(filters map[*config.FilterConfig]filter.Filter)
| 136 | } |
| 137 | |
| 138 | func (c *compiler) buildCompileResult(filters map[*config.FilterConfig]filter.Filter) *config.RulesCompileResult { |
| 139 | rs := &config.RulesCompileResult{} |
| 140 | |
| 141 | m := make(map[event.Type]bool) |
| 142 | events := make([]event.Type, 0) |
| 143 | |
| 144 | for _, f := range filters { |
| 145 | rs.NumberRules++ |
| 146 | for name, values := range f.GetStringFields() { |
| 147 | for _, v := range values { |
| 148 | if name == fields.EvtName || name == fields.EvtCategory { |
| 149 | types := event.NameToTypes(v) |
| 150 | for _, typ := range types { |
| 151 | switch typ.Category() { |
| 152 | case event.Process: |
| 153 | rs.HasProcEvents = true |
| 154 | case event.Thread: |
| 155 | rs.HasThreadEvents = true |
| 156 | case event.Module: |
| 157 | rs.HasModuleEvents = true |
| 158 | case event.File: |
| 159 | rs.HasFileEvents = true |
| 160 | case event.Net: |
| 161 | rs.HasNetworkEvents = true |
| 162 | case event.Registry: |
| 163 | rs.HasRegistryEvents = true |
| 164 | case event.Mem: |
| 165 | rs.HasMemEvents = true |
| 166 | case event.Handle: |
| 167 | rs.HasHandleEvents = true |
| 168 | case event.Threadpool: |
| 169 | rs.HasThreadpoolEvents = true |
| 170 | } |
| 171 | if typ.Subcategory() == event.DNS { |
| 172 | rs.HasDNSEvents = true |
| 173 | } |
| 174 | if typ == event.MapViewFile || typ == event.UnmapViewFile { |
| 175 | rs.HasVAMapEvents = true |
| 176 | } |
| 177 | if typ == event.OpenProcess || typ == event.OpenThread || typ == event.SetThreadContext || |
| 178 | typ == event.CreateSymbolicLinkObject { |
| 179 | rs.HasAuditAPIEvents = true |
| 180 | } |
| 181 | |
| 182 | if m[typ] { |
| 183 | continue |
| 184 | } |
| 185 | |
| 186 | events = append(events, typ) |
| 187 | m[typ] = true |
| 188 | } |
| 189 | } |
| 190 | } |
| 191 | } |
| 192 | } |
| 193 | |
| 194 | rs.UsedEvents = events |
| 195 |
no test coverage detected