diff --git a/src/afterfact.rs b/src/afterfact.rs index 1d9217b4..5cb9fcf0 100644 --- a/src/afterfact.rs +++ b/src/afterfact.rs @@ -43,29 +43,25 @@ pub fn after_fact() { process::exit(1); }; let mut displayflag = false; - let mut target: Box = if let Some(csv_path) = configs::CONFIG - .read() - .unwrap() - .args - .value_of("csv-timeline") - { - // ファイル出力する場合 - match File::create(csv_path) { - Ok(file) => Box::new(BufWriter::new(file)), - Err(err) => { - AlertMessage::alert( - &mut std::io::stderr().lock(), - format!("Failed to open file. {}", err), - ) - .ok(); - process::exit(1); + let mut target: Box = + if let Some(csv_path) = configs::CONFIG.read().unwrap().args.value_of("output") { + // ファイル出力する場合 + match File::create(csv_path) { + Ok(file) => Box::new(BufWriter::new(file)), + Err(err) => { + AlertMessage::alert( + &mut std::io::stderr().lock(), + format!("Failed to open file. {}", err), + ) + .ok(); + process::exit(1); + } } - } - } else { - displayflag = true; - // 標準出力に出力する場合 - Box::new(BufWriter::new(io::stdout())) - }; + } else { + displayflag = true; + // 標準出力に出力する場合 + Box::new(BufWriter::new(io::stdout())) + }; if let Err(err) = emit_csv(&mut target, displayflag) { fn_emit_csv_err(Box::new(err)); diff --git a/src/detections/configs.rs b/src/detections/configs.rs index c2fa589f..06f60e3d 100644 --- a/src/detections/configs.rs +++ b/src/detections/configs.rs @@ -52,22 +52,22 @@ fn build_app<'a>() -> ArgMatches<'a> { return ArgMatches::default(); } - let usages = "-f --filepath=[FILEPATH] 'File path to one .evtx file' - --csv-timeline=[CSV_TIMELINE] 'Save the timeline in CSV format' + let usages = "-d --directory=[DIRECTORY] 'Directory of multiple .evtx files' + -f --filepath=[FILEPATH] 'File path to one .evtx file' + -r --rules=[RULEDIRECTORY] 'Rule file directory (default: ./rules)' + -o --output=[CSV_TIMELINE] 'Save the timeline in CSV format. Example: results.csv' + -v --verbose 'Output verbose information' + -D --enable-deprecated-rules 'Enable sigma rules marked as deprecated' + -n --enable-noisy-rules 'Enable rules marked as noisy' + -m --min-level=[LEVEL] 'Minimum level for rules (default: informational)' + --start-timeline=[STARTTIMELINE] 'Start time of the event to load from event file. Example: '2018/11/28 12:00:00 +09:00'' + --end-timeline=[ENDTIMELINE] 'End time of the event to load from event file. Example: '2018/11/28 12:00:00 +09:00'' --rfc-2822 'Output date and time in RFC 2822 format. Example: Mon, 07 Aug 2006 12:34:56 -0600' --rfc-3339 'Output date and time in RFC 3339 format. Example: 2006-08-07T12:34:56.485214 -06:00' - --verbose 'Output verbose information to target event file path and rule file' - --starttimeline=[STARTTIMELINE] 'Start time of the event to load from event file. Example: '2018/11/28 12:00:00 +09:00'' - --endtimeline=[ENDTIMELINE]'End time of the event to load from event file. Example: '2018/11/28 12:00:00 +09:00'' - -q 'Quiet mode. Do not display the launch banner' - -r --rules=[RULEDIRECTORY] 'Rule file directory (default: ./rules)' - -m --min-level=[LEVEL] 'Minimum level for rules (default: informational)' -u --utc 'Output time in UTC format (default: local time)' - -d --directory=[DIRECTORY] 'Directory of multiple .evtx files' + -t --thread-number=[NUMBER] 'Thread number (default: optimal number for performance)' -s --statistics 'Prints statistics of event IDs' - -n --show-noisyalerts 'do not exclude noisy rules' - -t --threadnum=[NUM] 'Thread number (default: optimal number for performance)' - --show-deprecated 'do not exclude rules with YAML's status deprecated' + -q --quiet 'Quiet mode. Do not display the launch banner' --contributors 'Prints the list of contributors'"; App::new(&program) .about("Hayabusa: Aiming to be the world's greatest Windows event log analysis tool!") @@ -131,9 +131,9 @@ pub struct TargetEventTime { impl TargetEventTime { pub fn new() -> Self { - let start_time = if let Some(s_time) = CONFIG.read().unwrap().args.value_of("starttimeline") - { - match DateTime::parse_from_str(s_time, "%Y-%m-%d %H:%M:%S %z") // 2014-11-28 21:00:09 +09:00 + let start_time = + if let Some(s_time) = CONFIG.read().unwrap().args.value_of("start-timeline") { + match DateTime::parse_from_str(s_time, "%Y-%m-%d %H:%M:%S %z") // 2014-11-28 21:00:09 +09:00 .or_else(|_| DateTime::parse_from_str(s_time, "%Y/%m/%d %H:%M:%S %z")) // 2014/11/28 21:00:09 +09:00 { Ok(dt) => Some(dt.with_timezone(&Utc)), @@ -146,10 +146,10 @@ impl TargetEventTime { None } } - } else { - None - }; - let end_time = if let Some(e_time) = CONFIG.read().unwrap().args.value_of("endtimeline") { + } else { + None + }; + let end_time = if let Some(e_time) = CONFIG.read().unwrap().args.value_of("end-timeline") { match DateTime::parse_from_str(e_time, "%Y-%m-%d %H:%M:%S %z") // 2014-11-28 21:00:09 +09:00 .or_else(|_| DateTime::parse_from_str(e_time, "%Y/%m/%d %H:%M:%S %z")) // 2014/11/28 21:00:09 +09:00 { diff --git a/src/detections/utils.rs b/src/detections/utils.rs index 0ba39dd4..4ecf3733 100644 --- a/src/detections/utils.rs +++ b/src/detections/utils.rs @@ -184,7 +184,7 @@ pub fn get_thread_num() -> usize { let conf = configs::CONFIG.read().unwrap(); let threadnum = &conf .args - .value_of("threadnum") + .value_of("thread-number") .unwrap_or(def_thread_num_str.as_str()); return threadnum.parse::().unwrap().clone(); } diff --git a/src/filter.rs b/src/filter.rs index 113283cf..d1ff0466 100644 --- a/src/filter.rs +++ b/src/filter.rs @@ -18,7 +18,7 @@ pub fn exclude_ids() -> RuleExclude { .read() .unwrap() .args - .is_present("show-noisyalerts") + .is_present("enable-noisy-rules") { ids += "\n"; // 改行を入れないとexclude-rulesの一番最後の行とnoisy-rules.txtの一番最初の行が一行にまとめられてしまう。 match fs::read("config/noisy-rules.txt") { diff --git a/src/main.rs b/src/main.rs index a48d4028..425d0a9d 100644 --- a/src/main.rs +++ b/src/main.rs @@ -50,7 +50,7 @@ impl App { fn exec(&mut self) { let analysis_start_time: DateTime = Local::now(); - if !configs::CONFIG.read().unwrap().args.is_present("q") { + if !configs::CONFIG.read().unwrap().args.is_present("quiet") { self.output_logo(); println!(""); self.output_eggs(&format!( diff --git a/src/yaml.rs b/src/yaml.rs index 53a6a0af..4326d9f8 100644 --- a/src/yaml.rs +++ b/src/yaml.rs @@ -156,7 +156,7 @@ impl ParseYaml { .read() .unwrap() .args - .is_present("show-deprecated") + .is_present("enable-deprecated-rules") { let rule_status = &yaml_doc["status"].as_str(); if rule_status.is_some() && rule_status.unwrap() == "deprecated" {