diff --git a/README-Japanese.md b/README-Japanese.md index 135e367c..9e13daae 100644 --- a/README-Japanese.md +++ b/README-Japanese.md @@ -294,6 +294,7 @@ USAGE: -f --filepath=[FILEPATH] '1つの.evtxファイルのパス。' -r --rules=[RULEFILE/RULEDIRECTORY] 'ルールファイルまたはルールファイルを持つディレクトリ。(デフォルト: ./rules)' -c --color 'カラーで出力する。 (ターミナルはTrue Colorに対応する必要がある。)' + -C --config=[RULECONFIGDIRECTORY] 'ルールフォルダのコンフィグディレクトリ(デフォルト: ./rules/config)' -o --output=[CSV_TIMELINE] 'タイムラインをCSV形式で保存する。(例: results.csv)' -v --verbose '詳細な情報を出力する。' -D --enable-deprecated-rules 'Deprecatedルールを有効にする。' diff --git a/README.md b/README.md index efa980eb..17b57bc4 100644 --- a/README.md +++ b/README.md @@ -288,6 +288,7 @@ USAGE: -f --filepath=[FILEPATH] 'File path to one .evtx file.' -r --rules=[RULEFILE/RULEDIRECTORY] 'Rule file or directory. (Default: ./rules)' -c --color 'Output with color. (Terminal needs to support True Color.)' + -C --config=[RULECONFIGDIRECTORY] 'Rule config folder. (Default: ./rules/config)' -o --output=[CSV_TIMELINE] 'Save the timeline in CSV format. (Example: results.csv)' -v --verbose 'Output verbose information.' -D --enable-deprecated-rules 'Enable rules marked as deprecated.' diff --git a/src/detections/configs.rs b/src/detections/configs.rs index 4237240a..9ad2185a 100644 --- a/src/detections/configs.rs +++ b/src/detections/configs.rs @@ -18,13 +18,16 @@ lazy_static! { levelmap.insert("CRITICAL".to_owned(), 5); levelmap }; - pub static ref EVENTKEY_ALIAS: EventKeyAliasConfig = - load_eventkey_alias("./rules/config/eventkey_alias.txt"); + pub static ref EVENTKEY_ALIAS: EventKeyAliasConfig = load_eventkey_alias(&format!( + "{}/eventkey_alias.txt", + CONFIG.read().unwrap().folder_path + )); } #[derive(Clone)] pub struct ConfigReader { pub args: ArgMatches<'static>, + pub folder_path: String, pub event_timeline_config: EventInfoConfig, pub target_eventids: TargetEventIds, } @@ -37,8 +40,11 @@ impl Default for ConfigReader { impl ConfigReader { pub fn new() -> Self { + let arg = build_app(); + let folder_path_str = arg.value_of("config").unwrap_or("rules/config").to_string(); ConfigReader { - args: build_app(), + args: arg, + folder_path: folder_path_str, event_timeline_config: load_eventcode_info("config/statistics_event_info.txt"), target_eventids: load_target_ids("config/target_eventids.txt"), } @@ -63,6 +69,7 @@ fn build_app<'a>() -> ArgMatches<'a> { -f --filepath=[FILEPATH] 'File path to one .evtx file.' -r --rules=[RULEFILE/RULEDIRECTORY] 'Rule file or directory. (Default: ./rules)' -c --color 'Output with color. (Terminal needs to support True Color.)' + -C --config=[RULECONFIGDIRECTORY] 'Rule config folder. (Default: ./rules/config)' -o --output=[CSV_TIMELINE] 'Save the timeline in CSV format. (Example: results.csv)' -v --verbose 'Output verbose information.' -D --enable-deprecated-rules 'Enable rules marked as deprecated.' diff --git a/src/filter.rs b/src/filter.rs index 69d7ee3c..92293a62 100644 --- a/src/filter.rs +++ b/src/filter.rs @@ -36,10 +36,16 @@ pub fn exclude_ids() -> RuleExclude { .args .is_present("enable-noisy-rules") { - exclude_ids.insert_ids("./rules/config/noisy_rules.txt"); + exclude_ids.insert_ids(&format!( + "{}/noisy_rules.txt", + configs::CONFIG.read().unwrap().folder_path + )); }; - exclude_ids.insert_ids("./rules/config/exclude_rules.txt"); + exclude_ids.insert_ids(&format!( + "{}/exclude_rules.txt", + configs::CONFIG.read().unwrap().folder_path + )); exclude_ids }