Feature/output read rule directory#201 (#221)
* fixed filepath evtx extension #162 * added rules option to config usage #201 * fixed filepath evtx extension rule #162 * added rules directory read feature #201 * added test case #201 * fixed usage set #201 * removed all check rule #201 * fixed rule read function data #201
This commit is contained in:
@@ -47,10 +47,10 @@ impl Detection {
|
||||
}
|
||||
|
||||
// ルールファイルをパースします。
|
||||
pub fn parse_rule_files(level: String) -> Vec<RuleNode> {
|
||||
pub fn parse_rule_files(level: String, rulespath: Option<&str>) -> Vec<RuleNode> {
|
||||
// ルールファイルのパースを実行
|
||||
let mut rulefile_loader = ParseYaml::new();
|
||||
let result_readdir = rulefile_loader.read_dir(DIRPATH_RULES, &level);
|
||||
let result_readdir = rulefile_loader.read_dir(rulespath.unwrap_or(DIRPATH_RULES), &level);
|
||||
if result_readdir.is_err() {
|
||||
AlertMessage::alert(
|
||||
&mut std::io::stderr().lock(),
|
||||
@@ -202,3 +202,11 @@ impl Detection {
|
||||
return ret;
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_parse_rule_files() {
|
||||
let level = "INFO";
|
||||
let opt_rule_path = Some("./test_files/rules/level_yaml");
|
||||
let cole = Detection::parse_rule_files(level.to_owned(), opt_rule_path);
|
||||
assert_eq!(5, cole.len());
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user