Merge pull request #988 from Yamato-Security/improve_speed_by_removed…

…_unnecessary_trim perf: replaced trim method in afterfact with process in detection
Yamato-Security · Apr 6, 2023 · 1e7e7e2 · 1e7e7e2
2 parents 4e58d78 + 9c99950
commit 1e7e7e2
Show file tree

Hide file tree

Showing 4 changed files with 20 additions and 16 deletions.
diff --git a/src/afterfact.rs b/src/afterfact.rs
@@ -397,7 +397,7 @@ fn emit_csv<W: std::io::Write>(
                 wtr.write_record(detect_info.ext_field.iter().map(|x| {
                     output_remover.replace_all(
                         &output_replacer.replace_all(
-                            x.1.to_value().trim(),
+                            &x.1.to_value(),
                             &output_replaced_maps.values().collect_vec(),
                         ),
                         &removed_replaced_maps.values().collect_vec(),

diff --git a/src/detections/detection.rs b/src/detections/detection.rs
@@ -277,7 +277,8 @@ impl Detection {
                         key.as_str(),
                         Computer(
                             record_info.record["Event"]["System"]["Computer"]
-                                .to_string()
+                                .as_str()
+                                .unwrap_or_default()
                                 .replace('\"', "")
                                 .into(),
                         ),
@@ -303,11 +304,13 @@ impl Detection {
                 }
                 Level(_) => {
                     let str_level = level.as_str();
-                    let prof_level = LEVEL_ABBR_MAP
-                        .get(str_level)
-                        .unwrap_or(&str_level)
-                        .to_string();
-                    profile_converter.insert(key.as_str(), Level(prof_level.into()));
+                    let abbr_level = LEVEL_ABBR_MAP.get(str_level).unwrap_or(&str_level);
+                    let prof_level = if stored_static.output_path.is_none() {
+                        abbr_level
+                    } else {
+                        abbr_level.trim()
+                    };
+                    profile_converter.insert(key.as_str(), Level(prof_level.to_string().into()));
                 }
                 EventID(_) => {
                     profile_converter.insert(key.as_str(), EventID(eid.to_string().into()));
@@ -350,7 +353,7 @@ impl Detection {
                 }
                 MitreTactics(_) => {
                     let tactics = CompactString::from(
-                        &tag_info
+                        tag_info
                             .iter()
                             .filter(|x| tags_config_values.contains(&&CompactString::from(*x)))
                             .join(" ¦ "),
@@ -695,12 +698,13 @@ impl Detection {
                 }
                 Level(_) => {
                     let str_level = level.as_str();
-                    let prof_level = LEVEL_ABBR_MAP
-                        .get(str_level)
-                        .unwrap_or(&str_level)
-                        .to_string();
-
-                    profile_converter.insert(key.as_str(), Level(prof_level.into()));
+                    let abbr_level = LEVEL_ABBR_MAP.get(str_level).unwrap_or(&str_level);
+                    let prof_level = if stored_static.output_path.is_none() {
+                        abbr_level
+                    } else {
+                        abbr_level.trim()
+                    };
+                    profile_converter.insert(key.as_str(), Level(prof_level.to_string().into()));
                 }
                 EventID(_) => {
                     profile_converter.insert(key.as_str(), EventID("-".into()));

diff --git a/src/detections/message.rs b/src/detections/message.rs
@@ -164,7 +164,7 @@ pub fn insert(
                 ))
             }
             _ => {
-                if let Some(p) = profile_converter.get(key.to_string().as_str()) {
+                if let Some(p) = profile_converter.get(key.as_str()) {
                     replaced_profiles.push((
                         key.to_owned(),
                         profile.convert(&parse_message(

diff --git a/src/detections/utils.rs b/src/detections/utils.rs
@@ -437,7 +437,7 @@ fn _collect_recordinfo<'a>(
  * 最初の文字を大文字にする関数
  */
 pub fn make_ascii_titlecase(s: &str) -> CompactString {
-    let mut c = s.chars();
+    let mut c = s.trim().chars();
     match c.next() {
         None => CompactString::default(),
         Some(f) => {