diff --git a/README-Japanese.md b/README-Japanese.md index 33f4be56..26747b4b 100644 --- a/README-Japanese.md +++ b/README-Japanese.md @@ -338,6 +338,7 @@ OPTIONS: -d, --directory .evtxファイルを持つディレクトリのパス -D, --enable-deprecated-rules Deprecatedルールを有効にする --end-timeline 解析対象とするイベントログの終了時刻 (例: "2022-02-22 23:59:59 +09:00") + --exclude-status ... 読み込み対象外とするルール内でのステータス (ex: experimental) (ex: stable test) -f, --filepath 1つの.evtxファイルに対して解析を行う -F, --full-data 全てのフィールド情報を出力する -h, --help ヘルプ情報を表示する diff --git a/README.md b/README.md index efff6bb9..8e4a785a 100644 --- a/README.md +++ b/README.md @@ -336,6 +336,7 @@ OPTIONS: -d, --directory Directory of multiple .evtx files -D, --enable-deprecated-rules Enable rules marked as deprecated --end-timeline End time of the event logs to load (ex: "2022-02-22 23:59:59 +09:00") + --exclude-status ... Exclude by status in rule (ex: experimental) (ex: stable test) -f, --filepath File path to one .evtx file -F, --full-data Print all field information -h, --help Print help information diff --git a/src/detections/configs.rs b/src/detections/configs.rs index ff6f3ac9..17731171 100644 --- a/src/detections/configs.rs +++ b/src/detections/configs.rs @@ -214,7 +214,7 @@ pub struct Config { #[clap(long = "target-file-ext", multiple_values = true)] pub evtx_file_ext: Option>, - /// Exclude by status level (ex: expreimental test) + /// Exclude by status in rule (ex: experimental) (ex: stable test) #[clap(long = "exclude-status", multiple_values = true)] pub exclude_status: Option>, }