diff --git a/src/detections/configs.rs b/src/detections/configs.rs index 1862e2d4..86019b44 100644 --- a/src/detections/configs.rs +++ b/src/detections/configs.rs @@ -1,22 +1,49 @@ use std::fs::File; use std::io::prelude::*; use std::sync::Once; +use clap::ArgMatches; #[derive(Clone)] pub struct SingletonReader { pub regex: Vec>, pub whitelist: Vec>, + pub args: Config<'static>, } -pub fn singleton() -> Box { +#[derive(Debug, Clone)] +pub struct Config<'a> { + pub filepath: Option<&'a str>, + pub attackhunt: Option<&'a str>, + pub csv_timeline: Option<&'a str>, + pub human_readable_timeline: Option<&'a str>, + pub lang: Option<&'a str>, + pub timezone: Option<&'a str>, +} + +impl<'a> Config<'a> { + fn new(args: ArgMatches<'a>) -> Self { + Config { + filepath: args.value_of("filepath"), + attackhunt: args.value_of("attackhunt"), + csv_timeline: args.value_of("csv-timeline"), + human_readable_timeline: args.value_of("human-readable-timeline"), + lang: args.value_of("lang"), + timezone: args.value_of("timezone"), + } + } +} + +pub fn init_singleton(args: ArgMatches<'static>) -> Box { static mut SINGLETON: Option> = Option::None; static ONCE: Once = Once::new(); + static CONFIG: Config = Config::new(args); unsafe { ONCE.call_once(|| { let singleton = SingletonReader { regex: read_csv("regexes.txt"), whitelist: read_csv("whitelist.txt"), + args: CONFIG, }; SINGLETON = Some(Box::new(singleton)); @@ -26,6 +53,13 @@ pub fn singleton() -> Box { } } +pub fn singleton() -> Box { + static mut SINGLETON: Option> = Option::None; + unsafe { + return SINGLETON.clone().unwrap(); + } +} + fn read_csv(filename: &str) -> Vec> { let mut f = File::open(filename).expect("file not found!!!"); let mut contents: String = String::new(); diff --git a/src/detections/mod.rs b/src/detections/mod.rs index d1996a94..30eac958 100644 --- a/src/detections/mod.rs +++ b/src/detections/mod.rs @@ -1,7 +1,7 @@ mod application; mod applocker; mod common; -mod configs; +pub mod configs; pub mod detection; mod powershell; mod print; diff --git a/src/main.rs b/src/main.rs index fe8ffba4..b4ea6830 100644 --- a/src/main.rs +++ b/src/main.rs @@ -5,6 +5,7 @@ use clap::{App, AppSettings, Arg}; use evtx::EvtxParser; use quick_xml::de::DeError; use std::{fs, path::PathBuf, process}; +use yamato_event_analyzer::detections::configs; use yamato_event_analyzer::detections::detection; use yamato_event_analyzer::omikuji::Omikuji; use yamato_event_analyzer::toml; @@ -39,7 +40,9 @@ fn build_app() -> clap::App<'static, 'static> { fn main() -> Result<(), DeError> { let args = build_app().get_matches(); - let filepath: Option<&str> = args.value_of("filepath"); + configs::init_singleton(&args); + + let filepath: Option<&str> = configs::singleton().args.filepath; if let Some(filepath) = filepath { parse_file(filepath);