diff --git a/src/detections/configs.rs b/src/detections/configs.rs index f17ea5a0..5f97037e 100644 --- a/src/detections/configs.rs +++ b/src/detections/configs.rs @@ -1,7 +1,7 @@ use crate::detections::print::AlertMessage; use crate::detections::utils; use chrono::{DateTime, Utc}; -use clap::{App, AppSettings, Arg, ArgMatches}; +use clap::{App, AppSettings, ArgMatches}; use hashbrown::HashMap; use hashbrown::HashSet; use lazy_static::lazy_static; @@ -80,6 +80,7 @@ fn build_app<'a>() -> ArgMatches<'a> { -u --update-rules 'Update to the latest rules in the hayabusa-rules github repository.' -m --min-level=[LEVEL] 'Minimum level for rules. (Default: informational)' -l --live-analysis 'Analyze the local C:\\Windows\\System32\\winevt\\Logs folder (Windows Only. Administrator privileges required.)' + --level-tuning= 'Fix rule file's level [default: ./config/level_tuning.txt]' --start-timeline=[STARTTIMELINE] 'Start time of the event logs to load. (Example: '2018/11/28 12:00:00 +09:00')' --end-timeline=[ENDTIMELINE] 'End time of the event logs to load. (Example: '2018/11/28 12:00:00 +09:00')' --rfc-2822 'Output date and time in RFC 2822 format. (Example: Mon, 07 Aug 2006 12:34:56 -0600)' @@ -95,11 +96,6 @@ fn build_app<'a>() -> ArgMatches<'a> { .version("1.1.0") .author("Yamato Security (https://github.com/Yamato-Security/hayabusa)") .setting(AppSettings::VersionlessSubcommands) - .arg( - // TODO: When update claps to 3.x, these can write in usage texts... - Arg::from_usage("--level-tuning=[LEVEL_TUNING_FILE] 'Fix rule file's level'") - .default_value("./config/level_tuning.txt"), - ) .usage(usages) .args_from_usage(usages) .get_matches() diff --git a/src/main.rs b/src/main.rs index 133c8d40..9c08e7d6 100644 --- a/src/main.rs +++ b/src/main.rs @@ -112,31 +112,34 @@ impl App { .args .is_present("level-tuning") { - if let Some(level_tuning_config_path) = configs::CONFIG + let level_tuning_config_path = configs::CONFIG .read() .unwrap() .args .value_of("level-tuning") - { - if Path::new(level_tuning_config_path).exists() { - if let Err(err) = LevelTuning::run(level_tuning_config_path, configs::CONFIG + .unwrap_or("./config/level_tuning.txt") + .to_string(); + + if Path::new(&level_tuning_config_path).exists() { + if let Err(err) = LevelTuning::run( + &level_tuning_config_path, + configs::CONFIG .read() .unwrap() .args .value_of("rules") - .unwrap_or("rules")) { - AlertMessage::alert(&mut BufWriter::new(std::io::stderr().lock()), &err) - .ok(); - } - } else { - AlertMessage::alert( - &mut BufWriter::new(std::io::stderr().lock()), - "Need rule_levels.txt file to use --level-tuning option", - ) - .ok(); + .unwrap_or("rules"), + ) { + AlertMessage::alert(&mut BufWriter::new(std::io::stderr().lock()), &err).ok(); } - return; + } else { + AlertMessage::alert( + &mut BufWriter::new(std::io::stderr().lock()), + "Need rule_levels.txt file to use --level-tuning option", + ) + .ok(); } + return; } if !Path::new("./config").exists() {