log-analysis 0.1.571

A zeek log analysis library implemented in Rust
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109


use serde::{Serialize, Deserialize};

#[derive(Debug, Clone, PartialEq, Eq, Ord, PartialOrd, Serialize, Deserialize)]
pub enum 
ZeekProtocol
{
    NONE,
    CONN,
    DNS,
    HTTP,
    FILES,
    FTP,
    SSL,
    X509,
    SMTP,
    SNMP,
    SSH,
    PE,
    DHCP,
    NTP,
    SMB,
    IRC,
    RDP,
    LDAP,
    QUIC,
    TRACEROUTE,
    TUNNEL,
    DPD,
    KNOWN,
    SOFTWARE,
    WEIRD,
    NOTICE,
    CAPTURELOSS,
    REPORTER,
    SIP,
}
impl ZeekProtocol
{
    pub fn read(name: &str) -> ZeekProtocol
    {
        match name.to_ascii_lowercase().as_str()
        {
            "conn" => ZeekProtocol::CONN,
            "dns" => ZeekProtocol::DNS,
            "http" => ZeekProtocol::HTTP,
            "files" => ZeekProtocol::FILES,
            "ftp" => ZeekProtocol::FTP,
            "ssl" => ZeekProtocol::SSL,
            "x509" => ZeekProtocol::X509,
            "smtp" => ZeekProtocol::SMTP,
            "snmp" => ZeekProtocol::SNMP,
            "ssh" => ZeekProtocol::SSH,
            "pe" => ZeekProtocol::PE,
            "dhcp" => ZeekProtocol::DHCP,
            "ntp" => ZeekProtocol::NTP,
            "smb" => ZeekProtocol::SMB,
            "irc" => ZeekProtocol::IRC,
            "rdp" => ZeekProtocol::RDP,
            "ldap" => ZeekProtocol::LDAP,
            "quic" => ZeekProtocol::QUIC,
            "traceroute" => ZeekProtocol::TRACEROUTE,
            "tunnel" => ZeekProtocol::TUNNEL,
            "dpd" => ZeekProtocol::DPD,
            "known" => ZeekProtocol::KNOWN,
            "software" => ZeekProtocol::SOFTWARE,
            "weird" => ZeekProtocol::WEIRD,
            "notice" => ZeekProtocol::NOTICE,
            "capture_loss" => ZeekProtocol::CAPTURELOSS,
            "reporter" => ZeekProtocol::REPORTER,
            "sip" => ZeekProtocol::SIP,
            _ => ZeekProtocol::NONE, // add error type instead of string
        }
    }
    pub fn to_str(&self) -> &str 
    {
        match self {
            ZeekProtocol::CONN => "conn",
            ZeekProtocol::DNS => "dns",
            ZeekProtocol::HTTP => "http",
            ZeekProtocol::FILES => "files",
            ZeekProtocol::FTP => "ftp",
            ZeekProtocol::SSL => "ssl",
            ZeekProtocol::X509 => "x509",
            ZeekProtocol::SMTP => "smtp",
            ZeekProtocol::SNMP => "snmp",
            ZeekProtocol::SSH => "ssh",
            ZeekProtocol::PE => "pe",
            ZeekProtocol::DHCP => "dhcp",
            ZeekProtocol::NTP => "ntp",
            ZeekProtocol::SMB => "smb",
            ZeekProtocol::IRC => "irc",
            ZeekProtocol::RDP => "rdp",
            ZeekProtocol::LDAP => "ldap",
            ZeekProtocol::QUIC => "quic",
            ZeekProtocol::TRACEROUTE => "traceroute",
            ZeekProtocol::TUNNEL => "tunnel",
            ZeekProtocol::DPD => "dpd",
            ZeekProtocol::KNOWN => "known",
            ZeekProtocol::SOFTWARE => "software",
            ZeekProtocol::WEIRD => "weird",
            ZeekProtocol::NOTICE => "notice",
            ZeekProtocol::CAPTURELOSS => "capture_loss",
            ZeekProtocol::REPORTER => "reporter",
            ZeekProtocol::SIP => "sip",
            ZeekProtocol::NONE => "none", 
        }
    }
}