設計変更

src/main.rs

@@ -5,7 +5,6 @@ use evtx::EvtxParser;
 use std::env;
 use std::process;
 use std::path::PathBuf;
-use std::collections::HashMap;
 use quick_xml::de::{DeError};
 use yamato_event_analyzer::models::event;
 use yamato_event_analyzer::detections::security;
@@ -16,17 +15,16 @@ fn main() -> Result<(), DeError> {
 
     let args: Vec<String> = env::args().collect();
     let fp: PathBuf;
-    if args.len() > 1 {
+    if (args.len() > 1) {
         fp = PathBuf::from(args[1].to_string());
     } else {
         fp = PathBuf::from(format!("./samples/security.evtx"));
     }
     
-    let alert_all_admin = 0;
-    let mut total_admin_logons = 0;
-    let mut admin_logons: HashMap<String, HashMap<String, i32>> = HashMap::new();
-    let mut multiple_admin_logons: HashMap<String, i32> = HashMap::new();
     
+    let mut security = security::Security::new();
+    let mut system = system::System::new();
+    let mut application = application::Application::new();
     let mut parser = match EvtxParser::from_path(fp) {
         Ok(pointer) => pointer,
         Err(e) => {
@@ -41,17 +39,13 @@ fn main() -> Result<(), DeError> {
                 let event: event::Evtx = quick_xml::de::from_str(&r.data)?;
                 let event_id = event.System.EventID.to_string();
 
-                // ログがSecurity.evtxなら
                 if event.System.Channel == "Security" {
                     let event_data = event.parse_event_data();
-                    security::detection(event_id, 
-                        event_data, alert_all_admin, &mut total_admin_logons,
-                        &mut admin_logons, &mut multiple_admin_logons
-                    );
+                    &security.detection(event_id, event_data);
                 } else if event.System.Channel == "System" {
-                    system::detection();
+                    &system.detection();
                 } else if event.System.Channel == "Application" {
-                    application::detection();
+                    &application.detection();
                 }
             },
             Err(e) => eprintln!("{}", e),
@@ -59,13 +53,9 @@ fn main() -> Result<(), DeError> {
     }
 
     ////////////////////////////
-    // 表示　別ファイルでやりたい
+    // 表示
     ////////////////////////////
-    if total_admin_logons > 0 {
-        println!("total_admin_logons:{}", total_admin_logons);
-        println!("admin_logons:{:?}", admin_logons);
-        println!("multiple_admin_logons:{:?}", multiple_admin_logons);
-    }
+    security.disp();
 
     Ok(())
 }