Feature/output read rule directory#201 (#221)

* fixed filepath evtx extension #162

* added rules option to config usage #201

* fixed filepath evtx extension rule #162

* added rules directory read feature #201

* added test case #201

* fixed usage set #201

* removed all check rule #201

* fixed rule read function data #201
This commit is contained in:
DustInDark
2021-11-20 14:01:50 +09:00
committed by GitHub
parent 0b85a280f0
commit 86321a4502
5 changed files with 17 additions and 5 deletions

View File

@@ -47,10 +47,10 @@ impl Detection {
}
// ルールファイルをパースします。
pub fn parse_rule_files(level: String) -> Vec<RuleNode> {
pub fn parse_rule_files(level: String, rulespath: Option<&str>) -> Vec<RuleNode> {
// ルールファイルのパースを実行
let mut rulefile_loader = ParseYaml::new();
let result_readdir = rulefile_loader.read_dir(DIRPATH_RULES, &level);
let result_readdir = rulefile_loader.read_dir(rulespath.unwrap_or(DIRPATH_RULES), &level);
if result_readdir.is_err() {
AlertMessage::alert(
&mut std::io::stderr().lock(),
@@ -202,3 +202,11 @@ impl Detection {
return ret;
}
}
#[test]
fn test_parse_rule_files() {
let level = "INFO";
let opt_rule_path = Some("./test_files/rules/level_yaml");
let cole = Detection::parse_rule_files(level.to_owned(), opt_rule_path);
assert_eq!(5, cole.len());
}