diff --git a/src/detections/configs.rs b/src/detections/configs.rs index f9454f13..561c778f 100644 --- a/src/detections/configs.rs +++ b/src/detections/configs.rs @@ -51,6 +51,7 @@ fn build_app<'a>() -> ArgMatches<'a> { --csv-timeline=[CSV_TIMELINE] 'Csv output timeline' --rfc-2822 'Output date and time in RFC 2822 format. Example: Mon, 07 Aug 2006 12:34:56 -0600' --rfc-3339 'Output date and time in RFC 3339 format. Example: 2006-08-07T12:34:56.485214 -06:00' + --verbose 'Output check information to target event file path and rule file.' -l --lang=[LANG] 'Output language' -L --level=[LEVEL] 'Specified execute rule level(default: INFO)' -u --utc 'Output time in UTC format(default: local time)' diff --git a/src/detections/detection.rs b/src/detections/detection.rs index cc22aee4..428267a4 100644 --- a/src/detections/detection.rs +++ b/src/detections/detection.rs @@ -49,11 +49,11 @@ impl Detection { pub fn parse_rule_files(level: String) -> Vec { // ルールファイルのパースを実行 let mut rulefile_loader = ParseYaml::new(); - let resutl_readdir = rulefile_loader.read_dir(DIRPATH_RULES, &level); - if resutl_readdir.is_err() { + let result_readdir = rulefile_loader.read_dir(DIRPATH_RULES, &level); + if result_readdir.is_err() { AlertMessage::alert( &mut std::io::stderr().lock(), - format!("{}", resutl_readdir.unwrap_err()), + format!("{}", result_readdir.unwrap_err()), ) .ok(); return vec![]; @@ -69,10 +69,10 @@ impl Detection { err_msgs_result.err().iter().for_each(|err_msgs| { let errmsg_body = format!("Failed to parse Rule file. (FilePath : {})", rule.rulepath); - AlertMessage::alert(&mut std::io::stderr().lock(), errmsg_body).ok(); + AlertMessage::warn(&mut std::io::stdout().lock(), errmsg_body).ok(); err_msgs.iter().for_each(|err_msg| { - AlertMessage::alert(&mut std::io::stderr().lock(), err_msg.to_string()).ok(); + AlertMessage::warn(&mut std::io::stdout().lock(), err_msg.to_string()).ok(); }); println!(""); // 一行開けるためのprintln }); diff --git a/src/detections/print.rs b/src/detections/print.rs index e39f7150..cd2968ff 100644 --- a/src/detections/print.rs +++ b/src/detections/print.rs @@ -193,6 +193,9 @@ impl AlertMessage { pub fn alert(w: &mut W, contents: String) -> io::Result<()> { writeln!(w, "[ERROR] {}", contents) } + pub fn warn(w: &mut W, contents: String) -> io::Result<()> { + writeln!(w, "[WARN] {}", contents) + } } #[cfg(test)] @@ -315,4 +318,12 @@ mod tests { let mut stdout = stdout.lock(); AlertMessage::alert(&mut stdout, input.to_string()).expect("[ERROR] TEST!"); } + + #[test] + fn test_warn_message() { + let input = "TESTWarn!"; + let stdout = std::io::stdout(); + let mut stdout = stdout.lock(); + AlertMessage::alert(&mut stdout, input.to_string()).expect("[WARN] TESTWarn!"); + } } diff --git a/src/main.rs b/src/main.rs index 98bdd7ef..c6dd1935 100644 --- a/src/main.rs +++ b/src/main.rs @@ -112,6 +112,9 @@ fn analysis_files(evtx_files: Vec) { let rule_files = detection::Detection::parse_rule_files(level); let mut detection = detection::Detection::new(rule_files); for evtx_file in evtx_files { + if configs::CONFIG.read().unwrap().args.is_present("verbose") { + println!("check target evtx FilePath: {:?}", &evtx_file); + } detection = analysis_file(evtx_file, detection); } diff --git a/src/yaml.rs b/src/yaml.rs index cdf14268..c9006d4e 100644 --- a/src/yaml.rs +++ b/src/yaml.rs @@ -56,8 +56,8 @@ impl ParseYaml { // 個別のファイルの読み込みは即終了としない。 let read_content = self.read_file(path); if read_content.is_err() { - AlertMessage::alert( - &mut std::io::stderr().lock(), + AlertMessage::warn( + &mut std::io::stdout().lock(), format!( "fail to read file: {}\n{} ", entry.path().display(), @@ -70,8 +70,8 @@ impl ParseYaml { // ここも個別のファイルの読み込みは即終了としない。 let yaml_contents = YamlLoader::load_from_str(&read_content.unwrap()); if yaml_contents.is_err() { - AlertMessage::alert( - &mut std::io::stderr().lock(), + AlertMessage::warn( + &mut std::io::stdout().lock(), format!( "fail to parse as yaml: {}\n{} ", entry.path().display(), @@ -96,7 +96,9 @@ impl ParseYaml { if yaml_doc["ignore"].as_bool().unwrap_or(false) { return Option::None; } - + if configs::CONFIG.read().unwrap().args.is_present("verbose") { + println!("Loaded yml FilePath: {}", filepath); + } // 指定されたレベルより低いルールは無視する let doc_level = &yaml_doc["level"] .as_str()