Merge branch 'feature/code_refactor'

This commit is contained in:
akiranishikawa
2020-09-29 20:09:39 +09:00
4 changed files with 51 additions and 66 deletions

View File

@@ -8,7 +8,6 @@ use crate::models::event;
use evtx::EvtxParser;
use quick_xml::de::DeError;
use std::collections::BTreeMap;
use std::collections::HashMap;
#[derive(Debug)]
pub struct Detection {

View File

@@ -42,10 +42,9 @@ impl Security {
// Special privileges assigned to new logon (possible admin access)
//
fn se_debug_privilege(&mut self, event_data: HashMap<String, String>) {
match event_data.get("PrivilegeList") {
Some(privileage_list) => {
match privileage_list.find("SeDebugPrivilege") {
Some(_data) => {
if let Some(privileage_list) = event_data.get("PrivilegeList") {
if let Some(_data) = privileage_list.find("SeDebugPrivilege") {
// alert_all_adminが有効であれば、標準出力して知らせる
// DeepBlueCLIでは必ず0になっていて、基本的には表示されない。
if self.alert_all_admin == 1 {
@@ -88,10 +87,6 @@ impl Security {
}
}
}
None => (),
}
}
None => (),
}
}
}

View File

@@ -4,7 +4,7 @@ extern crate serde;
use clap::{App, AppSettings, Arg};
use evtx::EvtxParser;
use quick_xml::de::DeError;
use std::{env, path::PathBuf, process};
use std::{path::PathBuf, process};
use yamato_event_analyzer::detections::detection;
fn build_app() -> clap::App<'static, 'static> {
@@ -38,9 +38,8 @@ fn main() -> Result<(), DeError> {
let args = build_app().get_matches();
let filepath: Option<&str> = args.value_of("filepath");
match filepath {
Some(filepath) => parse_file(filepath),
None => (),
if let Some(filepath) = filepath {
parse_file(filepath);
}
Ok(())

View File

@@ -85,12 +85,11 @@ impl Evtx {
// 文字列データを取得する
//
fn get_string(v: &Data) -> String {
match &v.text {
Some(text) => {
return text.to_string();
}
_ => return "".to_string(),
let mut ret = "".to_string();
if let Some(text) = &v.text {
ret = text.to_string();
}
return ret;
}
//
@@ -99,22 +98,15 @@ impl Evtx {
pub fn parse_event_data(&self) -> HashMap<String, String> {
let mut values = HashMap::new();
match &self.event_data {
Some(event_data) => match &event_data.data {
Some(data) => {
if let Some(event_data) = &self.event_data {
if let Some(data) = &event_data.data {
for v in data.iter() {
match &v.name {
Some(name) => {
if let Some(name) = &v.name {
values.insert(name.to_string(), Evtx::get_string(v));
}
None => (),
}
}
}
None => (),
},
None => (),
}
values
}