設計変更、コマンドライン オプション受け取るように修正

Cargo.lock

@@ -1107,6 +1107,7 @@ dependencies = [
 name = "yamato_event_analyzer"
 version = "0.1.0"
 dependencies = [
+ "clap",
  "evtx",
  "quick-xml 0.17.2",
  "serde",

Cargo.toml

@@ -11,4 +11,4 @@ evtx = { git = "https://github.com/omerbenamram/evtx.git" }
 quick-xml = {version = "0.17", features = ["serialize"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = { version = "1.0"}
-
+clap = "*"

src/detections/common.rs

@@ -9,6 +9,7 @@ pub struct Common {
 }
 
 impl Common {
+
     pub fn new() -> Common {
         Common {
             record_id: 0,
@@ -29,7 +30,6 @@ impl Common {
 
     }
 
-
     //
     // Record IDがシーケンスになっているかチェック
     //

src/detections/detection.rs

@@ -0,0 +1,67 @@
+extern crate quick_xml;
+
+use std::collections::BTreeMap;
+use std::collections::HashMap;
+use crate::models::event;
+use evtx::EvtxParser;
+use crate::detections::common;
+use crate::detections::security;
+use crate::detections::system;
+use crate::detections::application;
+use quick_xml::de::{DeError};
+
+#[derive(Debug)]
+pub struct Detection {
+    timeline_list : BTreeMap<String, String>,
+}
+
+impl Detection {
+
+    pub fn new() -> Detection {
+        Detection {
+            timeline_list: BTreeMap::new(),
+        }
+    }
+
+    pub fn start(&mut self, mut parser: EvtxParser<std::fs::File>) -> Result<(), DeError> {
+    
+        let mut common: common::Common = common::Common::new();
+        let mut security = security::Security::new();
+        let mut system = system::System::new();
+        let mut application = application::Application::new();
+            
+        for record in parser.records() {
+            match record {
+                Ok(r) => {
+                    let event: event::Evtx = quick_xml::de::from_str(&r.data)?;
+                    let event_id = event.system.event_id.to_string();
+                    let channel = event.system.channel.to_string();
+                    let event_data = event.parse_event_data();
+                    
+                    &common.detection(&event.system, &event_data);
+                        //&common.detection(&event.system, &event_data);
+                    if channel == "Security" {
+                        &security.detection(event_id, &event.system, event_data);
+                    } else if channel == "System" {
+                        &system.detection();
+                    } else if channel == "Application" {
+                        &application.detection();
+                    } else {
+                        //&other.detection();
+                    }
+                },
+                Err(e) => eprintln!("{}", e),
+            }
+        }
+
+        ////////////////////////////
+        // 表示
+        ////////////////////////////
+        common.disp();
+        security.disp();
+        
+        return Ok(())
+    }
+
+}
+

src/detections/mod.rs

@@ -1,5 +1,5 @@
-pub mod common;
+mod common;
-pub mod security;
+mod security;
-pub mod system;
+mod system;
-pub mod application;
+mod application;
-
+pub mod detection;

src/main.rs

@@ -1,32 +1,56 @@
 extern crate serde;
-extern crate quick_xml;
+extern crate clap;
 
 use evtx::EvtxParser;
-use std::env;
+use std::{env, process, path::PathBuf};
-use std::process;
-use std::path::PathBuf;
 use quick_xml::de::{DeError};
-use yamato_event_analyzer::models::event;
+use yamato_event_analyzer::detections::detection;
-use yamato_event_analyzer::detections::common;
+use clap::{App, AppSettings, Arg};
-use yamato_event_analyzer::detections::security;
+
-use yamato_event_analyzer::detections::system;
+fn build_app() -> clap::App<'static, 'static> {
-use yamato_event_analyzer::detections::application;
+    let program = std::env::args()
+        .nth(0)
+        .and_then(|s| {
+            std::path::PathBuf::from(s)
+            .file_stem()
+            .map(|s| s.to_string_lossy().into_owned())
+        })
+        .unwrap();
+
+    App::new(program)
+        .about("Yea! (Yamato Event Analyzer). Aiming to be the world's greatest Windows event log analysis tool!")
+        .version("0.0.1")
+        .author("Author name <author@example.com>")
+        .setting(AppSettings::VersionlessSubcommands)
+        .arg(Arg::from_usage("-f --filepath=[FILEPATH] 'event file path'"))
+        .arg(Arg::from_usage("--attackhunt=[ATTACK_HUNT] 'Attack Hunt'"))
+        .arg(Arg::from_usage("--csv-timeline=[CSV_TIMELINE] 'csv output timeline'"))
+        .arg(Arg::from_usage("--human-readable-timeline=[HUMAN_READABLE_TIMELINE] 'human readable timeline'"))
+        .arg(Arg::from_usage("-l --lang=[LANG] 'output language'"))
+        .arg(Arg::from_usage("-t --timezone=[TIMEZONE] 'timezone setting'"))
+        .arg(Arg::from_usage("-d --directory 'event log files directory'"))
+        .arg(Arg::from_usage("-s --statistics 'event statistics'"))
+        .arg(Arg::from_usage("-u --update 'signature update'"))
+        .arg(Arg::from_usage("--credits 'Zachary Mathis, Akira Nishikawa'"))
+
+}
 
 fn main() -> Result<(), DeError> {
 
-    let args: Vec<String> = env::args().collect();
+    let args = build_app().get_matches();
-    let fp: PathBuf;
+    let filepath : Option<&str> = args.value_of("filepath");
-    if args.len() > 1 {
+    
-        fp = PathBuf::from(args[1].to_string());
+    match filepath {
-    } else {
+        Some(filepath) => parse_file(filepath),
-        fp = PathBuf::from(format!("./samples/security.evtx"));
+        None => (),
     }
     
-    let mut common = common::Common::new();    
+    Ok(())
-    let mut security = security::Security::new();
+}
-    let mut system = system::System::new();
+
-    let mut application = application::Application::new();
+fn parse_file(filepath: &str) {
-    let mut parser = match EvtxParser::from_path(fp) {
+    let fp = PathBuf::from(filepath);
+    let parser = match EvtxParser::from_path(fp) {
         Ok(pointer) => pointer,
         Err(e) => {
             eprintln!("{}", e);
@@ -34,34 +58,6 @@ fn main() -> Result<(), DeError> {
         },
     };
         
-    for record in parser.records() {
+    let mut detection = detection::Detection::new();
-        match record {
+    &detection.start(parser);
-            Ok(r) => {
-                let event: event::Evtx = quick_xml::de::from_str(&r.data)?;
-                let event_id = event.system.event_id.to_string();
-                let channel = event.system.channel.to_string();
-                let event_data = event.parse_event_data();
-                &common.detection(&event.system, &event_data);
-                if channel == "Security" {
-                    &security.detection(event_id, &event.system, event_data);
-                } else if channel == "System" {
-                    &system.detection();
-                } else if channel == "Application" {
-                    &application.detection();
-                } else {
-                    //&other.detection();
-                }
-            },
-            Err(e) => eprintln!("{}", e),
-        }
-    }
-
-    ////////////////////////////
-    // 表示
-    ////////////////////////////
-    common.disp();
-    security.disp();
-
-    Ok(())
 }
-