RecordIDのチェック,構造体の名称変更

src/detections/common.rs

@@ -0,0 +1,48 @@
+use std::collections::HashMap;
+use crate::models::event;
+
+#[derive(Debug)]
+pub struct Common {
+    record_id: u64,
+    date: String,
+    record_id_list : HashMap<String, String>,
+}
+
+impl Common {
+    pub fn new() -> Common {
+        Common {
+            record_id: 0,
+            date: "".to_string(),
+            record_id_list: HashMap::new(),
+        }
+    }
+
+    pub fn disp(&self) {
+        for (record_id, date) in self.record_id_list.iter() { 
+            println!("date:{:?} record-id: {:?}", date, record_id);
+        }
+    }
+
+    pub fn detection(&mut self, system: &event::System, event_data: &HashMap<String, String>) {
+    
+        &self.check_record_id(system);
+
+    }
+    
+
+    //
+    // Record IDがシーケンスになっているかチェック
+    //
+    fn check_record_id(&mut self, system: &event::System) {
+    
+        let event_record_id: u64 = system.event_record_id.parse().unwrap();
+        if self.record_id > 0 && event_record_id - self.record_id > 1 {
+            self.record_id_list.insert(self.record_id.to_string() + " - " + &system.event_record_id.to_string(), 
+                self.date.to_string() + " - " + &system.time_created.system_time.to_string());
+        }
+        self.record_id = event_record_id;
+        self.date = system.time_created.system_time.to_string();
+    }
+
+}
+

src/detections/mod.rs

@@ -1,3 +1,4 @@
+pub mod common;
 pub mod security;
 pub mod system;
 pub mod application;

src/detections/security.rs

@@ -1,4 +1,5 @@
 use std::collections::HashMap;
+use crate::models::event;
 
 #[derive(Debug)]
 pub struct Security {
@@ -26,7 +27,7 @@ impl Security {
         }
     }
 
-    pub fn detection(&mut self, event_id: String, event_data: HashMap<String, String>) {
+    pub fn detection(&mut self, event_id: String, system: &event::System, event_data: HashMap<String, String>) {
     
         if event_id == "4672" {
             &self.se_debug_privilege(event_data);
@@ -41,7 +42,7 @@ impl Security {
         match event_data.get("PrivilegeList") {
             Some(privileage_list) => {
                 match privileage_list.find("SeDebugPrivilege") {
-                    Some(data) => {
+                    Some(_data) => {
     
                         // alert_all_adminが有効であれば、標準出力して知らせる
                         // DeepBlueCLIでは必ず0になっていて、基本的には表示されない。