Closed fukusuket closed 4 months ago
@YamatoSecurity @hitenkoku
I'm thinking about which is the best expected behavior...🤔, what do you think? Personally, I think it might be better to indicate that -A, --enable-all-rules /-a, --scan-all-evtx-files
option is required...? (or if you have any other ideas, please let me know🙏)
@fukusuket I think that is a good idea. Since the JSON(L) files won't usually be separated by Channel like evtx
files then I think we can solve this by just requiring -A
and -a
whenever -J
is specified.
@YamatoSecurity Thank you for comment! I'll Implement with the above specifications.
Update: Since more options will usually confuse users, we should automatically disable the channel filter whenever the input is JSON, instead of EVTX
Describe the bug Nothing is detected when using the
-J, --JSON-input
option with the timeline command because ofChannel
filer https://github.com/Yamato-Security/hayabusa/pull/1334 :( This issue occurs only indev-2.16.0
version.Step to Reproduce
hayabusa csv-timeline -f ../apt29/apt29_evals_day1_manual_2020-05-01225525.json -J -w
Actual behavior Nothing is detected.
Expected behavior I expect the following behavior. It is necessary to consider which specifications to use.
2.15.0
(disable Channel filter when-J, --JSON-input
)-A, --enable-all-rules
/-a, --scan-all-evtx-files
option is required.evtx
, get theChannel
of the first record and filter based on itJSON
has 1 channel in 1 file likeevtx
?Environment
Additional context If you enable the
-A, --enable-all-rules
/-a, --scan-all-evtx-files
option, it will be detected as in version 2.15.0.