fixed config to show level-tuning option
This commit is contained in:
@@ -1,7 +1,7 @@
|
||||
use crate::detections::print::AlertMessage;
|
||||
use crate::detections::utils;
|
||||
use chrono::{DateTime, Utc};
|
||||
use clap::{App, AppSettings, Arg, ArgMatches};
|
||||
use clap::{App, AppSettings, ArgMatches};
|
||||
use hashbrown::HashMap;
|
||||
use hashbrown::HashSet;
|
||||
use lazy_static::lazy_static;
|
||||
@@ -80,6 +80,7 @@ fn build_app<'a>() -> ArgMatches<'a> {
|
||||
-u --update-rules 'Update to the latest rules in the hayabusa-rules github repository.'
|
||||
-m --min-level=[LEVEL] 'Minimum level for rules. (Default: informational)'
|
||||
-l --live-analysis 'Analyze the local C:\\Windows\\System32\\winevt\\Logs folder (Windows Only. Administrator privileges required.)'
|
||||
--level-tuning=<LEVEL_TUNING_FILE> 'Fix rule file's level [default: ./config/level_tuning.txt]'
|
||||
--start-timeline=[STARTTIMELINE] 'Start time of the event logs to load. (Example: '2018/11/28 12:00:00 +09:00')'
|
||||
--end-timeline=[ENDTIMELINE] 'End time of the event logs to load. (Example: '2018/11/28 12:00:00 +09:00')'
|
||||
--rfc-2822 'Output date and time in RFC 2822 format. (Example: Mon, 07 Aug 2006 12:34:56 -0600)'
|
||||
@@ -95,11 +96,6 @@ fn build_app<'a>() -> ArgMatches<'a> {
|
||||
.version("1.1.0")
|
||||
.author("Yamato Security (https://github.com/Yamato-Security/hayabusa)")
|
||||
.setting(AppSettings::VersionlessSubcommands)
|
||||
.arg(
|
||||
// TODO: When update claps to 3.x, these can write in usage texts...
|
||||
Arg::from_usage("--level-tuning=[LEVEL_TUNING_FILE] 'Fix rule file's level'")
|
||||
.default_value("./config/level_tuning.txt"),
|
||||
)
|
||||
.usage(usages)
|
||||
.args_from_usage(usages)
|
||||
.get_matches()
|
||||
|
||||
33
src/main.rs
33
src/main.rs
@@ -112,31 +112,34 @@ impl App {
|
||||
.args
|
||||
.is_present("level-tuning")
|
||||
{
|
||||
if let Some(level_tuning_config_path) = configs::CONFIG
|
||||
let level_tuning_config_path = configs::CONFIG
|
||||
.read()
|
||||
.unwrap()
|
||||
.args
|
||||
.value_of("level-tuning")
|
||||
{
|
||||
if Path::new(level_tuning_config_path).exists() {
|
||||
if let Err(err) = LevelTuning::run(level_tuning_config_path, configs::CONFIG
|
||||
.unwrap_or("./config/level_tuning.txt")
|
||||
.to_string();
|
||||
|
||||
if Path::new(&level_tuning_config_path).exists() {
|
||||
if let Err(err) = LevelTuning::run(
|
||||
&level_tuning_config_path,
|
||||
configs::CONFIG
|
||||
.read()
|
||||
.unwrap()
|
||||
.args
|
||||
.value_of("rules")
|
||||
.unwrap_or("rules")) {
|
||||
AlertMessage::alert(&mut BufWriter::new(std::io::stderr().lock()), &err)
|
||||
.ok();
|
||||
}
|
||||
} else {
|
||||
AlertMessage::alert(
|
||||
&mut BufWriter::new(std::io::stderr().lock()),
|
||||
"Need rule_levels.txt file to use --level-tuning option",
|
||||
)
|
||||
.ok();
|
||||
.unwrap_or("rules"),
|
||||
) {
|
||||
AlertMessage::alert(&mut BufWriter::new(std::io::stderr().lock()), &err).ok();
|
||||
}
|
||||
return;
|
||||
} else {
|
||||
AlertMessage::alert(
|
||||
&mut BufWriter::new(std::io::stderr().lock()),
|
||||
"Need rule_levels.txt file to use --level-tuning option",
|
||||
)
|
||||
.ok();
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
if !Path::new("./config").exists() {
|
||||
|
||||
Reference in New Issue
Block a user