CSEC_PUBLIC/hayabusa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #59 from YamatoSecurity/feature/issue#57

Browse Source 
Feature/issue#57
This commit is contained in:
ichiichi
2021-02-27 11:15:29 +09:00
committed by GitHub
parent 382a48edfc 4f42e21529
commit 7f99dadcb4
3 changed files with 13 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/afterfact.rs
View File

@@ -85,10 +85,8 @@ fn test_emit_csv() {
"CommandLine": "hoge"
},
"System": {
"TimeCreated": {
"#attributes":{
"SystemTime": "1996-02-27T01:05:01Z"
}
"TimeCreated_attributes": {
"SystemTime": "1996-02-27T01:05:01Z"
}
}
}

5
src/detections/detection.rs
View File

@@ -5,7 +5,7 @@ use crate::detections::rule;
use crate::detections::rule::RuleNode;
use crate::yaml::ParseYaml;
use evtx::err;
use evtx::{EvtxParser, SerializedEvtxRecord};
use evtx::{EvtxParser, ParserSettings, SerializedEvtxRecord};
use serde_json::{Error, Value};
use std::path::PathBuf;
@@ -66,6 +66,9 @@ impl Detection {
}
})
.map(|mut cur| {
let mut parse_config = ParserSettings::default();
parse_config = parse_config.separate_json_attributes(true);
cur = cur.with_configuration(parse_config);
let ret: Vec<err::Result<SerializedEvtxRecord<String>>> =
cur.records_json().collect();
return ret;

21
src/detections/print.rs
View File

@@ -120,8 +120,7 @@ impl Message {
}
fn get_event_time(event_record: &Value) -> Option<DateTime<Utc>> {
let system_time =
&event_record["Event"]["System"]["TimeCreated"]["#attributes"]["SystemTime"];
let system_time = &event_record["Event"]["System"]["TimeCreated_attributes"]["SystemTime"];
let system_time_str = system_time.as_str().unwrap_or("");
if system_time_str.is_empty() {
return Option::None;
@@ -157,10 +156,8 @@ mod tests {
"CommandLine": "hoge"
},
"System": {
"TimeCreated": {
"#attributes":{
"SystemTime": "1996-02-27T01:05:01Z"
}
"TimeCreated_attributes": {
"SystemTime": "1996-02-27T01:05:01Z"
}
}
}
@@ -180,10 +177,8 @@ mod tests {
"CommandLine": "hoge"
},
"System": {
"TimeCreated": {
"#attributes":{
"SystemTime": "1996-02-27T01:05:01Z"
}
"TimeCreated_attributes": {
"SystemTime": "1996-02-27T01:05:01Z"
}
}
}
@@ -203,10 +198,8 @@ mod tests {
"CommandLine": "hoge"
},
"System": {
"TimeCreated": {
"#attributes":{
"SystemTime": "2000-01-21T09:06:01Z"
}
"TimeCreated_attributes": {
"SystemTime": "2000-01-21T09:06:01Z"
}
}
}