diff --git a/config/linux/rules.yml b/config/linux/rules.yml new file mode 100644 index 0000000..cc7aa5c --- /dev/null +++ b/config/linux/rules.yml @@ -0,0 +1,5 @@ +rules: + - id: 1 + path: /etc + rule: '\.sh$' + message: "Shell script present in /etc folder." \ No newline at end of file diff --git a/config/macos/rules.yml b/config/macos/rules.yml new file mode 100644 index 0000000..cc7aa5c --- /dev/null +++ b/config/macos/rules.yml @@ -0,0 +1,5 @@ +rules: + - id: 1 + path: /etc + rule: '\.sh$' + message: "Shell script present in /etc folder." \ No newline at end of file diff --git a/config/windows/rules.yml b/config/windows/rules.yml index 81628b1..73b7b39 100644 --- a/config/windows/rules.yml +++ b/config/windows/rules.yml @@ -1,6 +1,5 @@ -monitor: - - path: C:\tmp\ - id: 7 - rule: '\.php$' - message: "This is a test" - labels: ["windows", "test"] \ No newline at end of file +rules: + - id: 1 + path: C:\ + rule: '\.ps1$' + message: "Powershell script present in root directory." \ No newline at end of file diff --git a/src/auditevent.rs b/src/auditevent.rs index 714b2aa..1c95dc1 100644 --- a/src/auditevent.rs +++ b/src/auditevent.rs @@ -504,7 +504,6 @@ impl fmt::Debug for Event { mod tests { use super::*; use crate::auditevent::Event; - use crate::appconfig::*; use tokio_test::block_on; use std::fs; diff --git a/src/integration.rs b/src/integration.rs index 17e7e52..cdbbc2f 100644 --- a/src/integration.rs +++ b/src/integration.rs @@ -144,8 +144,8 @@ mod tests { // ------------------------------------------------------------------------ #[cfg(any(target_os = "linux", target_os = "darwin"))] - pub fn create_dummy_event_unix(path: &str, operation: &str) -> Event { - Event{ + pub fn create_dummy_event_unix(path: &str, operation: &str) -> MonitorEvent { + MonitorEvent{ id: "Test_id".to_string(), timestamp: "Timestamp".to_string(), hostname: "Hostname".to_string(), diff --git a/src/main.rs b/src/main.rs index 5c93b1d..920e2dd 100644 --- a/src/main.rs +++ b/src/main.rs @@ -46,8 +46,9 @@ async fn main() { let (cfg, ruleset) = init(); let (tx, rx) = mpsc::channel(); + let rotator_cfg = cfg.clone(); match thread::Builder::new() - .name("FIM_Rotator".to_string()).spawn(|| rotator::rotator(cfg)){ + .name("FIM_Rotator".to_string()).spawn(|| rotator::rotator(rotator_cfg)){ Ok(_v) => info!("FIM rotator thread started."), Err(e) => error!("Could not start FIM rotator thread, error: {}", e) };