134 lines
3.4 KiB
Rust
134 lines
3.4 KiB
Rust
extern crate serde;
|
|
use serde::Deserialize;
|
|
use std::collections::HashMap;
|
|
|
|
#[derive(Debug, Deserialize, PartialEq)]
|
|
pub struct Data {
|
|
#[serde(rename = "Name")]
|
|
pub name: Option<String>,
|
|
#[serde(rename = "$value")]
|
|
pub text: Option<String>,
|
|
}
|
|
|
|
#[derive(Debug, Deserialize, PartialEq)]
|
|
pub struct TimeCreated {
|
|
#[serde(rename = "SystemTime")]
|
|
pub system_time: String,
|
|
}
|
|
|
|
#[derive(Debug, Deserialize, PartialEq)]
|
|
struct Execution {
|
|
#[serde(rename = "ProcessID")]
|
|
process_id: i32,
|
|
#[serde(rename = "ThreadID")]
|
|
thread_id: i32,
|
|
}
|
|
|
|
#[derive(Debug, Deserialize, PartialEq)]
|
|
pub struct Provider {
|
|
#[serde(rename = "Name")]
|
|
pub name: Option<String>,
|
|
#[serde(rename = "Guid")]
|
|
guid: Option<String>,
|
|
}
|
|
|
|
#[derive(Debug, Deserialize, PartialEq)]
|
|
pub struct System {
|
|
#[serde(rename = "Provider")]
|
|
pub provider: Provider,
|
|
#[serde(rename = "EventID")]
|
|
pub event_id: String,
|
|
#[serde(rename = "Version")]
|
|
pub version: Option<String>,
|
|
#[serde(rename = "Level")]
|
|
level: String,
|
|
#[serde(rename = "Task")]
|
|
task: String,
|
|
#[serde(rename = "Opcode")]
|
|
opcode: Option<String>,
|
|
#[serde(rename = "Keywords")]
|
|
keywords: String,
|
|
#[serde(rename = "TimeCreated")]
|
|
pub time_created: TimeCreated,
|
|
#[serde(rename = "EventRecordID")]
|
|
pub event_record_id: String,
|
|
#[serde(rename = "Correlation")]
|
|
correlation: Option<String>,
|
|
#[serde(rename = "Execution")]
|
|
execution: Option<Execution>,
|
|
#[serde(rename = "Channel")]
|
|
pub channel: String, // Security, System, Application ...etc
|
|
#[serde(rename = "Computer")]
|
|
computer: String,
|
|
#[serde(rename = "Security")]
|
|
security: String,
|
|
#[serde(rename = "Message")]
|
|
pub message: Option<String>,
|
|
}
|
|
|
|
#[derive(Debug, Deserialize, PartialEq)]
|
|
pub struct EventData {
|
|
#[serde(rename = "Data")]
|
|
pub data: Option<Vec<Data>>,
|
|
}
|
|
|
|
#[derive(Debug, Deserialize, PartialEq)]
|
|
pub struct UserData {
|
|
#[serde(rename = "LogFileCleared")]
|
|
pub log_file_cleared: Option<LogFileCleared>,
|
|
}
|
|
|
|
#[derive(Debug, Deserialize, PartialEq)]
|
|
pub struct LogFileCleared {
|
|
#[serde(rename = "SubjectUserSid")]
|
|
pub subject_user_sid: Option<String>,
|
|
#[serde(rename = "SubjectUserName")]
|
|
pub subject_user_name: Option<String>,
|
|
#[serde(rename = "SubjectDomainName")]
|
|
pub subject_domain_name: Option<String>,
|
|
#[serde(rename = "SubjectLogonId")]
|
|
pub subject_logon_id: Option<String>,
|
|
}
|
|
|
|
#[derive(Debug, Deserialize, PartialEq)]
|
|
pub struct Evtx {
|
|
#[serde(rename = "System")]
|
|
pub system: System,
|
|
#[serde(rename = "EventData")]
|
|
pub event_data: Option<EventData>,
|
|
#[serde(rename = "UserData")]
|
|
pub user_data: Option<UserData>,
|
|
}
|
|
|
|
impl Evtx {
|
|
//
|
|
// 文字列データを取得する
|
|
//
|
|
fn get_string(v: &Data) -> String {
|
|
let mut ret = "".to_string();
|
|
if let Some(text) = &v.text {
|
|
ret = text.to_string();
|
|
}
|
|
return ret;
|
|
}
|
|
|
|
//
|
|
// EventDataをHashMapとして取得する
|
|
//
|
|
pub fn parse_event_data(&self) -> HashMap<String, String> {
|
|
let mut values = HashMap::new();
|
|
|
|
if let Some(event_data) = &self.event_data {
|
|
if let Some(data) = &event_data.data {
|
|
for v in data.iter() {
|
|
if let Some(name) = &v.name {
|
|
values.insert(name.to_string(), Evtx::get_string(v));
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
values
|
|
}
|
|
}
|