fix(metrics/timelines): fixed Unknown output due to lowercase convert #…

…943
Yamato-Security · Feb 28, 2023 · 3f8273b · 3f8273b
1 parent d79ed2e
commit 3f8273b
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 5 deletions.
diff --git a/src/detections/configs.rs b/src/detections/configs.rs
@@ -1480,7 +1480,7 @@ fn load_eventcode_info(path: &str) -> EventInfoConfig {
             evttitle: event_title.to_string(),
         };
         config.eventinfo.insert(
-            (channel.to_owned(), eventcode.to_owned()),
+            (channel.to_lowercase(), eventcode.to_owned()),
             infodata.to_owned(),
         );
     });

diff --git a/src/timeline/metrics.rs b/src/timeline/metrics.rs
@@ -140,9 +140,9 @@ impl EventMetrics {
             let channel = if let Some(ch) =
                 utils::get_event_value("Channel", &record.record, &stored_static.eventkey_alias)
             {
-                ch.to_string().replace('\"', "").to_lowercase()
+                ch.as_str().unwrap()
             } else {
-                "-".to_string()
+                "-"
             };
             if let Some(idnum) =
                 utils::get_event_value("EventID", &record.record, &stored_static.eventkey_alias)
@@ -151,7 +151,7 @@ impl EventMetrics {
                     .stats_list
                     .entry((
                         idnum.to_string().replace('\"', "").to_lowercase().into(),
-                        channel.into(),
+                        channel.to_lowercase().into(),
                     ))
                     .or_insert(0);
                 *count += 1;

diff --git a/src/timeline/timelines.rs b/src/timeline/timelines.rs
@@ -200,7 +200,7 @@ impl Timeline {
             let ch = stored_static.disp_abbr_generic.replace_all(
                 stored_static
                     .ch_config
-                    .get(fmted_channel.to_lowercase().as_str())
+                    .get(fmted_channel.as_str())
                     .unwrap_or(fmted_channel)
                     .as_str(),
                 &stored_static.disp_abbr_general_values,