changed noisy and excluded rule output and output condition #596

src/detections/detection.rs

@@ -1,6 +1,9 @@
 extern crate csv;
 
 use crate::detections::configs;
+use crate::detections::utils::write_color_buffer;
+use termcolor::{BufferWriter, Color, ColorChoice};
+
 use crate::detections::pivot::insert_pivot_keyword;
 use crate::detections::print::AlertMessage;
 use crate::detections::print::DetectInfo;
@@ -119,13 +122,11 @@ impl Detection {
             .filter_map(return_if_success)
             .collect();
         if !*LOGONSUMMARY_FLAG {
-            let _ = &rulefile_loader
-                .rule_load_cnt
-                .insert(String::from("rule parsing error"), parseerror_count);
             Detection::print_rule_load_info(
                 &rulefile_loader.rulecounter,
                 &rulefile_loader.rule_load_cnt,
                 &rulefile_loader.rule_status_cnt,
+                &parseerror_count,
             );
         }
         ret
@@ -363,6 +364,7 @@ impl Detection {
         rc: &HashMap<String, u128>,
         ld_rc: &HashMap<String, u128>,
         st_rc: &HashMap<String, u128>,
+        err_rc: &u128,
     ) {
         if *STATISTICS_FLAG {
             return;
@@ -382,27 +384,40 @@ impl Detection {
         let mut sorted_st_rc: Vec<(&String, &u128)> = st_rc.iter().collect();
         let total_loaded_rule_cnt: u128 = sorted_st_rc.iter().map(|(_, v)| v.to_owned()).sum();
         sorted_st_rc.sort_by(|a, b| a.0.cmp(b.0));
+        let args = &configs::CONFIG.read().unwrap().args;
         sorted_st_rc.into_iter().for_each(|(key, value)| {
-            let rate = if value == &0_u128 {
-                0 as f64
-            } else {
-                (*value as f64) / (total_loaded_rule_cnt as f64) * 100.0
-            };
+            if value != &0_u128 {
+                let rate = (*value as f64) / (total_loaded_rule_cnt as f64) * 100.0;
+                let deprecated_flag = if (key == "deprecated" && !args.enable_deprecated_rules)|| (key == "noisy" && !args.enable_noisy_rules) {
+                    " (Disabled)"
+                }  else { "" };
                 //タイトルに利用するものはascii文字であることを前提として1文字目を大文字にするように変更する
                 println!(
-                "{} rules: {} ({:.2}%)",
+                    "{} rules: {} ({:.2}%){}",
                     make_ascii_titlecase(key.clone().as_mut()),
                     value,
-                rate
+                    rate,
+                    deprecated_flag,
                 );
+            }
         });
+        write_color_buffer(
+            BufferWriter::stdout(ColorChoice::Always),
+            Some(Color::Red),
+            &format!("Rule parsing errors: {}", err_rc)
+        ).ok();
         println!();
 
         let mut sorted_rc: Vec<(&String, &u128)> = rc.iter().collect();
         sorted_rc.sort_by(|a, b| a.0.cmp(b.0));
         sorted_rc.into_iter().for_each(|(key, value)| {
-            println!("{} rules: {}", key, value);
+            write_color_buffer(
+                BufferWriter::stdout(ColorChoice::Always),
+                None,
+                &format!("{} rules: {}", key, value)
+            ).ok();
         });
+
         println!("Total enabled detection rules: {}", total_loaded_rule_cnt);
         println!();
     }