diff --git a/CHANGELOG-Japanese.md b/CHANGELOG-Japanese.md index b72249c9..a083c39e 100644 --- a/CHANGELOG-Japanese.md +++ b/CHANGELOG-Japanese.md @@ -9,10 +9,11 @@ **改善:** - 結果概要に各レベルで検知した上位5つのルールを表示するようにした。 (#667) (@hitenkoku) +- 結果概要を出力しないようにするために `--no-summary` オプションを追加した。 (#672) (@hitenkoku) **バグ修正:** -- XXX +- ログオン情報の要約オプションを追加した場合に、Hayabusaがクラッシュしていたのを修正した。 (#674) (@hitenkoku) ## v1.5.1 [2022/08/20] diff --git a/CHANGELOG.md b/CHANGELOG.md index 016df85c..50893369 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,11 +8,12 @@ **Enhancements:** -- Added top alerts to the results summary. (#667) (@hitenkoku) +- Added top alerts to results summary. (#667) (@hitenkoku) +- Added `--no-summary` option to not display the results summary. (#672) (@hitenkoku) **Bug Fixes:** -- XXX +- Hayabusa would crash with `-L` option (logon summary option). (#674) (@hitenkoku) ## v1.5.1 [2022/08/20] diff --git a/README-Japanese.md b/README-Japanese.md index 72eb9213..eeafec84 100644 --- a/README-Japanese.md +++ b/README-Japanese.md @@ -393,6 +393,7 @@ OUTPUT: DISPLAY-SETTINGS: --no-color カラー出力を無効にする + --no-summary 結果概要を出力しない -q, --quiet Quietモード: 起動バナーを表示しない -v, --verbose 詳細な情報を出力する -V, --visualize-timeline イベント頻度タイムラインを出力する diff --git a/README.md b/README.md index 2d1213de..23b51db1 100644 --- a/README.md +++ b/README.md @@ -385,6 +385,7 @@ OUTPUT: DISPLAY-SETTINGS: --no-color Disable color output + --no-summary Do not display result summary -q, --quiet Quiet mode: do not display the launch banner -v, --verbose Output verbose information -V, --visualize-timeline Output event frequency timeline diff --git a/src/afterfact.rs b/src/afterfact.rs index 7096af0a..7720d990 100644 --- a/src/afterfact.rs +++ b/src/afterfact.rs @@ -366,77 +366,79 @@ fn emit_csv( } }; - disp_wtr_buf.clear(); - write_color_buffer( - &disp_wtr, - get_writable_color(Some(Color::Rgb(0, 255, 0))), - "Results Summary:", - true, - ) - .ok(); + if !configs::CONFIG.read().unwrap().args.no_summary { + disp_wtr_buf.clear(); + write_color_buffer( + &disp_wtr, + get_writable_color(Some(Color::Rgb(0, 255, 0))), + "Results Summary:", + true, + ) + .ok(); - let terminal_width = match *TERM_SIZE { - Some((Width(w), _)) => w as usize, - None => 100, - }; - println!(); - - if configs::CONFIG.read().unwrap().args.visualize_timeline { - _print_timeline_hist(timestamps, terminal_width, 3); + let terminal_width = match *TERM_SIZE { + Some((Width(w), _)) => w as usize, + None => 100, + }; println!(); + + if configs::CONFIG.read().unwrap().args.visualize_timeline { + _print_timeline_hist(timestamps, terminal_width, 3); + println!(); + } + let reducted_record_cnt: u128 = all_record_cnt - detected_record_idset.len() as u128; + let reducted_percent = if all_record_cnt == 0 { + 0 as f64 + } else { + (reducted_record_cnt as f64) / (all_record_cnt as f64) * 100.0 + }; + write_color_buffer( + &disp_wtr, + get_writable_color(None), + &format!( + "Total events: {}", + all_record_cnt.to_formatted_string(&Locale::en) + ), + true, + ) + .ok(); + write_color_buffer( + &disp_wtr, + get_writable_color(None), + &format!( + "Data reduction: {} events ({:.2}%)", + reducted_record_cnt.to_formatted_string(&Locale::en), + reducted_percent + ), + true, + ) + .ok(); + println!(); + + _print_unique_results( + total_detect_counts_by_level, + "Total".to_string(), + "detections".to_string(), + &color_map, + ); + println!(); + + _print_unique_results( + unique_detect_counts_by_level, + "Unique".to_string(), + "detections".to_string(), + &color_map, + ); + println!(); + + _print_detection_summary_by_date(detect_counts_by_date_and_level, &color_map); + println!(); + + _print_detection_summary_by_computer(detect_counts_by_computer_and_level, &color_map); + println!(); + + _print_detection_summary_by_rule(detect_counts_by_rule_and_level, &color_map); } - let reducted_record_cnt: u128 = all_record_cnt - detected_record_idset.len() as u128; - let reducted_percent = if all_record_cnt == 0 { - 0 as f64 - } else { - (reducted_record_cnt as f64) / (all_record_cnt as f64) * 100.0 - }; - write_color_buffer( - &disp_wtr, - get_writable_color(None), - &format!( - "Total events: {}", - all_record_cnt.to_formatted_string(&Locale::en) - ), - true, - ) - .ok(); - write_color_buffer( - &disp_wtr, - get_writable_color(None), - &format!( - "Data reduction: {} events ({:.2}%)", - reducted_record_cnt.to_formatted_string(&Locale::en), - reducted_percent - ), - true, - ) - .ok(); - println!(); - - _print_unique_results( - total_detect_counts_by_level, - "Total".to_string(), - "detections".to_string(), - &color_map, - ); - println!(); - - _print_unique_results( - unique_detect_counts_by_level, - "Unique".to_string(), - "detections".to_string(), - &color_map, - ); - println!(); - - _print_detection_summary_by_date(detect_counts_by_date_and_level, &color_map); - println!(); - - _print_detection_summary_by_computer(detect_counts_by_computer_and_level, &color_map); - println!(); - - _print_detection_summary_by_rule(detect_counts_by_rule_and_level, &color_map); Ok(()) } diff --git a/src/detections/configs.rs b/src/detections/configs.rs index b2310ef8..f3d1a5e3 100644 --- a/src/detections/configs.rs +++ b/src/detections/configs.rs @@ -224,9 +224,14 @@ pub struct Config { #[clap(help_heading = Some("OTHER-ACTIONS"), long = "set-default-profile", value_name = "PROFILE")] pub set_default_profile: Option, + /// Save the timeline in JSON format (ex: -j -o results.json) #[clap(help_heading = Some("OUTPUT"), short = 'j', long = "json", requires = "output")] pub json_timeline: bool, + + /// Do not display result summary + #[clap(help_heading = Some("DISPLAY-SETTINGS"), long = "no-summary")] + pub no_summary: bool, } impl ConfigReader<'_> { diff --git a/src/timeline/statistics.rs b/src/timeline/statistics.rs index f2debc94..6e6982e1 100644 --- a/src/timeline/statistics.rs +++ b/src/timeline/statistics.rs @@ -110,8 +110,21 @@ impl EventStatistics { if evtid.is_none() { continue; } + let idnum: i64 = if evtid.unwrap().is_number() { + evtid.unwrap().as_i64().unwrap() + } else { + evtid + .unwrap() + .as_str() + .unwrap() + .parse::() + .unwrap_or_default() + }; + if !(idnum == 4624 || idnum == 4625) { + continue; + } + let username = utils::get_event_value("TargetUserName", &record.record); - let idnum = evtid.unwrap().as_i64().unwrap(); let countlist: [usize; 2] = [0, 0]; if idnum == 4624 { let count: &mut [usize; 2] = self