diff --git a/src/detections/security.rs b/src/detections/security.rs index e4d9a07c..6c40b07f 100644 --- a/src/detections/security.rs +++ b/src/detections/security.rs @@ -201,7 +201,7 @@ impl Security { // see fn disp() self.total_failed_logons += 1; let username = event_data.get("TargetUserName").unwrap_or(&self.empty_str); - let failed_cnt = self.account_2_failedcnt.get(username).unwrap_or(&0) + &1; + let failed_cnt = self.account_2_failedcnt.get(username).unwrap_or(&0) + 1; self.account_2_failedcnt .insert(username.to_string(), failed_cnt); } diff --git a/src/models/event.rs b/src/models/event.rs index 8234e430..aaea9312 100644 --- a/src/models/event.rs +++ b/src/models/event.rs @@ -1,133 +1,133 @@ -extern crate serde; -use serde::Deserialize; -use std::collections::HashMap; - -#[derive(Debug, Deserialize, PartialEq)] -pub struct Data { - #[serde(rename = "Name")] - pub name: Option, - #[serde(rename = "$value")] - pub text: Option, -} - -#[derive(Debug, Deserialize, PartialEq)] -pub struct TimeCreated { - #[serde(rename = "SystemTime")] - pub system_time: String, -} - -#[derive(Debug, Deserialize, PartialEq)] -struct Execution { - #[serde(rename = "ProcessID")] - process_id: i32, - #[serde(rename = "ThreadID")] - thread_id: i32, -} - -#[derive(Debug, Deserialize, PartialEq)] -pub struct Provider { - #[serde(rename = "Name")] - pub name: Option, - #[serde(rename = "Guid")] - guid: Option, -} - -#[derive(Debug, Deserialize, PartialEq)] -pub struct System { - #[serde(rename = "Provider")] - pub provider: Provider, - #[serde(rename = "EventID")] - pub event_id: String, - #[serde(rename = "Version")] - version: Option, - #[serde(rename = "Level")] - level: String, - #[serde(rename = "Task")] - task: String, - #[serde(rename = "Opcode")] - opcode: Option, - #[serde(rename = "Keywords")] - keywords: String, - #[serde(rename = "TimeCreated")] - pub time_created: TimeCreated, - #[serde(rename = "EventRecordID")] - pub event_record_id: String, - #[serde(rename = "Correlation")] - correlation: Option, - #[serde(rename = "Execution")] - execution: Option, - #[serde(rename = "Channel")] - pub channel: String, // Security, System, Application ...etc - #[serde(rename = "Computer")] - computer: String, - #[serde(rename = "Security")] - security: String, - #[serde(rename = "Message")] - pub message: Option, -} - -#[derive(Debug, Deserialize, PartialEq)] -pub struct EventData { - #[serde(rename = "Data")] - pub data: Option>, -} - -#[derive(Debug, Deserialize, PartialEq)] -pub struct UserData { - #[serde(rename = "LogFileCleared")] - pub log_file_cleared: Option, -} - -#[derive(Debug, Deserialize, PartialEq)] -pub struct LogFileCleared { - #[serde(rename = "SubjectUserSid")] - pub subject_user_sid: Option, - #[serde(rename = "SubjectUserName")] - pub subject_user_name: Option, - #[serde(rename = "SubjectDomainName")] - pub subject_domain_name: Option, - #[serde(rename = "SubjectLogonId")] - pub subject_logon_id: Option, -} - -#[derive(Debug, Deserialize, PartialEq)] -pub struct Evtx { - #[serde(rename = "System")] - pub system: System, - #[serde(rename = "EventData")] - pub event_data: Option, - #[serde(rename = "UserData")] - pub user_data: Option, -} - -impl Evtx { - // - // 文字列データを取得する - // - fn get_string(v: &Data) -> String { - let mut ret = "".to_string(); - if let Some(text) = &v.text { - ret = text.to_string(); - } - return ret; - } - - // - // EventDataをHashMapとして取得する - // - pub fn parse_event_data(&self) -> HashMap { - let mut values = HashMap::new(); - - if let Some(event_data) = &self.event_data { - if let Some(data) = &event_data.data { - for v in data.iter() { - if let Some(name) = &v.name { - values.insert(name.to_string(), Evtx::get_string(v)); - } - } - } - } - - values - } -} +extern crate serde; +use serde::Deserialize; +use std::collections::HashMap; + +#[derive(Debug, Deserialize, PartialEq)] +pub struct Data { + #[serde(rename = "Name")] + pub name: Option, + #[serde(rename = "$value")] + pub text: Option, +} + +#[derive(Debug, Deserialize, PartialEq)] +pub struct TimeCreated { + #[serde(rename = "SystemTime")] + pub system_time: String, +} + +#[derive(Debug, Deserialize, PartialEq)] +struct Execution { + #[serde(rename = "ProcessID")] + process_id: i32, + #[serde(rename = "ThreadID")] + thread_id: i32, +} + +#[derive(Debug, Deserialize, PartialEq)] +pub struct Provider { + #[serde(rename = "Name")] + pub name: Option, + #[serde(rename = "Guid")] + guid: Option, +} + +#[derive(Debug, Deserialize, PartialEq)] +pub struct System { + #[serde(rename = "Provider")] + pub provider: Provider, + #[serde(rename = "EventID")] + pub event_id: String, + #[serde(rename = "Version")] + version: Option, + #[serde(rename = "Level")] + level: String, + #[serde(rename = "Task")] + task: String, + #[serde(rename = "Opcode")] + opcode: Option, + #[serde(rename = "Keywords")] + keywords: String, + #[serde(rename = "TimeCreated")] + pub time_created: TimeCreated, + #[serde(rename = "EventRecordID")] + pub event_record_id: String, + #[serde(rename = "Correlation")] + correlation: Option, + #[serde(rename = "Execution")] + execution: Option, + #[serde(rename = "Channel")] + pub channel: String, // Security, System, Application ...etc + #[serde(rename = "Computer")] + computer: String, + #[serde(rename = "Security")] + security: String, + #[serde(rename = "Message")] + pub message: Option, +} + +#[derive(Debug, Deserialize, PartialEq)] +pub struct EventData { + #[serde(rename = "Data")] + pub data: Option>, +} + +#[derive(Debug, Deserialize, PartialEq)] +pub struct UserData { + #[serde(rename = "LogFileCleared")] + pub log_file_cleared: Option, +} + +#[derive(Debug, Deserialize, PartialEq)] +pub struct LogFileCleared { + #[serde(rename = "SubjectUserSid")] + pub subject_user_sid: Option, + #[serde(rename = "SubjectUserName")] + pub subject_user_name: Option, + #[serde(rename = "SubjectDomainName")] + pub subject_domain_name: Option, + #[serde(rename = "SubjectLogonId")] + pub subject_logon_id: Option, +} + +#[derive(Debug, Deserialize, PartialEq)] +pub struct Evtx { + #[serde(rename = "System")] + pub system: System, + #[serde(rename = "EventData")] + pub event_data: Option, + #[serde(rename = "UserData")] + pub user_data: Option, +} + +impl Evtx { + // + // 文字列データを取得する + // + fn get_string(v: &Data) -> String { + let mut ret = "".to_string(); + if let Some(text) = &v.text { + ret = text.to_string(); + } + return ret; + } + + // + // EventDataをHashMapとして取得する + // + pub fn parse_event_data(&self) -> HashMap { + let mut values = HashMap::new(); + + if let Some(event_data) = &self.event_data { + if let Some(data) = &event_data.data { + for v in data.iter() { + if let Some(name) = &v.name { + values.insert(name.to_string(), Evtx::get_string(v)); + } + } + } + } + + values + } +}