diff --git a/src/detections/detection.rs b/src/detections/detection.rs index 52dab334..1904d5fe 100644 --- a/src/detections/detection.rs +++ b/src/detections/detection.rs @@ -11,7 +11,7 @@ use crate::detections::print::MESSAGES; use crate::detections::rule; use crate::detections::rule::RuleNode; use crate::detections::utils::get_serde_number_to_string; -use crate::fillter::RuleFill; +use crate::fillter; use crate::yaml::ParseYaml; use std::sync::Arc; @@ -55,7 +55,7 @@ impl Detection { pub fn parse_rule_files( level: String, rulespath: Option<&str>, - fill_ids: &RuleFill, + fill_ids: &fillter::RuleFill, ) -> Vec { // ルールファイルのパースを実行 let mut rulefile_loader = ParseYaml::new(); @@ -275,9 +275,7 @@ impl Detection { fn test_parse_rule_files() { let level = "informational"; let opt_rule_path = Some("./test_files/rules/level_yaml"); - let fill_ids = RuleFill { - no_use_rule: std::collections::HashSet::new(), - }; - let cole = Detection::parse_rule_files(level.to_owned(), opt_rule_path, &fill_ids); + let cole = + Detection::parse_rule_files(level.to_owned(), opt_rule_path, &fillter::exclude_ids()); assert_eq!(5, cole.len()); } diff --git a/src/fillter.rs b/src/fillter.rs index d3ddb429..7b61d175 100644 --- a/src/fillter.rs +++ b/src/fillter.rs @@ -1,6 +1,36 @@ +use crate::detections::configs; use std::collections::HashSet; +use std::fs; #[derive(Clone, Debug)] pub struct RuleFill { pub no_use_rule: HashSet, } + +pub fn exclude_ids() -> RuleFill { + let mut ids = String::from_utf8(fs::read("config/exclude-rules.txt").unwrap()).unwrap(); + if !configs::CONFIG + .read() + .unwrap() + .args + .is_present("show-noisyalerts") + { + ids += "\n"; // 改行を入れないとexclude-rulesの一番最後の行とnoisy-rules.txtの一番最後の行が一行にまとめられてしまう。 + ids += &String::from_utf8(fs::read("config/noisy-rules.txt").unwrap()).unwrap(); + } + + let mut fill_ids = RuleFill { + no_use_rule: HashSet::new(), + }; + + for v in ids.split_whitespace() { + let v = v.to_string(); + if v.is_empty() { + // 空行は無視する。 + continue; + } + fill_ids.no_use_rule.insert(v); + } + + return fill_ids; +} diff --git a/src/main.rs b/src/main.rs index f4e86cf6..525256eb 100644 --- a/src/main.rs +++ b/src/main.rs @@ -13,7 +13,6 @@ use hayabusa::{detections::configs, timeline::timeline::Timeline}; use hhmmss::Hhmmss; use pbr::ProgressBar; use serde_json::Value; -use std::collections::HashSet; use std::{ fs::{self, File}, path::PathBuf, @@ -124,34 +123,10 @@ fn analysis_files(evtx_files: Vec) { .to_uppercase(); println!("Analyzing event files: {:?}", evtx_files.len()); - //除外ルール前処理 - let mut ids = String::from_utf8(fs::read("config/exclude-rules.txt").unwrap()).unwrap(); - if !configs::CONFIG - .read() - .unwrap() - .args - .is_present("show-noisyalerts") - { - ids += "\n"; // 改行を入れないとexclude-rulesの一番最後の行とnoisy-rules.txtの一番最後の行が一行にまとめられてしまう。 - ids += &String::from_utf8(fs::read("config/noisy-rules.txt").unwrap()).unwrap(); - } - - let mut fill_ids = fillter::RuleFill { - no_use_rule: HashSet::new(), - }; - - for v in ids.split_whitespace() { - let v = v.to_string(); - if v.is_empty() { - // 空行は無視する。 - continue; - } - fill_ids.no_use_rule.insert(v); - } let rule_files = detection::Detection::parse_rule_files( level, configs::CONFIG.read().unwrap().args.value_of("rules"), - &fill_ids, + &fillter::exclude_ids(), ); let mut pb = ProgressBar::new(evtx_files.len() as u64); let mut detection = detection::Detection::new(rule_files); diff --git a/src/yaml.rs b/src/yaml.rs index da18486c..a06aac28 100644 --- a/src/yaml.rs +++ b/src/yaml.rs @@ -160,6 +160,7 @@ impl ParseYaml { #[cfg(test)] mod tests { + use crate::fillter; use crate::yaml; use crate::yaml::RuleFill; use std::collections::HashSet; @@ -211,10 +212,8 @@ mod tests { fn test_default_level_read_yaml() { let mut yaml = yaml::ParseYaml::new(); let path = Path::new("test_files/rules/level_yaml"); - let fill_ids = RuleFill { - no_use_rule: HashSet::new(), - }; - yaml.read_dir(path.to_path_buf(), &"", &fill_ids).unwrap(); + yaml.read_dir(path.to_path_buf(), &"", &fillter::exclude_ids()) + .unwrap(); assert_eq!(yaml.files.len(), 5); } @@ -222,21 +221,19 @@ mod tests { fn test_info_level_read_yaml() { let mut yaml = yaml::ParseYaml::new(); let path = Path::new("test_files/rules/level_yaml"); - let fill_ids = RuleFill { - no_use_rule: HashSet::new(), - }; - yaml.read_dir(path.to_path_buf(), &"informational", &fill_ids) - .unwrap(); + yaml.read_dir( + path.to_path_buf(), + &"informational", + &fillter::exclude_ids(), + ) + .unwrap(); assert_eq!(yaml.files.len(), 5); } #[test] fn test_low_level_read_yaml() { let mut yaml = yaml::ParseYaml::new(); let path = Path::new("test_files/rules/level_yaml"); - let fill_ids = RuleFill { - no_use_rule: HashSet::new(), - }; - yaml.read_dir(path.to_path_buf(), &"LOW", &fill_ids) + yaml.read_dir(path.to_path_buf(), &"LOW", &fillter::exclude_ids()) .unwrap(); assert_eq!(yaml.files.len(), 4); } @@ -244,10 +241,7 @@ mod tests { fn test_medium_level_read_yaml() { let mut yaml = yaml::ParseYaml::new(); let path = Path::new("test_files/rules/level_yaml"); - let fill_ids = RuleFill { - no_use_rule: HashSet::new(), - }; - yaml.read_dir(path.to_path_buf(), &"MEDIUM", &fill_ids) + yaml.read_dir(path.to_path_buf(), &"MEDIUM", &fillter::exclude_ids()) .unwrap(); assert_eq!(yaml.files.len(), 3); } @@ -255,10 +249,7 @@ mod tests { fn test_high_level_read_yaml() { let mut yaml = yaml::ParseYaml::new(); let path = Path::new("test_files/rules/level_yaml"); - let fill_ids = RuleFill { - no_use_rule: HashSet::new(), - }; - yaml.read_dir(path.to_path_buf(), &"HIGH", &fill_ids) + yaml.read_dir(path.to_path_buf(), &"HIGH", &fillter::exclude_ids()) .unwrap(); assert_eq!(yaml.files.len(), 2); } @@ -266,11 +257,16 @@ mod tests { fn test_critical_level_read_yaml() { let mut yaml = yaml::ParseYaml::new(); let path = Path::new("test_files/rules/level_yaml"); - let fill_ids = RuleFill { - no_use_rule: HashSet::new(), - }; - yaml.read_dir(path.to_path_buf(), &"CRITICAL", &fill_ids) + yaml.read_dir(path.to_path_buf(), &"CRITICAL", &fillter::exclude_ids()) .unwrap(); assert_eq!(yaml.files.len(), 1); } + #[test] + fn test_exclude_rules_file() { + let mut yaml = yaml::ParseYaml::new(); + let path = Path::new("test_files/rules/exclude_rules"); + yaml.read_dir(path.to_path_buf(), &"", &fillter::exclude_ids()) + .unwrap(); + assert_eq!(yaml.ignorerule_count, 1); + } }