enabled recover record option in hayabusa-evtx crate #952

[hitenkoku]

What Changed

• enabled recover record option in hayabusa-evtx crate

Evidence

#952 (comment)

[YamatoSecurity]

@hitenkoku Thanks!
When running on a directory of files I get the following error:

thread 'hayabusa-thread' panicked at 'called `Option::unwrap()` on a `None` value', src/detections/rule/selectionnodes.rs:453:36
thread 'hayabusa-thread' panicked at 'called `Option::unwrap()` on a `None` value', src/detections/rule/selectionnodes.rsthread ':hayabusa-thread' panicked at 'called `Option::unwrap()` on a `None` value453', :src/detections/rule/selectionnodes.rs36:
453:36
thread 'hayabusa-thread' panicked at 'called `Option::unwrap()` on a `None` value', src/detections/rule/selectionnodes.rsthread 'thread 'hayabusa-thread:' panicked at '453hayabusa-thread:called `Option::unwrap()` on a `None` value' panicked at '36', called `Option::unwrap()` on a `None` value
src/detections/rule/selectionnodes.rs:453', src/detections/rule/selectionnodes.rs::45336:
36

[hitenkoku]

@YamatoSecurity Thanks for your comment.

I fixed error in 95af61b.

Would you check it?

[codecov]

Codecov Report

Patch coverage: 56.06% and project coverage change: -0.13% ⚠️

Comparison is base (a160864) 83.17% compared to head (a1a1e48) 83.04%.
Report is 26 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1147      +/-   ##
==========================================
- Coverage   83.17%   83.04%   -0.13%     
==========================================
  Files          26       26              
  Lines       22618    22728     +110     
==========================================
+ Hits        18812    18874      +62     
- Misses       3806     3854      +48     

Files Changed	Coverage Δ
src/afterfact.rs	74.67% <38.59%> (-0.62%)	⬇️
src/main.rs	68.31% <48.64%> (-0.13%)	⬇️
src/detections/configs.rs	66.64% <66.66%> (+<0.01%)	⬆️
src/detections/detection.rs	75.63% <100.00%> (+0.06%)	⬆️
src/detections/rule/condition_parser.rs	96.99% <100.00%> (+<0.01%)	⬆️
src/detections/rule/count.rs	93.60% <100.00%> (+<0.01%)	⬆️
src/detections/rule/matchers.rs	97.08% <100.00%> (+<0.01%)	⬆️
src/detections/rule/mod.rs	94.73% <100.00%> (+<0.01%)	⬆️
src/detections/rule/selectionnodes.rs	92.28% <100.00%> (+0.01%)	⬆️
src/detections/utils.rs	92.39% <100.00%> (+<0.01%)	⬆️
... and 6 more

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[YamatoSecurity]

@hitenkoku Thanks! I updated the haybusa-evtx crate and added a short option -x.
The previous error we had was fixed but now I get this error:

thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: DeserializationError(InvalidEvtxRecordHeaderMagic { magic: [0, 0, 0, 0] })', src/main.rs:1165:43

Could you check this?

[YamatoSecurity]

By the way, I am not using the --recover-records option when this error happens...

[YamatoSecurity]

@hitenkoku Things are working well for me now. Thank you!
@fukusuket Just in case, could you check this as well?

[fukusuket]

I have verified that there is no difference in the results(hayabusa-sample-evtx) below! LGTM!!🚀

• 2.7.0 : csv-timeline(json-timeline) -p super-verbose
• This PR: csv-timeline(json-timeline) -p super-verbose
• This PR: csv-timeline(json-timeline) -x -p super-verbose