CSEC_PUBLIC/hayabusa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'main' into 592-config-flag-seems-to-be-ignored

Browse Source
This commit is contained in:
DustInDark
2022-06-23 21:22:17 +09:00
parent 36a6f79662 3dd18b4e0b
commit beb721aeea
20 changed files with 119 additions and 168 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/afterfact.rs
+46 -11
View File
@@ -3,7 +3,8 @@ use crate::detections::configs::{CURRENT_EXE_PATH, TERM_SIZE};
use crate::detections::print;
use crate::detections::print::{AlertMessage, IS_HIDE_RECORD_ID};
use crate::detections::utils;
use crate::detections::utils::write_color_buffer;
use crate::detections::utils::{get_writable_color, write_color_buffer};
use bytesize::ByteSize;
use chrono::{DateTime, Local, TimeZone, Utc};
use csv::QuoteStyle;
use hashbrown::HashMap;
@@ -13,6 +14,7 @@ use lazy_static::lazy_static;
use serde::Serialize;
use std::cmp::min;
use std::error::Error;
use std::fs;
use std::fs::File;
use std::io;
use std::io::BufWriter;
@@ -363,10 +365,32 @@ fn emit_csv<W: std::io::Write>(
wtr.flush()?;
}
let output_path = configs::CONFIG.read().unwrap().args.output.clone();
if let Some(path) = output_path {
if let Ok(metadata) = fs::metadata(path) {
println!(
"Saved file: {} ({})",
configs::CONFIG
.read()
.unwrap()
.args
.output
.as_ref()
.unwrap()
.display(),
ByteSize::b(metadata.len()).to_string_as(false)
);
println!();
}
};
disp_wtr_buf.clear();
disp_wtr_buf.set_color(ColorSpec::new().set_fg(None)).ok();
writeln!(disp_wtr_buf, "Results Summary:").ok();
disp_wtr.print(&disp_wtr_buf).ok();
write_color_buffer(
&disp_wtr,
get_writable_color(Some(Color::Green)),
"Results Summary:",
)
.ok();
let terminal_width = match *TERM_SIZE {
Some((Width(w), _)) => w as usize,
@@ -384,11 +408,22 @@ fn emit_csv<W: std::io::Write>(
} else {
(reducted_record_cnt as f64) / (all_record_cnt as f64) * 100.0
};
println!("Total events: {}", all_record_cnt);
println!(
"Data reduction: {} events ({:.2}%)",
reducted_record_cnt, reducted_percent
);
write_color_buffer(
&disp_wtr,
get_writable_color(None),
&format!("Total events: {}", all_record_cnt),
)
.ok();
write_color_buffer(
&disp_wtr,
get_writable_color(None),
&format!(
"Data reduction: {} events ({:.2}%)",
reducted_record_cnt, reducted_percent
),
)
.ok();
println!();
println!();
_print_unique_results(
@@ -486,7 +521,7 @@ fn _print_unique_results(
// output total results
write_color_buffer(
BufferWriter::stdout(ColorChoice::Always),
&BufferWriter::stdout(ColorChoice::Always),
None,
&format!(
"{} {}: {}",
@@ -506,7 +541,7 @@ fn _print_unique_results(
head_word, level_name, tail_word, counts_by_level[i]
);
write_color_buffer(
BufferWriter::stdout(ColorChoice::Always),
&BufferWriter::stdout(ColorChoice::Always),
_get_output_color(color_map, level_name),
&output_raw_str,
)
src/detections/print.rs
+2 -2
View File
@@ -331,7 +331,7 @@ impl AlertMessage {
/// ERRORメッセージを表示する関数
pub fn alert(contents: &str) -> io::Result<()> {
write_color_buffer(
BufferWriter::stderr(ColorChoice::Always),
&BufferWriter::stderr(ColorChoice::Always),
None,
&format!("[ERROR] {}", contents),
)
@@ -340,7 +340,7 @@ impl AlertMessage {
/// WARNメッセージを表示する関数
pub fn warn(contents: &str) -> io::Result<()> {
write_color_buffer(
BufferWriter::stderr(ColorChoice::Always),
&BufferWriter::stderr(ColorChoice::Always),
None,
&format!("[WARN] {}", contents),
)
src/detections/utils.rs
+10 -1
View File
@@ -242,7 +242,7 @@ pub fn create_rec_info(data: Value, path: String, keys: &[String]) -> EvtxRecord
* 標準出力のカラー出力設定を指定した値に変更し画面出力を行う関数
*/
pub fn write_color_buffer(
wtr: BufferWriter,
wtr: &BufferWriter,
color: Option<Color>,
output_str: &str,
) -> io::Result<()> {
@@ -252,6 +252,15 @@ pub fn write_color_buffer(
wtr.print(&buf)
}
/// no-colorのオプションの指定があるかを確認し、指定されている場合はNoneをかえし、指定されていない場合は引数で指定されたColorをSomeでラップして返す関数
pub fn get_writable_color(color: Option<Color>) -> Option<Color> {
if configs::CONFIG.read().unwrap().args.no_color {
None
} else {
color
}
}
/**
* CSVのrecord infoカラムに出力する文字列を作る
*/
src/main.rs
+16 -15
View File
@@ -123,7 +123,7 @@ impl App {
Ok(output) => {
if output != "You currently have the latest rules." {
write_color_buffer(
BufferWriter::stdout(ColorChoice::Always),
&BufferWriter::stdout(ColorChoice::Always),
None,
"Rules updated successfully.",
)
@@ -187,7 +187,7 @@ impl App {
if *STATISTICS_FLAG {
write_color_buffer(
BufferWriter::stdout(ColorChoice::Always),
&BufferWriter::stdout(ColorChoice::Always),
None,
"Generating Event ID Statistics",
)
@@ -196,7 +196,7 @@ impl App {
}
if *LOGONSUMMARY_FLAG {
write_color_buffer(
BufferWriter::stdout(ColorChoice::Always),
&BufferWriter::stdout(ColorChoice::Always),
None,
"Generating Logons Summary",
)
@@ -279,7 +279,7 @@ impl App {
return;
} else {
write_color_buffer(
BufferWriter::stdout(ColorChoice::Always),
&BufferWriter::stdout(ColorChoice::Always),
None,
&configs::CONFIG.read().unwrap().headless_help,
)
@@ -291,7 +291,7 @@ impl App {
let analysis_duration = analysis_end_time.signed_duration_since(analysis_start_time);
println!();
write_color_buffer(
BufferWriter::stdout(ColorChoice::Always),
&BufferWriter::stdout(ColorChoice::Always),
None,
&format!("Elapsed Time: {}", &analysis_duration.hhmmssxxx()),
)
@@ -346,15 +346,15 @@ impl App {
)
.ok();
});
write_color_buffer(BufferWriter::stdout(ColorChoice::Always), None, &output).ok();
write_color_buffer(&BufferWriter::stdout(ColorChoice::Always), None, &output).ok();
} else {
//標準出力の場合
let output = "The following pivot keywords were found:".to_string();
write_color_buffer(BufferWriter::stdout(ColorChoice::Always), None, &output).ok();
write_color_buffer(&BufferWriter::stdout(ColorChoice::Always), None, &output).ok();
pivot_key_unions.iter().for_each(|(key, pivot_keyword)| {
write_color_buffer(
BufferWriter::stdout(ColorChoice::Always),
&BufferWriter::stdout(ColorChoice::Always),
None,
&create_output(String::default(), key, pivot_keyword),
)
@@ -442,7 +442,8 @@ impl App {
fn print_contributors(&self) {
match fs::read_to_string("./contributors.txt") {
Ok(contents) => {
write_color_buffer(BufferWriter::stdout(ColorChoice::Always), None, &contents).ok();
write_color_buffer(&BufferWriter::stdout(ColorChoice::Always), None, &contents)
.ok();
}
Err(err) => {
AlertMessage::alert(&format!("{}", err)).ok();
@@ -458,7 +459,7 @@ impl App {
.min_level
.to_uppercase();
write_color_buffer(
BufferWriter::stdout(ColorChoice::Always),
&BufferWriter::stdout(ColorChoice::Always),
None,
&format!("Analyzing event files: {:?}", evtx_files.len()),
)
@@ -684,7 +685,7 @@ impl App {
Some(Color::Green)
};
write_color_buffer(
BufferWriter::stdout(ColorChoice::Always),
&BufferWriter::stdout(ColorChoice::Always),
output_color,
&content,
)
@@ -704,7 +705,7 @@ impl App {
Some(path) => {
let egg_path = CURRENT_EXE_PATH.join(path);
let content = fs::read_to_string(egg_path).unwrap_or_default();
write_color_buffer(BufferWriter::stdout(ColorChoice::Always), None, &content).ok();
write_color_buffer(&BufferWriter::stdout(ColorChoice::Always), None, &content).ok();
}
}
}
@@ -718,7 +719,7 @@ impl App {
let hayabusa_rule_repo = Repository::open(Path::new("rules"));
if hayabusa_repo.is_err() && hayabusa_rule_repo.is_err() {
write_color_buffer(
BufferWriter::stdout(ColorChoice::Always),
&BufferWriter::stdout(ColorChoice::Always),
None,
"Attempting to git clone the hayabusa-rules repository into the rules folder.",
)
@@ -897,7 +898,7 @@ impl App {
.entry(tmp[3].to_string())
.or_insert(0b0) += 1;
write_color_buffer(
BufferWriter::stdout(ColorChoice::Always),
&BufferWriter::stdout(ColorChoice::Always),
None,
&format!(
"[Updated] {} (Modified: {} | Path: {})",
@@ -914,7 +915,7 @@ impl App {
Ok("Rule updated".to_string())
} else {
write_color_buffer(
BufferWriter::stdout(ColorChoice::Always),
&BufferWriter::stdout(ColorChoice::Always),
None,
"You currently have the latest rules.",
)
src/options/level_tuning.rs
+2 -2
View File
@@ -59,7 +59,7 @@ impl LevelTuning {
for (path, rule) in rulefile_loader.files {
if let Some(new_level) = tuning_map.get(rule["id"].as_str().unwrap()) {
write_color_buffer(
BufferWriter::stdout(ColorChoice::Always),
&BufferWriter::stdout(ColorChoice::Always),
None,
&format!("path: {}", path),
)
@@ -94,7 +94,7 @@ impl LevelTuning {
file.write_all(content.as_bytes()).unwrap();
file.flush().unwrap();
write_color_buffer(
BufferWriter::stdout(ColorChoice::Always),
&BufferWriter::stdout(ColorChoice::Always),
None,
&format!(
"level: {} -> {}",