diff --git a/src/detections/configs.rs b/src/detections/configs.rs index 59e76bb7..67d64147 100644 --- a/src/detections/configs.rs +++ b/src/detections/configs.rs @@ -55,21 +55,21 @@ fn build_app<'a>() -> ArgMatches<'a> { let usages = "-d --directory=[DIRECTORY] 'Directory of multiple .evtx files.' -f --filepath=[FILEPATH] 'File path to one .evtx file.' - -r --rules=[RULEDIRECTORY/RULEFILE] 'Rule file or directory (default: ./rules)' + -r --rules=[RULEFILE/RULEDIRECTORY] 'Rule file or directory. (Default: ./rules)' -c --color 'Output with color. (Terminal needs to support True Color.)' - -o --output=[CSV_TIMELINE] 'Save the timeline in CSV format. (example: results.csv)' + -o --output=[CSV_TIMELINE] 'Save the timeline in CSV format. (Example: results.csv)' -v --verbose 'Output verbose information.' - -D --enable-deprecated-rules 'Enable sigma rules marked as deprecated.' + -D --enable-deprecated-rules 'Enable rules marked as deprecated.' -n --enable-noisy-rules 'Enable rules marked as noisy.' - -u --update-rules 'Clone latest hayabusa-rule' - -m --min-level=[LEVEL] 'Minimum level for rules. (default: informational)' - -l --live-analysis 'Analyze to WINDIR\\System32\\winevt\\Logs (Windows Only. Need Administrator privileges.)' - --start-timeline=[STARTTIMELINE] 'Start time of the event to load from event file. (example: '2018/11/28 12:00:00 +09:00')' - --end-timeline=[ENDTIMELINE] 'End time of the event to load from event file. (example: '2018/11/28 12:00:00 +09:00')' - --rfc-2822 'Output date and time in RFC 2822 format. (example: Mon, 07 Aug 2006 12:34:56 -0600)' - --rfc-3339 'Output date and time in RFC 3339 format. (example: 2006-08-07T12:34:56.485214 -06:00)' - -U --utc 'Output time in UTC format. (default: local time)' - -t --thread-number=[NUMBER] 'Thread number. (default: optimal number for performance.)' + -u --update-rules 'Update to the latest rules in the hayabusa-rules github repository.' + -m --min-level=[LEVEL] 'Minimum level for rules. (Default: informational)' + -l --live-analysis 'Analyze the local C:\\Windows\\System32\\winevt\\Logs folder (Windows Only. Administrator privileges required.)' + --start-timeline=[STARTTIMELINE] 'Start time of the event logs to load. (Example: '2018/11/28 12:00:00 +09:00')' + --end-timeline=[ENDTIMELINE] 'End time of the event logs to load. (Example: '2018/11/28 12:00:00 +09:00')' + --rfc-2822 'Output date and time in RFC 2822 format. (Example: Mon, 07 Aug 2006 12:34:56 -0600)' + --rfc-3339 'Output date and time in RFC 3339 format. (Example: 2006-08-07T12:34:56.485214 -06:00)' + -U --utc 'Output time in UTC format. (Default: local time)' + -t --thread-number=[NUMBER] 'Thread number. (Default: Optimal number for performance.)' -s --statistics 'Prints statistics of event IDs.' -q --quiet 'Quiet mode. Do not display the launch banner.' -Q --quiet-errors 'Quiet errors mode. Do not save error logs.' diff --git a/src/main.rs b/src/main.rs index 7bb7d2b4..533b6e73 100644 --- a/src/main.rs +++ b/src/main.rs @@ -148,7 +148,7 @@ impl App { { AlertMessage::alert( &mut BufWriter::new(std::io::stderr().lock()), - &"--filepath only accepts .evtx files. no hidden file.".to_string(), + &"--filepath only accepts .evtx files. Hidden files are ignored.".to_string(), ) .ok(); return;