mandiant / mandiant/macos-UnifiedLogs

Review LogData default values

Open
#144 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
376
Forks
43
Avg merge
1d 21h
Merged PRs (30d)
8

Description

Currently the log data returned by this library is a `LogData` structure as shown below
```
#[derive(Debug, Serialize)]
pub struct LogData {
pub subsystem: String,
pub thread_id: u64,
pub pid: u64,
pub euid: u32,
pub library: String,
pub library_uuid: String,
pub activity_id: u64,
pub parent_activity_id: u64,
pub time: f64,
pub category: String,
pub event_type: EventType,
pub log_type: LogType,
pub process: String,
pub process_uuid: String,
pub message: String,
pub raw_message: String,
pub boot_uuid: String,
pub timezone_name: String,
pub message_entries: Vec,
pub timestamp: String,
pub message_flags: Vec,
pub evidence: String,
}
```

@ReturnRei has mention a few good points that some of default values can be misleading. For example, by default `euid` is set to 0. Which on macOS is the root account.

Some of these values should be replaced with an `Option type` that is set to `None` if the value is not set when parsing the log entry
Some values that should probably be Option include
- euid
- parent_activity_id
- activity_id

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the LogData structure shown in the issue and trace the parser that constructs it for unset values. Review whether euid, parent_activity_id, and activity_id can be represented as None without misleading defaults, then check the affected parsing behavior and public API expectations.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
backend-api-design
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.