Merge branch 'main' into 606-print-all-field-info-when-no-details-are-defined

src/detections/configs.rs

@@ -115,9 +115,13 @@ pub struct Config {
     pub visualize_timeline: bool,
 
     /// Enable rules marked as deprecated
-    #[clap(short = 'D', long = "enable-deprecated-rules")]
+    #[clap(long = "enable-deprecated-rules")]
     pub enable_deprecated_rules: bool,
 
+    /// Disable event ID filter to scan all events
+    #[clap(short = 'D', long = "deep-scan")]
+    pub deep_scan: bool,
+
     /// Enable rules marked as noisy
     #[clap(short = 'n', long = "enable-noisy-rules")]
     pub enable_noisy_rules: bool,
@@ -238,13 +242,13 @@ impl ConfigReader<'_> {
             headless_help: String::default(),
             event_timeline_config: load_eventcode_info(
                 CURRENT_EXE_PATH
-                    .join("config/statistics_event_info.txt")
+                    .join("rules/config/statistics_event_info.txt")
                     .to_str()
                     .unwrap(),
             ),
             target_eventids: load_target_ids(
                 CURRENT_EXE_PATH
-                    .join("config/target_eventids.txt")
+                    .join("rules/config/target_event_IDs.txt")
                     .to_str()
                     .unwrap(),
             ),

src/detections/print.rs

@@ -63,7 +63,7 @@ lazy_static! {
     );
     pub static ref CH_CONFIG: HashMap<String, String> = Message::create_output_filter_config(
         CURRENT_EXE_PATH
-            .join("config/channel_abbreviations.txt")
+            .join("rules/config/channel_abbreviations.txt")
             .to_str()
             .unwrap(),
         false,