CSEC_PUBLIC/hayabusa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Feature/#158 add rulefilepath column (#168)

Browse Source 
* add level csv column

* update

* Feature/output detect count151 (#167)

* add output process count of detects events #151

* add output process count of detects event when output stdio #151

* add format enter

* update

Co-authored-by: DustInDark <nextsasasa@gmail.com>
This commit is contained in:
James
2021-11-09 00:35:28 +09:00
committed by GitHub
parent c97cf7373a
commit e77a193c5c
7 changed files with 44 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/detections/detection.rs
View File

@@ -85,7 +85,7 @@ impl Detection {
return rulefile_loader
.files
.into_iter()
.map(|rule_file| rule::create_rule(rule_file))
.map(|rule_file_tuple| rule::create_rule(rule_file_tuple.0, rule_file_tuple.1))
.filter_map(return_if_success)
.collect();
}
@@ -156,6 +156,7 @@ impl Detection {
fn insert_message(rule: &RuleNode, record_info: &EvtxRecordInfo) {
MESSAGES.lock().unwrap().insert(
record_info.evtx_filepath.to_string(),
rule.rulepath.to_string(),
&record_info.record,
rule.yaml["level"].as_str().unwrap_or("").to_string(),
rule.yaml["title"].as_str().unwrap_or("").to_string(),
@@ -168,6 +169,7 @@ impl Detection {
let output = Detection::create_count_output(rule, &agg_result);
MESSAGES.lock().unwrap().insert_message(
agg_result.filepath,
rule.rulepath.to_string(),
agg_result.start_timedate,
rule.yaml["level"].as_str().unwrap_or("").to_string(),
rule.yaml["title"].as_str().unwrap_or("").to_string(),