diff --git a/src/afterfact.rs b/src/afterfact.rs index 2be77936..72d2aabb 100644 --- a/src/afterfact.rs +++ b/src/afterfact.rs @@ -113,7 +113,7 @@ fn emit_csv(writer: &mut W, displayflag: bool) -> io::Result< wtr.flush()?; println!(""); - println!("Total events detected: {:?}", detect_count); + println!("Total events: {:?}", detect_count); Ok(()) } diff --git a/src/detections/configs.rs b/src/detections/configs.rs index 0a15e830..eabc45f7 100644 --- a/src/detections/configs.rs +++ b/src/detections/configs.rs @@ -56,7 +56,7 @@ fn build_app<'a>() -> ArgMatches<'a> { --verbose 'Output verbose information to target event file path and rule file' -q 'Quiet mode. Do not display the launch banner' -r --rules=[RULEDIRECTORY] 'Rule file directory (default: ./rules)' - -L --level=[LEVEL] 'Minimum level for rules (default: INFORMATIONAL)' + -m --min-level=[LEVEL] 'Minimum level for rules (default: informational)' -u --utc 'Output time in UTC format (default: local time)' -d --directory=[DIRECTORY] 'Directory of multiple .evtx files' -s --statistics 'Prints statistics of event IDs' diff --git a/src/detections/detection.rs b/src/detections/detection.rs index 10a1542a..9533fe49 100644 --- a/src/detections/detection.rs +++ b/src/detections/detection.rs @@ -181,7 +181,7 @@ impl Detection { println!("{} alerts: {}", levellabel[i], value); total_unique += value; } - println!("Unique events detected: {}", total_unique); + println!("Unique alerts detected: {}", total_unique); } // 複数のイベントレコードに対して、ルールを1個実行します。 diff --git a/src/detections/print.rs b/src/detections/print.rs index 51e65acb..a9c6c4da 100644 --- a/src/detections/print.rs +++ b/src/detections/print.rs @@ -165,7 +165,7 @@ impl Message { detect_count += detect_infos.len(); } println!(""); - println!("Total Events Detected:{:?}", detect_count); + println!("Total events:{:?}", detect_count); } pub fn iter(&self) -> &BTreeMap, Vec> { diff --git a/src/main.rs b/src/main.rs index 0e898eb8..4f0b5cdc 100644 --- a/src/main.rs +++ b/src/main.rs @@ -125,7 +125,7 @@ fn analysis_files(evtx_files: Vec) { .read() .unwrap() .args - .value_of("level") + .value_of("min-level") .unwrap_or("informational") .to_uppercase(); println!("Analyzing event files: {:?}", evtx_files.len());