diff --git a/src/detections/configs.rs b/src/detections/configs.rs index cd2d77220..28525aaba 100644 --- a/src/detections/configs.rs +++ b/src/detections/configs.rs @@ -1607,7 +1607,7 @@ pub struct CommonOptions { pub struct InputOption { /// Directory of multiple .evtx files #[arg(help_heading = Some("Input"), short = 'd', long, value_name = "DIR", conflicts_with_all = ["filepath", "live_analysis"], display_order = 300)] - pub directory: Option, + pub directory: Option>, /// File path to one .evtx file #[arg(help_heading = Some("Input"), short = 'f', long = "file", value_name = "FILE", conflicts_with_all = ["directory", "live_analysis"], display_order = 320)] diff --git a/src/main.rs b/src/main.rs index 01ebd9ede..b04735640 100644 --- a/src/main.rs +++ b/src/main.rs @@ -784,18 +784,21 @@ impl App { time_filter, stored_static.borrow_mut(), ); - } else if let Some(directory) = &stored_static + } else if let Some(directories) = &stored_static .output_option .as_ref() .unwrap() .input_args .directory { - let evtx_files = Self::collect_evtxfiles( - directory.as_os_str().to_str().unwrap(), - target_extensions, - stored_static, - ); + let mut evtx_files = Vec::new(); + for directory in directories { + evtx_files.extend(Self::collect_evtxfiles( + directory.as_os_str().to_str().unwrap(), + target_extensions, + stored_static, + )); + } if evtx_files.is_empty() { AlertMessage::alert("No .evtx files were found.").ok(); return;