CSEC_PUBLIC/hayabusa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

refactor

Browse Source
This commit is contained in:
Your Name
2020-10-05 09:08:32 +09:00
parent 1057a72efc
commit dc2e55cc9f
2 changed files with 9 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/detections/detection.rs
View File

@@ -38,12 +38,7 @@ impl Detection {
&common.detection(&event.system, &event_data);
//&common.detection(&event.system, &event_data);
if channel == "Security" {
&security.detection(
event_id,
&event.system,
&event.user_data.as_ref(),
event_data,
);
&security.detection(event_id, &event.system, &event.user_data, event_data);
} else if channel == "System" {
&system.detection(event_id, &event.system, event_data);
} else if channel == "Application" {

13
src/detections/security.rs
View File

@@ -66,7 +66,7 @@ impl Security {
&mut self,
event_id: String,
_system: &event::System,
user_data: &Option<&event::UserData>,
user_data: &Option<event::UserData>,
event_data: HashMap<String, String>,
) {
self.process_craeted(&event_id, &event_data);
@@ -287,16 +287,19 @@ impl Security {
self.passspray_2_user = HashMap::new();
}
fn audit_log_cleared(&mut self, event_id: &String, user_data: &Option<&event::UserData>) {
fn audit_log_cleared(&mut self, event_id: &String, user_data: &Option<event::UserData>) {
if event_id != "1102" {
return;
}
println!("Audit Log Clear");
println!("The Audit log was cleared.");
user_data.and_then(|u| u.log_file_cleared.as_ref());
let username = user_data.and_then(|u| u.log_file_cleared.and_then(|l| l.subject_user_name));
println!("Security ID: {}", username.unwrap_or("".to_string()));
let username = user_data.as_ref().and_then(|u| {
u.log_file_cleared
.as_ref()
.and_then(|l| l.subject_user_name.as_ref())
});
println!("Security ID: {}", username.unwrap_or(&"".to_string()));
}
}