aliasキーがない場合もEvent.EventDataを自動で走査する (#442)

* add no event key

* support not-register-alias search

* added checking EventData when key do not match in alias #290

- added checking key in Event.EventData, if key is not exist in eventkey_alias.txt.

* cargo fmt

* fixed panic when filter files does not exists

* fixed errorlog format when filter config files does not exist

Co-authored-by: DustInDark <nextsasasa@gmail.com>

src/detections/utils.rs

@@ -166,8 +166,8 @@ pub fn get_event_value<'a>(key: &str, event_value: &'a Value) -> Option<&'a Valu
     }
 
     let event_key = configs::EVENTKEY_ALIAS.get_event_key(key);
+    let mut ret: &Value = event_value;
     if let Some(event_key) = event_key {
-        let mut ret: &Value = event_value;
         // get_event_keyが取得できてget_event_key_splitが取得できないことはない
         let splits = configs::EVENTKEY_ALIAS.get_event_key_split(key);
         let mut start_idx = 0;
@@ -184,8 +184,12 @@ pub fn get_event_value<'a>(key: &str, event_value: &'a Value) -> Option<&'a Valu
 
         Option::Some(ret)
     } else {
-        let mut ret: &Value = event_value;
-        let event_key = key;
+        let event_key;
+        if !key.contains('.') {
+            event_key = "Event.EventData.".to_string() + key;
+        } else {
+            event_key = key.to_string();
+        }
         for key in event_key.split('.') {
             if !ret.is_object() {
                 return Option::None;