fix line feed code and refactoring

src/detections/security.rs

@@ -201,7 +201,7 @@ impl Security {
         // see fn disp()
         self.total_failed_logons += 1;
         let username = event_data.get("TargetUserName").unwrap_or(&self.empty_str);
-        let failed_cnt = self.account_2_failedcnt.get(username).unwrap_or(&0) + &1;
+        let failed_cnt = self.account_2_failedcnt.get(username).unwrap_or(&0) + 1;
         self.account_2_failedcnt
             .insert(username.to_string(), failed_cnt);
     }

src/models/event.rs

@@ -1,133 +1,133 @@
-extern crate serde;
-use serde::Deserialize;
-use std::collections::HashMap;
-
-#[derive(Debug, Deserialize, PartialEq)]
-pub struct Data {
-    #[serde(rename = "Name")]
-    pub name: Option<String>,
-    #[serde(rename = "$value")]
-    pub text: Option<String>,
-}
-
-#[derive(Debug, Deserialize, PartialEq)]
-pub struct TimeCreated {
-    #[serde(rename = "SystemTime")]
-    pub system_time: String,
-}
-
-#[derive(Debug, Deserialize, PartialEq)]
-struct Execution {
-    #[serde(rename = "ProcessID")]
-    process_id: i32,
-    #[serde(rename = "ThreadID")]
-    thread_id: i32,
-}
-
-#[derive(Debug, Deserialize, PartialEq)]
-pub struct Provider {
-    #[serde(rename = "Name")]
-    pub name: Option<String>,
-    #[serde(rename = "Guid")]
-    guid: Option<String>,
-}
-
-#[derive(Debug, Deserialize, PartialEq)]
-pub struct System {
-    #[serde(rename = "Provider")]
-    pub provider: Provider,
-    #[serde(rename = "EventID")]
-    pub event_id: String,
-    #[serde(rename = "Version")]
-    version: Option<String>,
-    #[serde(rename = "Level")]
-    level: String,
-    #[serde(rename = "Task")]
-    task: String,
-    #[serde(rename = "Opcode")]
-    opcode: Option<String>,
-    #[serde(rename = "Keywords")]
-    keywords: String,
-    #[serde(rename = "TimeCreated")]
-    pub time_created: TimeCreated,
-    #[serde(rename = "EventRecordID")]
-    pub event_record_id: String,
-    #[serde(rename = "Correlation")]
-    correlation: Option<String>,
-    #[serde(rename = "Execution")]
-    execution: Option<Execution>,
-    #[serde(rename = "Channel")]
-    pub channel: String, // Security, System, Application ...etc
-    #[serde(rename = "Computer")]
-    computer: String,
-    #[serde(rename = "Security")]
-    security: String,
-    #[serde(rename = "Message")]
-    pub message: Option<String>,
-}
-
-#[derive(Debug, Deserialize, PartialEq)]
-pub struct EventData {
-    #[serde(rename = "Data")]
-    pub data: Option<Vec<Data>>,
-}
-
-#[derive(Debug, Deserialize, PartialEq)]
-pub struct UserData {
-    #[serde(rename = "LogFileCleared")]
-    pub log_file_cleared: Option<LogFileCleared>,
-}
-
-#[derive(Debug, Deserialize, PartialEq)]
-pub struct LogFileCleared {
-    #[serde(rename = "SubjectUserSid")]
-    pub subject_user_sid: Option<String>,
-    #[serde(rename = "SubjectUserName")]
-    pub subject_user_name: Option<String>,
-    #[serde(rename = "SubjectDomainName")]
-    pub subject_domain_name: Option<String>,
-    #[serde(rename = "SubjectLogonId")]
-    pub subject_logon_id: Option<String>,
-}
-
-#[derive(Debug, Deserialize, PartialEq)]
-pub struct Evtx {
-    #[serde(rename = "System")]
-    pub system: System,
-    #[serde(rename = "EventData")]
-    pub event_data: Option<EventData>,
-    #[serde(rename = "UserData")]
-    pub user_data: Option<UserData>,
-}
-
-impl Evtx {
-    //
-    // 文字列データを取得する
-    //
-    fn get_string(v: &Data) -> String {
-        let mut ret = "".to_string();
-        if let Some(text) = &v.text {
-            ret = text.to_string();
-        }
-        return ret;
-    }
-
-    //
-    // EventDataをHashMapとして取得する
-    //
-    pub fn parse_event_data(&self) -> HashMap<String, String> {
-        let mut values = HashMap::new();
-
-        if let Some(event_data) = &self.event_data {
-            if let Some(data) = &event_data.data {
-                for v in data.iter() {
-                    if let Some(name) = &v.name {
-                        values.insert(name.to_string(), Evtx::get_string(v));
-                    }
-                }
-            }
-        }
-
-        values
-    }
-}
+extern crate serde;
+use serde::Deserialize;
+use std::collections::HashMap;
+
+#[derive(Debug, Deserialize, PartialEq)]
+pub struct Data {
+    #[serde(rename = "Name")]
+    pub name: Option<String>,
+    #[serde(rename = "$value")]
+    pub text: Option<String>,
+}
+
+#[derive(Debug, Deserialize, PartialEq)]
+pub struct TimeCreated {
+    #[serde(rename = "SystemTime")]
+    pub system_time: String,
+}
+
+#[derive(Debug, Deserialize, PartialEq)]
+struct Execution {
+    #[serde(rename = "ProcessID")]
+    process_id: i32,
+    #[serde(rename = "ThreadID")]
+    thread_id: i32,
+}
+
+#[derive(Debug, Deserialize, PartialEq)]
+pub struct Provider {
+    #[serde(rename = "Name")]
+    pub name: Option<String>,
+    #[serde(rename = "Guid")]
+    guid: Option<String>,
+}
+
+#[derive(Debug, Deserialize, PartialEq)]
+pub struct System {
+    #[serde(rename = "Provider")]
+    pub provider: Provider,
+    #[serde(rename = "EventID")]
+    pub event_id: String,
+    #[serde(rename = "Version")]
+    version: Option<String>,
+    #[serde(rename = "Level")]
+    level: String,
+    #[serde(rename = "Task")]
+    task: String,
+    #[serde(rename = "Opcode")]
+    opcode: Option<String>,
+    #[serde(rename = "Keywords")]
+    keywords: String,
+    #[serde(rename = "TimeCreated")]
+    pub time_created: TimeCreated,
+    #[serde(rename = "EventRecordID")]
+    pub event_record_id: String,
+    #[serde(rename = "Correlation")]
+    correlation: Option<String>,
+    #[serde(rename = "Execution")]
+    execution: Option<Execution>,
+    #[serde(rename = "Channel")]
+    pub channel: String, // Security, System, Application ...etc
+    #[serde(rename = "Computer")]
+    computer: String,
+    #[serde(rename = "Security")]
+    security: String,
+    #[serde(rename = "Message")]
+    pub message: Option<String>,
+}
+
+#[derive(Debug, Deserialize, PartialEq)]
+pub struct EventData {
+    #[serde(rename = "Data")]
+    pub data: Option<Vec<Data>>,
+}
+
+#[derive(Debug, Deserialize, PartialEq)]
+pub struct UserData {
+    #[serde(rename = "LogFileCleared")]
+    pub log_file_cleared: Option<LogFileCleared>,
+}
+
+#[derive(Debug, Deserialize, PartialEq)]
+pub struct LogFileCleared {
+    #[serde(rename = "SubjectUserSid")]
+    pub subject_user_sid: Option<String>,
+    #[serde(rename = "SubjectUserName")]
+    pub subject_user_name: Option<String>,
+    #[serde(rename = "SubjectDomainName")]
+    pub subject_domain_name: Option<String>,
+    #[serde(rename = "SubjectLogonId")]
+    pub subject_logon_id: Option<String>,
+}
+
+#[derive(Debug, Deserialize, PartialEq)]
+pub struct Evtx {
+    #[serde(rename = "System")]
+    pub system: System,
+    #[serde(rename = "EventData")]
+    pub event_data: Option<EventData>,
+    #[serde(rename = "UserData")]
+    pub user_data: Option<UserData>,
+}
+
+impl Evtx {
+    //
+    // 文字列データを取得する
+    //
+    fn get_string(v: &Data) -> String {
+        let mut ret = "".to_string();
+        if let Some(text) = &v.text {
+            ret = text.to_string();
+        }
+        return ret;
+    }
+
+    //
+    // EventDataをHashMapとして取得する
+    //
+    pub fn parse_event_data(&self) -> HashMap<String, String> {
+        let mut values = HashMap::new();
+
+        if let Some(event_data) = &self.event_data {
+            if let Some(data) = &event_data.data {
+                for v in data.iter() {
+                    if let Some(name) = &v.name {
+                        values.insert(name.to_string(), Evtx::get_string(v));
+                    }
+                }
+            }
+        }
+
+        values
+    }
+}