-
Notifications
You must be signed in to change notification settings - Fork 18
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Bugfix: Support multiple messages for the same Event ID
Some event ID have multiple messages stored in the message lists - these are generally designed for events which have different number of properties. So for example the message file might contain two messages for the same event id, one with 1 expansion and one with 2 expansions. Then the application might emit an event to the log file with 2 properties or only 1 property of the same event id. This pr stores both the messages and the number of expasions in the message set and is able to select the most appropriate one for each message - we aim to maximize the number of expasions available in the message string.
- Loading branch information
Showing
7 changed files
with
139 additions
and
57 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,79 @@ | ||
| package evtx | ||
|
|
||
| import ( | ||
| "regexp" | ||
| "strconv" | ||
| "sync" | ||
| ) | ||
|
|
||
| var ( | ||
| expansionRegex = regexp.MustCompile("%[0-9]+") | ||
| ) | ||
|
|
||
| type MessageSet struct { | ||
| mu sync.Mutex | ||
| Provider string | ||
| Channel string | ||
| Messages map[int]string | ||
| Parameters map[int]string | ||
| } | ||
|
|
||
| func (self *MessageSet) AddMessage(event_id int, message string) { | ||
| self.mu.Lock() | ||
| defer self.mu.Unlock() | ||
|
|
||
| number_of_expansions := self.getLargestExpansion(message) | ||
| key := event_id<<16 | number_of_expansions | ||
|
|
||
| self.Messages[key] = message | ||
| } | ||
|
|
||
| func (self *MessageSet) AddParameter(event_id int, message string) { | ||
| self.mu.Lock() | ||
| defer self.mu.Unlock() | ||
|
|
||
| self.Parameters[event_id] = message | ||
| } | ||
|
|
||
| func (self *MessageSet) GetParameter(id int) string { | ||
| self.mu.Lock() | ||
| defer self.mu.Unlock() | ||
|
|
||
| res, _ := self.Parameters[id] | ||
| return res | ||
| } | ||
|
|
||
| // Calculates the largest expansion number from the message string. | ||
| func (self *MessageSet) getLargestExpansion(message string) int { | ||
| res := 0 | ||
|
|
||
| for _, m := range expansionRegex.FindAllString(message, -1) { | ||
| val, err := strconv.Atoi(m[1:]) | ||
| if err == nil { | ||
| val-- | ||
| if val > res { | ||
| res = val | ||
| } | ||
| } | ||
| } | ||
|
|
||
| return res | ||
| } | ||
|
|
||
| // Sometimes a number of message strings are generated for each event | ||
| // id. This function finds the most appropriate message string with | ||
| // the most expansions relevant for this event. | ||
| func (self *MessageSet) GetBestMessage( | ||
| event_id, number_of_expansions int) string { | ||
| self.mu.Lock() | ||
| defer self.mu.Unlock() | ||
|
|
||
| for i := number_of_expansions; i > 0; i-- { | ||
| key := event_id<<16 | i | ||
| res, pres := self.Messages[key] | ||
| if pres { | ||
| return res | ||
| } | ||
| } | ||
| return "" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters