records_json_value().collect();
return values; return values;
}); });
}) })
.collect(); .collect();
// 作成したjobを実行し(handle.awaitの部分)、スレッドの実行時にエラーが発生した場合、標準エラー出力に出しておく // 作成したjobを実行し(handle.awaitの部分)、スレッドの実行時にエラーが発生した場合、標準エラー出力に出しておく
let mut ret = vec![]; let mut ret = vec![];
@@ -193,20 +194,23 @@ impl Detection {
let record_json = parse_result.unwrap().data; let record_json = parse_result.unwrap().data;
let event_id_opt = utils::get_event_value(&utils::get_event_id_key(), &record_json); let event_id_opt = utils::get_event_value(&utils::get_event_id_key(), &record_json);
let is_exit_eventid = event_id_opt let is_exit_eventid = event_id_opt
.and_then(|event_id| event_id.as_i64()) .and_then(|event_id| event_id.as_i64())
.and_then(|event_id| { .and_then(|event_id| {
if event_id_set.contains(&event_id) { if event_id_set.contains(&event_id) {
return Option::Some(&record_json); return Option::Some(&record_json);
} else { } else {
return Option::None; return Option::None;
} }
}); });
if is_exit_eventid.is_none() { if is_exit_eventid.is_none() {
return Option::None; return Option::None;
} }
let evtx_filepath = evtx_files[parser_idx].display().to_string(); let evtx_filepath = evtx_files[parser_idx].display().to_string();
let record_info = EvtxRecordInfo{ evtx_filepath: evtx_filepath, record: record_json}; let record_info = EvtxRecordInfo {
evtx_filepath: evtx_filepath,
record: record_json,
};
return Option::Some(record_info); return Option::Some(record_info);
}) })
.collect(); .collect();