search

Yamato-Security / hayabusa

Hayabusa (éš¼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
GNU Affero General Public License v3.0
2.32k stars 203 forks source link

[bug] `update-rules` fails for packages created with `Release Automation` #1429

Closed fukusuket closed 1 month ago

fukusuket commented 1 month ago

Describe the bug update-rules fails for packages created with Release Automation.

Sorry, I did not notice this issue because the rules folder was up to date when I was testing :( This issue occurs when there is an update to hayabusa_rules repo after the Release Automation Actions are executed.

Step to Reproduce

  1. Download package from https://github.com/Yamato-Security/hayabusa/actions/runs/11233651311
  2. ./hayabusa update-rules

Actual behavior

% ./hayabusa-2.18.0-mac-aarch64 update-rules -q
Start time: 2024/10/09 09:14

[ERROR] Failed to update rules. Error { code: -1, klass: 9, message: "object not found - no match for id (3c2a557667c452d01ed9c869be0d86ee669cb78b)" }

Expected behavior Successfully updated rules

Environment

Additional context I have been deleting unused files under the rules folder in the actions, so that may be the cause ... 🤔

In Integration-test, cargo build --release binaries are used. However, it does not use the release package zip, so it cannot detect this issue. It might be better to also have an Integration-test that uses the release package zip...

fukusuket commented 1 month ago

[ERROR] Failed to update rules. Error { code: -1, klass: 9, message: "object not found - no match for id (3c2a557667c452d01ed9c869be0d86ee669cb78b)" }

The above message matches the following commit hash from this morning https://github.com/Yamato-Security/hayabusa-rules/commit/3c2a557667c452d01ed9c869be0d86ee669cb78b

fukusuket commented 1 month ago

The cause was that only the latest commit in git was available, as shown below.

fukusuke@fukusukenoMacBook-Air ~ % cd Downloads/hayabusa-2.18.0-mac-arm/rules
fukusuke@fukusukenoMacBook-Air rules % pwd
/Users/fukusuke/Downloads/hayabusa-2.18.0-mac-arm/rules
fukusuke@fukusukenoMacBook-Air rules % git log --all
commit 61cc3c153b85132582c923e35d0b67d01927c9de (grafted, HEAD -> main, origin/main)
Author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Date:   Mon Oct 7 20:15:16 2024 +0000

    Sigma Rule Update (2024-10-07  20:15:08) (#735)

    Co-authored-by: hach1yon <hach1yon@users.noreply.github.com>
fukusuke@fukusukenoMacBook-Air rules %

To keep all commit history in git, we need to specify fetch-depth: 0 in the following action. https://github.com/actions/checkout?tab=readme-ov-file#fetch-all-history-for-all-tags-and-branches

I would modify it to specify fetch-depth: 0.

fukusuket commented 1 month ago

After specifying fetch-depth: 0, I confirmed that the commit history is retained.

fukusuke@fukusukenoMacBook-Air Downloads % cd hayabusa-2.18.0-mac-arm/rules
fukusuke@fukusukenoMacBook-Air rules % git log --all
commit a04b2a90be14b7317d1ac8ed1d8c692de573fa1d (HEAD -> main, origin/main)
Author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Date:   Tue Oct 8 21:12:20 2024 +0000

    Sigma Rule Supported Modifier Update (2024-10-08  21:12:14) (#737)

    Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>

commit 423ed0cc979f7ca1d6225e64d16c3e067196973c
Author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Date:   Tue Oct 8 20:13:20 2024 +0000

    Sigma Rule Update (2024-10-08  20:13:13) (#736)

    Co-authored-by: hach1yon <hach1yon@users.noreply.github.com>

commit 61cc3c153b85132582c923e35d0b67d01927c9de
Author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Date:   Mon Oct 7 20:15:16 2024 +0000

    Sigma Rule Update (2024-10-07  20:15:08) (#735)

    Co-authored-by: hach1yon <hach1yon@users.noreply.github.com>

commit 3c2a557667c452d01ed9c869be0d86ee669cb78b
Author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Date:   Sun Oct 6 21:10:53 2024 +0000

    Sigma Rule Supported Modifier Update (2024-10-06  21:10:47) (#734)

    Co-authored-by: YamatoSecurity <YamatoSecurity@users.noreply.github.com>

commit b83ba8b3e131b9834d0518b5f17199a95875802d
Merge: 33a181e0 220cae37
Author: Zach Mathis (田中ザック) <71482215+YamatoSecurity@users.noreply.github.com>
Date:   Sat Oct 5 07:42:53 2024 +0900
...