chg: enable pwsh field extraction by default

Yamato-Security · Nov 24, 2023 · 994e320 · 994e320
1 parent 24697f5
commit 994e320
Show file tree

Hide file tree

Showing 13 changed files with 60 additions and 60 deletions.
diff --git a/src/afterfact.rs b/src/afterfact.rs
@@ -1945,7 +1945,7 @@ mod tests {
                 include_eid: None,
                 exclude_eid: None,
                 no_field: false,
-                field_data_extraction: false,
+                no_pwsh_field_extraction: false,
                 remove_duplicate_data: false,
                 remove_duplicate_detections: false,
                 no_wizard: true,
@@ -2035,7 +2035,7 @@ mod tests {
                 include_eid: None,
                 exclude_eid: None,
                 no_field: false,
-                field_data_extraction: false,
+                no_pwsh_field_extraction: false,
                 remove_duplicate_data: false,
                 remove_duplicate_detections: false,
                 no_wizard: true,
@@ -2275,7 +2275,7 @@ mod tests {
                 include_eid: None,
                 exclude_eid: None,
                 no_field: false,
-                field_data_extraction: false,
+                no_pwsh_field_extraction: false,
                 remove_duplicate_data: false,
                 remove_duplicate_detections: false,
                 no_wizard: true,
@@ -2367,7 +2367,7 @@ mod tests {
                 include_eid: None,
                 exclude_eid: None,
                 no_field: false,
-                field_data_extraction: false,
+                no_pwsh_field_extraction: false,
                 remove_duplicate_data: false,
                 remove_duplicate_detections: false,
                 no_wizard: true,
@@ -2593,7 +2593,7 @@ mod tests {
                 include_eid: None,
                 exclude_eid: None,
                 no_field: false,
-                field_data_extraction: false,
+                no_pwsh_field_extraction: false,
                 remove_duplicate_data: true,
                 remove_duplicate_detections: false,
                 no_wizard: true,
@@ -2683,7 +2683,7 @@ mod tests {
                 include_eid: None,
                 exclude_eid: None,
                 no_field: false,
-                field_data_extraction: false,
+                no_pwsh_field_extraction: false,
                 remove_duplicate_data: false,
                 remove_duplicate_detections: false,
                 no_wizard: true,
@@ -2920,7 +2920,7 @@ mod tests {
                 include_eid: None,
                 exclude_eid: None,
                 no_field: false,
-                field_data_extraction: false,
+                no_pwsh_field_extraction: false,
                 remove_duplicate_data: true,
                 remove_duplicate_detections: false,
                 no_wizard: true,
@@ -3010,7 +3010,7 @@ mod tests {
                 include_eid: None,
                 exclude_eid: None,
                 no_field: false,
-                field_data_extraction: false,
+                no_pwsh_field_extraction: false,
                 remove_duplicate_data: true,
                 remove_duplicate_detections: false,
                 no_wizard: true,
@@ -3332,7 +3332,7 @@ mod tests {
             include_eid: None,
             exclude_eid: None,
             no_field: false,
-            field_data_extraction: false,
+            no_pwsh_field_extraction: false,
             remove_duplicate_data: false,
             remove_duplicate_detections: false,
             no_wizard: true,
@@ -3501,7 +3501,7 @@ mod tests {
                 include_eid: None,
                 exclude_eid: None,
                 no_field: false,
-                field_data_extraction: false,
+                no_pwsh_field_extraction: false,
                 remove_duplicate_data: false,
                 remove_duplicate_detections: false,
                 no_wizard: true,
@@ -3590,7 +3590,7 @@ mod tests {
                 include_eid: None,
                 exclude_eid: None,
                 no_field: false,
-                field_data_extraction: false,
+                no_pwsh_field_extraction: false,
                 remove_duplicate_data: false,
                 remove_duplicate_detections: false,
                 no_wizard: true,
@@ -3768,7 +3768,7 @@ mod tests {
                 include_eid: None,
                 exclude_eid: None,
                 no_field: false,
-                field_data_extraction: false,
+                no_pwsh_field_extraction: false,
                 remove_duplicate_data: false,
                 remove_duplicate_detections: false,
                 no_wizard: true,
@@ -3857,7 +3857,7 @@ mod tests {
                 include_eid: None,
                 exclude_eid: None,
                 no_field: false,
-                field_data_extraction: false,
+                no_pwsh_field_extraction: false,
                 remove_duplicate_data: false,
                 remove_duplicate_detections: false,
                 no_wizard: true,

diff --git a/src/detections/configs.rs b/src/detections/configs.rs
@@ -499,8 +499,8 @@ impl StoredStatic {
         };
 
         let field_data_extraction_flag = match &input_config.as_ref().unwrap().action {
-            Some(Action::CsvTimeline(opt)) => opt.output_options.field_data_extraction,
-            Some(Action::JsonTimeline(opt)) => opt.output_options.field_data_extraction,
+            Some(Action::CsvTimeline(opt)) => opt.output_options.no_pwsh_field_extraction,
+            Some(Action::JsonTimeline(opt)) => opt.output_options.no_pwsh_field_extraction,
             _ => false,
         };
 
@@ -1485,14 +1485,14 @@ pub struct OutputOption {
     #[arg(help_heading = Some("General Options"), short='C', long = "clobber", display_order = 290, requires = "output")]
     pub clobber: bool,
 
-    /// Enable PowerShell Classic Data field extraction (default: disabled)
-    #[arg(help_heading = Some("Output"), long = "field-data-extraction", display_order = 390)]
-    pub field_data_extraction: bool,
-
     /// Disable field data mapping
     #[arg(help_heading = Some("Output"), short = 'F', long = "no-field-data-mapping", display_order = 400)]
     pub no_field: bool,
 
+    /// Disable PowerShell Classic Data field extraction
+    #[arg(help_heading = Some("Output"), long = "no-pwsh-field-extraction", display_order = 410)]
+    pub no_pwsh_field_extraction: bool,
+
     /// Duplicate field data will be replaced with "DUP"
     #[arg(
             help_heading = Some("Output"),
@@ -2173,7 +2173,7 @@ fn extract_output_options(config: &Config) -> Option<OutputOption> {
             include_eid: option.include_eid.clone(),
             exclude_eid: option.exclude_eid.clone(),
             no_field: false,
-            field_data_extraction: false,
+            no_pwsh_field_extraction: false,
             remove_duplicate_data: false,
             remove_duplicate_detections: false,
             no_wizard: option.no_wizard,
@@ -2212,7 +2212,7 @@ fn extract_output_options(config: &Config) -> Option<OutputOption> {
             include_eid: None,
             exclude_eid: None,
             no_field: false,
-            field_data_extraction: false,
+            no_pwsh_field_extraction: false,
             remove_duplicate_data: false,
             remove_duplicate_detections: false,
             no_wizard: true,
@@ -2251,7 +2251,7 @@ fn extract_output_options(config: &Config) -> Option<OutputOption> {
             include_eid: None,
             exclude_eid: None,
             no_field: false,
-            field_data_extraction: false,
+            no_pwsh_field_extraction: false,
             remove_duplicate_data: false,
             remove_duplicate_detections: false,
             no_wizard: true,
@@ -2299,7 +2299,7 @@ fn extract_output_options(config: &Config) -> Option<OutputOption> {
             include_eid: None,
             exclude_eid: None,
             no_field: false,
-            field_data_extraction: false,
+            no_pwsh_field_extraction: false,
             remove_duplicate_data: false,
             remove_duplicate_detections: false,
             no_wizard: true,
@@ -2347,7 +2347,7 @@ fn extract_output_options(config: &Config) -> Option<OutputOption> {
             include_eid: None,
             exclude_eid: None,
             no_field: false,
-            field_data_extraction: false,
+            no_pwsh_field_extraction: false,
             remove_duplicate_data: false,
             remove_duplicate_detections: false,
             no_wizard: true,
@@ -2401,7 +2401,7 @@ fn extract_output_options(config: &Config) -> Option<OutputOption> {
             include_eid: None,
             exclude_eid: None,
             no_field: false,
-            field_data_extraction: false,
+            no_pwsh_field_extraction: false,
             remove_duplicate_data: false,
             remove_duplicate_detections: false,
             no_wizard: true,
@@ -2455,7 +2455,7 @@ fn extract_output_options(config: &Config) -> Option<OutputOption> {
             include_eid: None,
             exclude_eid: None,
             no_field: false,
-            field_data_extraction: false,
+            no_pwsh_field_extraction: false,
             remove_duplicate_data: false,
             remove_duplicate_detections: false,
             no_wizard: true,
@@ -2705,7 +2705,7 @@ mod tests {
                     include_eid: None,
                     exclude_eid: None,
                     no_field: false,
-                    field_data_extraction: false,
+                    no_pwsh_field_extraction: false,
                     remove_duplicate_data: false,
                     remove_duplicate_detections: false,
                     no_wizard: true,
@@ -2778,7 +2778,7 @@ mod tests {
                     include_eid: None,
                     exclude_eid: None,
                     no_field: false,
-                    field_data_extraction: false,
+                    no_pwsh_field_extraction: false,
                     remove_duplicate_data: false,
                     remove_duplicate_detections: false,
                     no_wizard: true,

diff --git a/src/detections/detection.rs b/src/detections/detection.rs
@@ -1246,7 +1246,7 @@ mod tests {
                     include_eid: None,
                     exclude_eid: None,
                     no_field: false,
-                    field_data_extraction: false,
+                    no_pwsh_field_extraction: false,
                     remove_duplicate_data: false,
                     remove_duplicate_detections: false,
                     no_wizard: true,
@@ -1508,7 +1508,7 @@ mod tests {
                 include_eid: None,
                 exclude_eid: None,
                 no_field: false,
-                field_data_extraction: false,
+                no_pwsh_field_extraction: false,
                 remove_duplicate_data: false,
                 remove_duplicate_detections: false,
                 no_wizard: true,
@@ -1644,7 +1644,7 @@ mod tests {
                 include_eid: None,
                 exclude_eid: None,
                 no_field: false,
-                field_data_extraction: false,
+                no_pwsh_field_extraction: false,
                 remove_duplicate_data: false,
                 remove_duplicate_detections: false,
                 no_wizard: true,
@@ -1776,7 +1776,7 @@ mod tests {
                 include_eid: None,
                 exclude_eid: None,
                 no_field: false,
-                field_data_extraction: false,
+                no_pwsh_field_extraction: false,
                 remove_duplicate_data: false,
                 remove_duplicate_detections: false,
                 no_wizard: true,
@@ -1921,7 +1921,7 @@ mod tests {
                 include_eid: None,
                 exclude_eid: None,
                 no_field: false,
-                field_data_extraction: false,
+                no_pwsh_field_extraction: false,
                 remove_duplicate_data: false,
                 remove_duplicate_detections: false,
                 no_wizard: true,

diff --git a/src/detections/rule/condition_parser.rs b/src/detections/rule/condition_parser.rs
@@ -606,7 +606,7 @@ mod tests {
                     include_eid: None,
                     exclude_eid: None,
                     no_field: false,
-                    field_data_extraction: false,
+                    no_pwsh_field_extraction: false,
                     remove_duplicate_data: false,
                     remove_duplicate_detections: false,
                     no_wizard: true,

diff --git a/src/detections/rule/count.rs b/src/detections/rule/count.rs
@@ -630,7 +630,7 @@ mod tests {
                     include_eid: None,
                     exclude_eid: None,
                     no_field: false,
-                    field_data_extraction: false,
+                    no_pwsh_field_extraction: false,
                     remove_duplicate_data: false,
                     remove_duplicate_detections: false,
                     no_wizard: true,

diff --git a/src/detections/rule/matchers.rs b/src/detections/rule/matchers.rs
@@ -865,7 +865,7 @@ mod tests {
                     include_eid: None,
                     exclude_eid: None,
                     no_field: false,
-                    field_data_extraction: false,
+                    no_pwsh_field_extraction: false,
                     remove_duplicate_data: false,
                     remove_duplicate_detections: false,
                     no_wizard: true,

diff --git a/src/detections/rule/mod.rs b/src/detections/rule/mod.rs
@@ -450,7 +450,7 @@ mod tests {
                     include_eid: None,
                     exclude_eid: None,
                     no_field: false,
-                    field_data_extraction: false,
+                    no_pwsh_field_extraction: false,
                     remove_duplicate_data: false,
                     remove_duplicate_detections: false,
                     no_wizard: true,

diff --git a/src/detections/rule/selectionnodes.rs b/src/detections/rule/selectionnodes.rs
@@ -573,7 +573,7 @@ mod tests {
                     include_eid: None,
                     exclude_eid: None,
                     no_field: false,
-                    field_data_extraction: false,
+                    no_pwsh_field_extraction: false,
                     remove_duplicate_data: false,
                     remove_duplicate_detections: false,
                     no_wizard: true,

diff --git a/src/detections/utils.rs b/src/detections/utils.rs
@@ -304,7 +304,7 @@ pub fn create_rec_info(
     path: String,
     keys: &Nested<String>,
     recovered_record: &bool,
-    enable_field_extraction: &bool,
+    no_pwsh_field_extraction: &bool,
 ) -> EvtxRecordInfo {
     // 高速化のための処理
 
@@ -330,7 +330,7 @@ pub fn create_rec_info(
             continue;
         }
 
-        if *enable_field_extraction {
+        if !*no_pwsh_field_extraction {
             if key == "EventID" {
                 event_id = val.clone();
             }
@@ -340,7 +340,7 @@ pub fn create_rec_info(
         }
         key_2_values.insert(key.to_string(), val.unwrap());
     }
-    if *enable_field_extraction {
+    if !*no_pwsh_field_extraction {
         extract_fields(channel, event_id, &mut data);
     }
 
@@ -1071,7 +1071,7 @@ mod tests {
                     include_eid: None,
                     exclude_eid: None,
                     no_field: false,
-                    field_data_extraction: false,
+                    no_pwsh_field_extraction: false,
                     remove_duplicate_data: false,
                     remove_duplicate_detections: false,
                     no_wizard: true,