CSEC_PUBLIC/hayabusa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'main' into feature/463

Browse Source
This commit is contained in:
garigariganzy
2022-09-26 23:51:49 +09:00
parent cf427e9695 ebe89905b5
commit d670743cbe
19 changed files with 153 additions and 112 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/detections/configs.rs
+6 -6
View File
@@ -188,9 +188,9 @@ pub struct Config {
#[clap(help_heading = Some("ADVANCED"), short, long = "thread-number", value_name = "NUMBER")]
pub thread_number: Option<usize>,
/// Print statistics of event IDs
#[clap(help_heading = Some("OTHER-ACTIONS"), short, long)]
pub statistics: bool,
/// Print event ID metrics
#[clap(help_heading = Some("OTHER-ACTIONS"), short='M', long)]
pub metrics: bool,
/// Print a summary of successful and failed logons
#[clap(help_heading = Some("OTHER-ACTIONS"), short = 'L', long = "logon-summary")]
@@ -266,11 +266,11 @@ impl ConfigReader<'_> {
args: parse.clone(),
headless_help: String::default(),
event_timeline_config: load_eventcode_info(
utils::check_setting_path(&parse.config, "statistics_event_info.txt", false)
utils::check_setting_path(&parse.config, "event_id_info.txt", false)
.unwrap_or_else(|| {
utils::check_setting_path(
&CURRENT_EXE_PATH.to_path_buf(),
"rules/config/statistics_event_info.txt",
"rules/config/event_id_info.txt",
true,
)
.unwrap()
@@ -581,7 +581,7 @@ fn load_eventcode_info(path: &str) -> EventInfoConfig {
return config;
}
// statistics_event_infoが読み込めなかったらエラーで終了とする。
// event_id_info.txtが読み込めなかったらエラーで終了とする。
read_result.unwrap().into_iter().for_each(|line| {
if line.len() != 2 {
return;
src/detections/detection.rs
+4 -4
View File
@@ -14,7 +14,7 @@ use crate::detections::message::DetectInfo;
use crate::detections::message::ERROR_LOG_STACK;
use crate::detections::message::{CH_CONFIG, DEFAULT_DETAILS, TAGS_CONFIG};
use crate::detections::message::{
LOGONSUMMARY_FLAG, PIVOT_KEYWORD_LIST_FLAG, QUIET_ERRORS_FLAG, STATISTICS_FLAG,
LOGONSUMMARY_FLAG, METRICS_FLAG, PIVOT_KEYWORD_LIST_FLAG, QUIET_ERRORS_FLAG,
};
use crate::detections::pivot::insert_pivot_keyword;
use crate::detections::rule;
@@ -364,7 +364,7 @@ impl Detection {
}
let detect_info = DetectInfo {
rulepath: (&rule.rulepath).to_owned(),
rulepath: rule.rulepath.to_owned(),
ruletitle: rule.yaml["title"].as_str().unwrap_or("-").to_string(),
level: LEVEL_ABBR.get(&level).unwrap_or(&level).to_string(),
computername: record_info.record["Event"]["System"]["Computer"]
@@ -495,7 +495,7 @@ impl Detection {
}
let detect_info = DetectInfo {
rulepath: (&rule.rulepath).to_owned(),
rulepath: rule.rulepath.to_owned(),
ruletitle: rule.yaml["title"].as_str().unwrap_or("-").to_string(),
level: LEVEL_ABBR.get(&level).unwrap_or(&level).to_string(),
computername: "-".to_owned(),
@@ -599,7 +599,7 @@ impl Detection {
st_rc: &HashMap<String, u128>,
err_rc: &u128,
) {
if *STATISTICS_FLAG {
if *METRICS_FLAG {
return;
}
let mut sorted_ld_rc: Vec<(&String, &u128)> = ld_rc.iter().collect();
src/detections/message.rs
+1 -2
View File
@@ -46,7 +46,7 @@ lazy_static! {
);
pub static ref QUIET_ERRORS_FLAG: bool = configs::CONFIG.read().unwrap().args.quiet_errors;
pub static ref ERROR_LOG_STACK: Mutex<Vec<String>> = Mutex::new(Vec::new());
pub static ref STATISTICS_FLAG: bool = configs::CONFIG.read().unwrap().args.statistics;
pub static ref METRICS_FLAG: bool = configs::CONFIG.read().unwrap().args.metrics;
pub static ref LOGONSUMMARY_FLAG: bool = configs::CONFIG.read().unwrap().args.logon_summary;
pub static ref TAGS_CONFIG: HashMap<String, String> = create_output_filter_config(
utils::check_setting_path(&CURRENT_EXE_PATH.to_path_buf(), "config/mitre_tactics.txt", true)
@@ -625,7 +625,6 @@ mod tests {
}
}
#[ignore]
#[test]
fn test_insert_message_race_condition() {
MESSAGES.clear();
src/detections/pivot.rs
+7 -1
View File
@@ -91,9 +91,9 @@ mod tests {
use crate::detections::pivot::PIVOT_KEYWORD;
use serde_json;
//PIVOT_KEYWORDはグローバルなので、他の関数の影響も考慮する必要がある。
#[test]
fn insert_pivot_keyword_local_ip4() {
PIVOT_KEYWORD.write().unwrap().clear();
load_pivot_keywords("test_files/config/pivot_keywords.txt");
let record_json_str = r#"
{
@@ -119,6 +119,7 @@ mod tests {
#[test]
fn insert_pivot_keyword_ip4() {
PIVOT_KEYWORD.write().unwrap().clear();
load_pivot_keywords("test_files/config/pivot_keywords.txt");
let record_json_str = r#"
{
@@ -144,6 +145,7 @@ mod tests {
#[test]
fn insert_pivot_keyword_ip_empty() {
PIVOT_KEYWORD.write().unwrap().clear();
load_pivot_keywords("test_files/config/pivot_keywords.txt");
let record_json_str = r#"
{
@@ -169,6 +171,7 @@ mod tests {
#[test]
fn insert_pivot_keyword_local_ip6() {
PIVOT_KEYWORD.write().unwrap().clear();
load_pivot_keywords("test_files/config/pivot_keywords.txt");
let record_json_str = r#"
{
@@ -194,6 +197,7 @@ mod tests {
#[test]
fn insert_pivot_keyword_level_infomational() {
PIVOT_KEYWORD.write().unwrap().clear();
load_pivot_keywords("test_files/config/pivot_keywords.txt");
let record_json_str = r#"
{
@@ -219,6 +223,7 @@ mod tests {
#[test]
fn insert_pivot_keyword_level_low() {
PIVOT_KEYWORD.write().unwrap().clear();
load_pivot_keywords("test_files/config/pivot_keywords.txt");
let record_json_str = r#"
{
@@ -244,6 +249,7 @@ mod tests {
#[test]
fn insert_pivot_keyword_level_none() {
PIVOT_KEYWORD.write().unwrap().clear();
load_pivot_keywords("test_files/config/pivot_keywords.txt");
let record_json_str = r#"
{
src/detections/utils.rs
+1 -1
View File
@@ -410,7 +410,7 @@ pub fn check_rule_config() -> Result<(), String> {
"target_event_IDs.txt",
"default_details.txt",
"level_tuning.txt",
"statistics_event_info.txt",
"event_id_info.txt",
"eventkey_alias.txt",
];
let mut not_exist_file = vec![];
src/main.rs
+6 -6
View File
@@ -11,8 +11,8 @@ use hayabusa::detections::configs::{load_pivot_keywords, TargetEventTime, TARGET
use hayabusa::detections::configs::{CONFIG, CURRENT_EXE_PATH};
use hayabusa::detections::detection::{self, EvtxRecordInfo};
use hayabusa::detections::message::{
AlertMessage, ERROR_LOG_PATH, ERROR_LOG_STACK, LOGONSUMMARY_FLAG, PIVOT_KEYWORD_LIST_FLAG,
QUIET_ERRORS_FLAG, STATISTICS_FLAG,
AlertMessage, ERROR_LOG_PATH, ERROR_LOG_STACK, LOGONSUMMARY_FLAG, METRICS_FLAG,
PIVOT_KEYWORD_LIST_FLAG, QUIET_ERRORS_FLAG,
};
use hayabusa::detections::pivot::PivotKeyword;
use hayabusa::detections::pivot::PIVOT_KEYWORD;
@@ -193,11 +193,11 @@ impl App {
return;
}
if *STATISTICS_FLAG {
if *METRICS_FLAG {
write_color_buffer(
&BufferWriter::stdout(ColorChoice::Always),
None,
"Generating Event ID Statistics",
"Generating Event ID Metrics",
true,
)
.ok();
@@ -565,7 +565,7 @@ impl App {
}
println!();
detection.add_aggcondition_msges(&self.rt);
if !(*STATISTICS_FLAG || *LOGONSUMMARY_FLAG || *PIVOT_KEYWORD_LIST_FLAG) {
if !(*METRICS_FLAG || *LOGONSUMMARY_FLAG || *PIVOT_KEYWORD_LIST_FLAG) {
after_fact(total_records);
}
}
@@ -647,7 +647,7 @@ impl App {
// timeline機能の実行
tl.start(&records_per_detect);
if !(*STATISTICS_FLAG || *LOGONSUMMARY_FLAG) {
if !(*METRICS_FLAG || *LOGONSUMMARY_FLAG) {
// ruleファイルの検知
detection = detection.start(&self.rt, records_per_detect);
}
src/timeline/statistics.rs → src/timeline/metrics.rs
+10 -6
View File
@@ -1,8 +1,9 @@
use crate::detections::message::{LOGONSUMMARY_FLAG, STATISTICS_FLAG};
use crate::detections::message::{LOGONSUMMARY_FLAG, METRICS_FLAG};
use crate::detections::{detection::EvtxRecordInfo, utils};
use hashbrown::HashMap;
#[derive(Debug)]
<<<<<<< HEAD:src/timeline/statistics.rs
pub struct LogEventInfo {
pub channel: String,
pub eventid: String,
@@ -16,6 +17,9 @@ impl LogEventInfo {
#[derive(Debug)]
pub struct EventStatistics {
=======
pub struct EventMetrics {
>>>>>>> ebe89905b51b332817d753847e22758d4b511d5c:src/timeline/metrics.rs
pub total: usize,
pub filepath: String,
pub start_time: String,
@@ -26,7 +30,7 @@ pub struct EventStatistics {
/**
* Windows Event Logの統計情報を出力する
*/
impl EventStatistics {
impl EventMetrics {
pub fn new(
total: usize,
filepath: String,
@@ -34,8 +38,8 @@ impl EventStatistics {
end_time: String,
stats_list: HashMap<String, usize>,
stats_login_list: HashMap<String, [usize; 2]>,
) -> EventStatistics {
EventStatistics {
) -> EventMetrics {
EventMetrics {
total,
filepath,
start_time,
@@ -46,8 +50,8 @@ impl EventStatistics {
}
pub fn evt_stats_start(&mut self, records: &[EvtxRecordInfo]) {
// 引数でstatisticsオプションが指定されている時だけ、統計情報を出力する。
if !*STATISTICS_FLAG {
// 引数でmetricsオプションが指定されている時だけ、統計情報を出力する。
if !*METRICS_FLAG {
return;
}
src/timeline/mod.rs
+1 -1
View File
@@ -1,2 +1,2 @@
pub mod statistics;
pub mod metrics;
pub mod timelines;
src/timeline/timelines.rs
+6 -6
View File
@@ -1,13 +1,13 @@
use crate::detections::message::{LOGONSUMMARY_FLAG, STATISTICS_FLAG};
use crate::detections::message::{LOGONSUMMARY_FLAG, METRICS_FLAG};
use crate::detections::{configs::CONFIG, detection::EvtxRecordInfo};
use comfy_table::*;
use super::statistics::EventStatistics;
use super::metrics::EventMetrics;
use hashbrown::HashMap;
#[derive(Debug)]
pub struct Timeline {
pub stats: EventStatistics,
pub stats: EventMetrics,
}
impl Default for Timeline {
@@ -26,7 +26,7 @@ impl Timeline {
let statsloginlst = HashMap::new();
let statistic =
EventStatistics::new(totalcnt, filepath, starttm, endtm, statslst, statsloginlst);
EventMetrics::new(totalcnt, filepath, starttm, endtm, statslst, statsloginlst);
Timeline { stats: statistic }
}
@@ -36,7 +36,7 @@ impl Timeline {
}
pub fn tm_stats_dsp_msg(&mut self) {
if !*STATISTICS_FLAG {
if !*METRICS_FLAG {
return;
}
// 出力メッセージ作成
@@ -98,7 +98,7 @@ impl Timeline {
.event_timeline_config
.get_event_id(*event_id)
.is_some();
// statistics_event_info.txtに登録あるものは情報設定
// event_id_info.txtに登録あるものは情報設定
if conf {
// 出力メッセージ1行作成
msges.push(format!(