feat: add partition diagnostic rule

[fukusuket]

What Changed

• added partition diagnostic rule
  • related Parse and analyze partition diagnostic log takajo#67

Evidence

Test Environment

• OS: macOS sonoma version 14.0
• Hard: MacBook Air(M1, 2020) , Memory 8GB, Core 8
• Hayabusa 2.10.1

Test

2023-11-17 13:06:47.048 +09:00 ‖ mouse ‖ MS-Win-Partition/Diagnostic ‖ 1006 ‖ info ‖ 51 ‖ Device Conn ‖ Manufacturer: NVMe ¦ Model: KINGSTON OM8PDP3512B-A01 ¦ Revision: EDFK0S03 ¦ SerialNumber: 0026_B768_5D25_0F85. ‖ Adapter: 0 ¦ AdapterAlignmentMask: 3 ¦ AdapterId: A9786D92-695A-11EE-BDC1-806E6F6E6963 ¦ AdapterMaximumTransferBytes: 131072 ¦ AdapterMaximumTransferPages: 33 ¦ AdapterSerialNumber: NULL ¦ Bus: 0 ¦ BusType: 17 ¦ BytesOffsetForSectorAlignment: 0 ¦ BytesPerLogicalSector: 512 ¦ BytesPerPhysicalSector: 512 ¦ BytesPerSector: 512 ¦ Capacity: 512110190592 ¦ Characteristics: 256 ¦ Device: 14 ¦ DiskId: F0E437B2-048F-3A1B-F313-EC03B765EEF9 ¦ DiskNumber: 0 ¦ DumpCount: 0 ¦ FaultTolerance: 0 ¦ FirmwareSlotCount: 0 ¦ FirmwareSupportsUpgrade: false ¦ Flags: 538976528 ¦ FlushCacheSupported: true ¦ Function: 0 ¦ HibernationCount: 0 ¦ HybridCacheBytes: 0 ¦ HybridSupported: false ¦ IdFlags: 4 ¦ IncursSeekPenalty: false ¦ InterleaveBytes: 0 ¦ IoctlSupport: 59899 ¦ IsPowerProtected: false ¦ IsSystemCritical: true ¦ IsThinProvisioned: false ¦ IsTrimSupported: true ¦ Location: Integrated : Bus 0 : Device 14 : Function 0 : Adapter 0 ¦ Lun: 0 ¦ Mbr: ¦ MbrBytes: 0 ¦ NVCacheEnabled: false ¦ NumberOfColumns: 0 ¦ NumberOfLogicalCopies: 0 ¦ NumberOfPhysicalCopies: 0 ¦ OptimalUnmapGranularity: 0 ¦ PagingCount: 0 ¦ ParentId: PCI\VEN_8086&DEV_467F&SUBSYS_00008086&REV_00\3&11583659&1&70 ¦ PartitionCount: 4 ¦ PartitionStyle: 1 ¦ PartitionTable: 0100000004000000C27D004ABF65964993881C82C54F5A51004400000000000000DA243C770000008000000000000000010000000000000000001000000000000000401000000000010000000000000028732AC11FF8D211BA4B00A0C93EC93BA243A9B085466D4896464BF59CD3A7FF00000000000000004500460049002000730079007300740065006D00200070006100720074006900740069006F006E000000000000000000000000000000000000000000000000000000000000000000010000000000000000005010000000000000000100000000020000000000000016E3C9E35C0BB84D817DF92DF00215AEFFE4DF5EC445EF42BBE1D1DD9EC0BF8A00000000000000004D006900630072006F0073006F0066007400200072006500730065007200760065006400200070006100720074006900740069006F006E0000000000000000000000000000000000010000000000000000005011000000000000D0AA760000000300000000000000A2A0D0EBE5B9334487C068B6B72699C7A7C45513316BA14380F4E35B98D9695F00000000000000004200610073006900630020006400610074006100200070006100720074006900740069006F006E0000000000000000000000000000000000000000000000000000000000000000000100000000000000000020BC7600000000000080000000000400000000000000A4BB94DED106404DA16ABFD50179D6AC932296802442A34D8ECA8ADCD4B8613501000000000000804200610073006900630020006400610074006100200070006100720074006900740069006F006E0000000000000000005FBC9D444C1F0000EA11B033FB7F00000900000000000000 ¦ PartitionTableBytes: 624 ¦ PoolId: 00000000-0000-0000-0000-000000000000 ¦ Port: 2 ¦ PortDriver: 1 ¦ RegistryId: A9786D9C-695A-11EE-BDC1-806E6F6E6963 ¦ Slot: -1 ¦ Socket: -1 ¦ StorageId: 6575692E30303236423736383544323530463835 ¦ StorageIdAssociation: 0 ¦ StorageIdBytes: 20 ¦ StorageIdCodeSet: 3 ¦ StorageIdCount: 3 ¦ StorageIdType: 8 ¦ Target: 0 ¦ UnmapAlignment: 0 ¦ UserRemovalPolicy: false ¦ Vbr0: ¦ Vbr0Bytes: 0 ¦ Vbr1: ¦ Vbr1Bytes: 0 ¦ Vbr2: ¦ Vbr2Bytes: 0 ¦ Vbr3: ¦ Vbr3Size: 0 ¦ WriteCacheChangeable: 2 ¦ WriteCacheEnabled: 2 ¦ WriteCacheType: 2 ¦ WriteThroughSupported: 1

{
    "Timestamp": "2023-11-17 13:06:47.048 +09:00",
    "Computer": "mouse",
    "Channel": "MS-Win-Partition/Diagnostic",
    "EventID": 1006,
    "Level": "info",
    "RecordID": 51,
    "RuleTitle": "Device Conn",
    "Details": {
        "Manufacturer": "NVMe",
        "Model": "KINGSTON OM8PDP3512B-A01",
        "Revision": "EDFK0S03",
        "SerialNumber": "0026_B768_5D25_0F85."
    },
    "ExtraFieldInfo": {
        "Adapter": 0,
        "AdapterAlignmentMask": 3,
        "AdapterId": "A9786D92-695A-11EE-BDC1-806E6F6E6963",
        "AdapterMaximumTransferBytes": 131072,
        "AdapterMaximumTransferPages": 33,
        "AdapterSerialNumber": "NULL",
        "Bus": 0,
        "BusType": 17,
        "BytesOffsetForSectorAlignment": 0,
        "BytesPerLogicalSector": 512,
        "BytesPerPhysicalSector": 512,
        "BytesPerSector": 512,
        "Capacity": 512110190592,
        "Characteristics": 256,
        "Device": 14,
        "DiskId": "F0E437B2-048F-3A1B-F313-EC03B765EEF9",
        "DiskNumber": 0,
        "DumpCount": 0,
        "FaultTolerance": 0,
        "FirmwareSlotCount": 0,
        "FirmwareSupportsUpgrade": false,
        "Flags": 538976528,
        "FlushCacheSupported": true,
        "Function": 0,
        "HibernationCount": 0,
        "HybridCacheBytes": 0,
        "HybridSupported": false,
        "IdFlags": 4,
        "IncursSeekPenalty": false,
        "InterleaveBytes": 0,
        "IoctlSupport": 59899,
        "IsPowerProtected": false,
        "IsSystemCritical": true,
        "IsThinProvisioned": false,
        "IsTrimSupported": true,
        "Location": "Integrated : Bus 0 : Device 14 : Function 0 : Adapter 0",
        "Lun": 0,
        "Mbr": "",
        "MbrBytes": 0,
        "NVCacheEnabled": false,
        "NumberOfColumns": 0,
        "NumberOfLogicalCopies": 0,
        "NumberOfPhysicalCopies": 0,
        "OptimalUnmapGranularity": 0,
        "PagingCount": 0,
        "ParentId": "PCI\\VEN_8086&DEV_467F&SUBSYS_00008086&REV_00\\3&11583659&1&70",
        "PartitionCount": 4,
        "PartitionStyle": 1,
        "PartitionTable": "0100000004000000C27D004ABF65964993881C82C54F5A51004400000000000000DA243C770000008000000000000000010000000000000000001000000000000000401000000000010000000000000028732AC11FF8D211BA4B00A0C93EC93BA243A9B085466D4896464BF59CD3A7FF00000000000000004500460049002000730079007300740065006D00200070006100720074006900740069006F006E000000000000000000000000000000000000000000000000000000000000000000010000000000000000005010000000000000000100000000020000000000000016E3C9E35C0BB84D817DF92DF00215AEFFE4DF5EC445EF42BBE1D1DD9EC0BF8A00000000000000004D006900630072006F0073006F0066007400200072006500730065007200760065006400200070006100720074006900740069006F006E0000000000000000000000000000000000010000000000000000005011000000000000D0AA760000000300000000000000A2A0D0EBE5B9334487C068B6B72699C7A7C45513316BA14380F4E35B98D9695F00000000000000004200610073006900630020006400610074006100200070006100720074006900740069006F006E0000000000000000000000000000000000000000000000000000000000000000000100000000000000000020BC7600000000000080000000000400000000000000A4BB94DED106404DA16ABFD50179D6AC932296802442A34D8ECA8ADCD4B8613501000000000000804200610073006900630020006400610074006100200070006100720074006900740069006F006E0000000000000000005FBC9D444C1F0000EA11B033FB7F00000900000000000000",
        "PartitionTableBytes": 624,
        "PoolId": "00000000-0000-0000-0000-000000000000",
        "Port": 2,
        "PortDriver": 1,
        "RegistryId": "A9786D9C-695A-11EE-BDC1-806E6F6E6963",
        "Slot": -1,
        "Socket": -1,
        "StorageId": "6575692E30303236423736383544323530463835",
        "StorageIdAssociation": 0,
        "StorageIdBytes": 20,
        "StorageIdCodeSet": 3,
        "StorageIdCount": 3,
        "StorageIdType": 8,
        "Target": 0,
        "UnmapAlignment": 0,
        "UserRemovalPolicy": false,
        "Vbr0": "",
        "Vbr0Bytes": 0,
        "Vbr1": "",
        "Vbr1Bytes": 0,
        "Vbr2": "",
        "Vbr2Bytes": 0,
        "Vbr3": "",
        "Vbr3Size": 0,
        "WriteCacheChangeable": 2,
        "WriteCacheEnabled": 2,
        "WriteCacheType": 2,
        "WriteThroughSupported": 1
    }
}

I would appreciate it if you could review when you have time🙏

[YamatoSecurity]

@fukusuket LGTM! Thank you!