Added for target %AllFieldInfo% alias to json object output #750

Yamato-Security · Oct 22, 2022 · 1fb3440 · 1fb3440
1 parent 204cf09
commit 1fb3440
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 5 deletions.
diff --git a/config/profiles.yaml b/config/profiles.yaml
@@ -43,7 +43,7 @@ all-field-info:
     Level: "%Level%"
     RecordID: "%RecordID%"
     RuleTitle: "%RuleTitle%"
-    AllFieldInfo: "%RecordInformation%"
+    AllFieldInfo: "%AllFieldInfo%"
     RuleFile: "%RuleFile%"
     EvtxFile: "%EvtxFile%"
 
@@ -59,7 +59,7 @@ all-field-info-verbose:
     OtherTags: "%OtherTags%"
     RecordID: "%RecordID%"
     RuleTitle: "%RuleTitle%"
-    AllFieldInfo: "%RecordInformation%"
+    AllFieldInfo: "%AllFieldInfo%"
     RuleFile: "%RuleFile%"
     EvtxFile: "%EvtxFile%"
 
@@ -82,7 +82,7 @@ super-verbose:
     Details: "%Details%"
     RuleFile: "%RuleFile%"
     EvtxFile: "%EvtxFile%"
-    AllFieldInfo: "%RecordInformation%"
+    AllFieldInfo: "%AllFieldInfo%"
 
 #Output that is compatible to import the CSV into Timesketch
 timesketch-minimal:
@@ -117,4 +117,4 @@ timesketch-verbose:
     Details: "%Details%"
     RuleFile: "%RuleFile%"
     EvtxFile: "%EvtxFile%"
-    AllFieldInfo: "%RecordInformation%"
+    AllFieldInfo: "%AllFieldInfo%"
diff --git a/src/afterfact.rs b/src/afterfact.rs
@@ -933,7 +933,7 @@ fn _get_json_vec(target_alias_context: &str, target_data: &String) -> Vec<String
             .map(|x| x.to_string())
             .collect();
         ret
-    } else if target_alias_context.contains("%Details%") {
+    } else if target_alias_context.contains("%Details%") || target_alias_context.contains("%AllFieldInfo%") {
         let ret: Vec<String> = target_data
             .to_owned()
             .split(" ¦ ")