Commit Graph

79 Commits

Author SHA1 Message Date
Yamato Security
d7ca64fec5 finalize 1.6.0 2022-09-16 08:23:51 +09:00
Yamato Security
a33936e23f add timesketch import docs 2022-08-20 20:03:53 +09:00
Yamato Security
0ecbf0ee35 timesketch compatibility 2022-08-20 13:29:50 +09:00
Tanaka Zakku
4411457663 update profile 2022-08-08 10:45:01 +09:00
Tanaka Zakku
216d821d28 update profiles 2022-08-08 10:28:08 +09:00
DastInDark
3f25f951e7 Changed MitreTechniques alias to MitreTags due to MitreTags is included
tags expect techniques.
2022-08-07 00:24:32 +09:00
DastInDark
2bb5bd4022 added new tags in default_profile.yaml 2022-08-07 00:10:32 +09:00
DastInDark
b58ddcdfe6 Renamed file name To be clearly output_tag.txt treat MitreTactics #637 2022-08-07 00:05:43 +09:00
DastInDark
c36e4e8e6f fixed rulepath and evtxpath to adjust #625 change #165 2022-07-31 13:30:56 +09:00
DastInDark
5e3be8ab6a removed Tag column due to Tag Info is another enhance request. 2022-07-31 12:33:29 +09:00
DastInDark
db757cb041 To avoid confuse, default profile section is changed name to standard. 2022-07-31 12:32:40 +09:00
DastInDark
e207a9e7b2 To avoid confuse ,Unified quote of profile file in config folder to double quote #165 2022-07-31 12:11:44 +09:00
DastInDark
fedbd57083 Changed profile file extension from txt to yaml to indicate yaml format #165 2022-07-31 12:06:03 +09:00
DastInDark
548f8f065a added default_profile and cargo fmt 2022-07-24 23:15:54 +09:00
DastInDark
ead69e78dc add: To create profile load process. #165 2022-07-19 05:20:50 +09:00
Tanaka Zakku
411ebcadfb readme update 2022-07-01 07:27:46 +09:00
Tanaka Zakku
5da0c6982b delete unneeded files 2022-06-29 22:10:55 +09:00
Tanaka Zakku
dd28d27afe updates 2022-06-29 10:17:23 +09:00
DustInDark
c8cd0ac3c2 added sample eventids 2022-06-29 00:06:21 +09:00
DustInDark
2dcf960d51 display default channel name if not defined (#555)
* displayed other channel data in Channel column #553

* updated changelog #553

* updated changelog

* readme and channel abbreviataions update

* changelog update

Co-authored-by: Tanaka Zakku <71482215+YamatoSecurity@users.noreply.github.com>
2022-06-01 13:01:14 +09:00
DustInDark
7a7afe732c most detections summary by date (#551)
* added Date with most detections by level #550

* cargo fmt

* updated changelog #550

* updated readme #550

* removed  most undefined detections date in summary #550

* cargo fmt

* add space after level tuning

* changed undefined rule detection count to no show #550

* cargo fmt

* readme update

* channel abb update

* channel abb update

* readme update

Co-authored-by: Tanaka Zakku <71482215+YamatoSecurity@users.noreply.github.com>
2022-05-31 22:29:51 +09:00
DustInDark
b47561a79c remove color option (#518)
* removed used crate in color option and add term color #481

* removed level_color.txt due to fix output color #481

* removed color definition by file

* update cargo

* removed color definiton by true type vec

* added hex crate

* added level_color.txt and color output to command prompt and powershell #481

* adjust termcolor crate
* restored level_color.txt

* remove c option #481

* fixed document #481

* fixed stdoutput test

* add no-color option #481

- disable color output when no-color option set

* added no-color option document

* Fixed clipy err

* doc, changelog, cargo pkg update

* changelog and rules update

* version up to 1.2.2

* readme and changelog update

* reformat to markdown lint

* adjusted logon summary generator section in japanese readme to english
 readme

* fixed typo in readme

Co-authored-by: garigariganzy <tosada31@hotmail.co.jp>
Co-authored-by: Tanaka Zakku <71482215+YamatoSecurity@users.noreply.github.com>
2022-05-17 11:32:57 +09:00
Yamato Security
fc271c2076 Merge pull request #512 from Yamato-Security/511-move-level_tuning.txt
level_tuning.txtのパスを./rules/configに移動
2022-04-20 20:51:14 +09:00
DustInDark
b43eb853e9 Added Channel column and Channel Abbreviations (#508)
* added Channel output #504

* added test #504

* fixed clippy warnings

* fixed convert serde value to Channel #504

* added channel output config #504

* added doc #504

* added Channel column and Channel addreviation

* fixed file name typo

* changed channel position #504

* fixed markdown warnings in CHANGELOG

* readme update

Co-authored-by: Tanaka Zakku <71482215+YamatoSecurity@users.noreply.github.com>
2022-04-20 16:12:53 +09:00
Tanaka Zakku
c6b2879eb5 change path 2022-04-20 10:16:25 +09:00
Yamato Security
dbf3c55bc4 level tuning (#510)
>Co-authored-by: DustInDark <nextsasasa@gmail.com
2022-04-20 09:29:25 +09:00
Yamato Security
861e1c5c4e Merge branch 'develop' into feature/level-tuning#390 2022-04-11 17:24:28 +09:00
DustInDark
d6efb5107a reduce output mitre attack detail tachnique No. by config file (#483)
* reduced mitre attck tag output by config file #477

* prepared 1.2.0 version toml

* added test files and mitre attck strategy tag file #477

* fixed cargo.toml version

* updated cargo.lock

* output tag english update

* cargo fmt

Co-authored-by: Tanaka Zakku <71482215+YamatoSecurity@users.noreply.github.com>
2022-04-07 00:47:08 +09:00
DustInDark
cd8c856d05 changed level_tuning.txt header from next_level to new_level 2022-04-06 22:46:35 +09:00
itiB
52bc918cfb Add: README.md 2022-04-06 01:54:09 +09:00
kazuminn
c8efa95447 Pivot Keyword List機能の追加 (#412)
* add get_pivot_keyword() func

* change function name and call it's function

* [WIP] support config file

* compilete output

* cargo fmt

* [WIP] add test

* add test

* support -o option in pivot

* add pivot mod

* fix miss

* pass test in pivot.rs

* add comment

* pass all test

* add fast return

* fix output

* add test config file

* review

* rebase

* cargo fmt

* test pass

* fix clippy in my commit

* cargo fmt

* little refactor

* change file input logic and config format

* [WIP] change output

* [wip] change deta structure

* change output & change data structure

* pass test

* add config

* cargo fmt & clippy & rebase

* fix cllipy

* delete /rules/ in .gitignore

* clean comment

* clean

* clean

* fix rebase miss

* fix rebase miss

* fix clippy

* file name output on -o to stdout

* add pivot_keywords.txt to ./config

* updated english

* Documentation update

* cargo fmt and clean

* updated translate japanese

* readme update

* readme update

Co-authored-by: DustInDark <nextsasasa@gmail.com>
Co-authored-by: Tanaka Zakku <71482215+YamatoSecurity@users.noreply.github.com>
2022-04-05 21:17:23 +09:00
itiB
9f8f12ec2f fix: level tuning's file name 2022-04-05 02:03:49 +09:00
itiB
d38834e20e Add: input rule_level.txt files & read rules 2022-04-03 21:58:33 +09:00
itiB
276889338d Add: --level-tuning option's outline 2022-04-03 21:57:50 +09:00
garigariganzy
7861174a93 Remove unnecessary code from timeline_event_info and rename files for… (#470)
* Remove unnecessary code from timeline_event_info and rename files for issue462

* Remove unnecessary code #462
2022-03-30 09:46:18 +09:00
Yamato Security
5e14263272 statistics event id update (#457) 2022-03-22 19:01:32 +09:00
Yamato Security
65eb818f9b unique rules to detections (#426) 2022-02-28 10:16:39 +09:00
DustInDark
92c472d451 Hotfix/moved rule configs to hayabusa rules repo#409 (#414)
* fixed target config path #409

* fixed target config file path in test #409

* fixed rules target #409

* Documentation fix, deleted unneeded config files

* added workflow

* changed submodule option

* fixed worksflow to ref submodule

* fixed gitmodules

* fixed workflow

* check code insert

* added update submodules command

* test rules update

* removed test runs

* fixed error

Co-authored-by: Tanaka Zakku <71482215+YamatoSecurity@users.noreply.github.com>
2022-02-26 18:19:19 +09:00
DustInDark
a04b63662c Bugfix/fixed alias to no detect rename binary rule (#406)
* added OriginalFileName alias #405

* removed not exist tag in sigma rule(OriginalFilename)

* fixed typo
2022-02-22 23:17:48 +09:00
Tanaka Zakku
0260a223fd Update config files 2022-02-21 17:07:47 +09:00
DustInDark
58017e971f fixed detection lack when tab and enter control character in event record#395 (#396)
* fixed no detected bug when enter and tab control character in record data #395

* added remove \r \n \t character in utils.rs
* added call of utils.rs function in selectionnodes.rs

* added tests #395

* changed space control character function args #395

* fixed test due to function args changes #395

* changed replace method using regex #395

* changed regex by record_data_filter.txt #395

* added record_data_filter.txt #395

* fixed test #395

* added record_data_filter

- add Properties regex
- add ScriptBlockText regex
- add Payload regex
2022-02-17 05:07:15 +09:00
DustInDark
b12029de5c Feature/colorlog#239 (#365)
* added color carete #239

* added hex library

* added color config file parser #239

* added color output feature #239

* changed fast hashmap library

* added color output description(Japanese) #239

* added color output description(English) #239

* fixed medium level typo

* removed white color font level #239

* added trim and loose colorcode condition #239

* fixed hex convert error panic #239

- output warn and go next iterator when happen hex convert panic

- added user input in hex convert warn output to use easily
2022-01-26 01:39:14 +09:00
kazuminn
15ee980711 exclude-rules.txtとnoisy-rules.txtをコメントに対応 (#362)
* add exclude files comments feature

* trim()

* add error handling and split function

* add id validation

* add comments

* cargo fmt

* fix error statment

* change -full.txt to .txt

* change alert to warn
2022-01-20 23:12:41 +09:00
Tanaka Zakku
b85ccd5af3 timeline event info update 2021-12-23 12:31:04 +09:00
Tanaka Zakku
4ce909fd06 signature.json is not used so will delete 2021-12-23 06:21:36 +09:00
Yamato Security
2681292dcb target_eventids.txt sample file (#329) 2021-12-22 11:28:11 +09:00
Tanaka Zakku
282c0bf249 ruletuning/exclude_win_rare_tasks 2021-12-22 07:58:00 +09:00
Yamato Security
2e37e17300 Revert "bugfix-ExcludeSigmaCountRules#317" (#324) 2021-12-21 20:45:46 +09:00
Tanaka Zakku
5edc0ac11f bugfix-ExcludeSigmaCountRules#317 2021-12-21 07:59:32 +09:00
DustInDark
6e237ebdda Merge branch 'main' into feature/update_eventkey_alias#274 2021-12-19 19:14:16 +09:00