feat: update

Yamato-Security · Dec 17, 2024 · e3169d4 · e3169d4
1 parent e1903a7
commit e3169d4
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/src/detections/detection.rs b/src/detections/detection.rs
@@ -221,7 +221,7 @@ impl Detection {
                 }
             }
         }
-        // temporalルールの結果は個々ルールの判定がすべて出揃ってから判定できるため、再度rulesをループしてtemporalルールの判定を行う
+        // temporalルールは個々ルールの判定がすべて出揃ってから判定できるため、再度rulesをループしてtemporalルールの判定を行う
         for rule in self.rules.iter() {
             if let CorrelationType::Temporal(ref_ids) = &rule.correlation_type {
                 if ref_ids
@@ -232,11 +232,13 @@ impl Detection {
                         .iter()
                         .filter_map(|id| detected_temporal_refs.get(id))
                         .collect();
+
                     let flattened_values: Vec<AggResult> = matched_values
                         .into_iter()
                         .flat_map(|v| v.clone())
                         .sorted_by(|a, b| a.start_timedate.cmp(&b.start_timedate))
                         .collect();
+
                     let agg_result = flattened_values.first().unwrap();
                     ret.push(Detection::create_agg_log_record(
                         rule,

diff --git a/src/detections/rule/correlation_parser.rs b/src/detections/rule/correlation_parser.rs
@@ -367,7 +367,7 @@ fn parse_temporal_rules(
                             _cmp_num: 1,
                         };
                         let mut detection = DetectionNode::new();
-                        detection.name_to_selection = node.detection.name_to_selection.clone();
+                        detection.name_to_selection = node.detection.name_to_selection;
                         detection.condition = node.detection.condition;
                         detection.timeframe = Some(time_frame.unwrap());
                         detection.aggregation_condition = Some(agg_info);