CSEC_PUBLIC/hayabusa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

to remove unnecessary % in csv output

Browse Source
This commit is contained in:
DastInDark
2022-07-29 23:23:23 +09:00
parent 2795a542a0
commit ef546e19eb
1 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
src/detections/detection.rs
View File

@@ -269,11 +269,11 @@ impl Detection {
for target_profile in PRELOAD_PROFILE_REGEX.matches(tmp).into_iter() { for target_profile in PRELOAD_PROFILE_REGEX.matches(tmp).into_iter() {
match PRELOAD_PROFILE[target_profile] { match PRELOAD_PROFILE[target_profile] {
"%Timestamp%" => { "%Timestamp%" => {
profile_converter.insert(k.to_string(), format_time(&time, false)); profile_converter.insert(format!("%{}%", k), format_time(&time, false));
} }
"%Computer%" => { "%Computer%" => {
profile_converter.insert( profile_converter.insert(
k.to_string(), format!("%{}%", k),
record_info.record["Event"]["System"]["Computer"] record_info.record["Event"]["System"]["Computer"]
.to_string() .to_string()
.replace('\"', ""), .replace('\"', ""),
@@ -281,37 +281,37 @@ impl Detection {
} }
"%Channel%" => { "%Channel%" => {
profile_converter.insert( profile_converter.insert(
k.to_string(), format!("%{}%", k),
CH_CONFIG.get(ch_str).unwrap_or(ch_str).to_string(), CH_CONFIG.get(ch_str).unwrap_or(ch_str).to_string(),
); );
} }
"%Level%" => { "%Level%" => {
profile_converter.insert( profile_converter.insert(
k.to_string(), format!("%{}%", k),
LEVEL_ABBR.get(&level).unwrap_or(&level).to_string(), LEVEL_ABBR.get(&level).unwrap_or(&level).to_string(),
); );
} }
"%EventID%" => { "%EventID%" => {
profile_converter.insert(k.to_string(), eid.to_owned()); profile_converter.insert(format!("%{}%", k), eid.to_owned());
} }
"%MitreAttack%" => { "%MitreAttack%" => {
profile_converter.insert(k.to_string(), tag_info.join(" | ")); profile_converter.insert(format!("%{}%", k), tag_info.join(" | "));
} }
"%RecordID%" => { "%RecordID%" => {
profile_converter.insert( profile_converter.insert(
k.to_string(), format!("%{}%", k),
rec_id.as_ref().unwrap_or(&"-".to_string()).to_owned(), rec_id.as_ref().unwrap_or(&"-".to_string()).to_owned(),
); );
} }
"%RuleTitle%" => { "%RuleTitle%" => {
profile_converter.insert( profile_converter.insert(
k.to_string(), format!("%{}%", k),
rule.yaml["title"].as_str().unwrap_or("").to_string(), rule.yaml["title"].as_str().unwrap_or("").to_string(),
); );
} }
"%RecordInformation%" => { "%RecordInformation%" => {
profile_converter.insert( profile_converter.insert(
k.to_string(), format!("%{}%", k),
opt_record_info opt_record_info
.as_ref() .as_ref()
.unwrap_or(&"-".to_string()) .unwrap_or(&"-".to_string())
@@ -319,11 +319,11 @@ impl Detection {
); );
} }
"%RuleFile%" => { "%RuleFile%" => {
profile_converter.insert(k.to_string(), (&rule.rulepath).to_owned()); profile_converter.insert(format!("%{}%", k), (&rule.rulepath).to_owned());
} }
"%EvtxFile%" => { "%EvtxFile%" => {
profile_converter profile_converter
.insert(k.to_string(), record_info.evtx_filepath.to_string()); .insert(format!("%{}%", k), record_info.evtx_filepath.to_string());
} }
_ => {} _ => {}
} }