Yamato-Security / hayabusa

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
GNU Affero General Public License v3.0
2.32k stars 203 forks source link

fix: output completion message when scan is finished #1462

Closed fukusuket closed 3 weeks ago

fukusuket commented 4 weeks ago

What Changed

Evidence

% ./hayabusa csv-timeline -d ../hayabusa-sample-evtx -w

スクリーンショット 2024-10-25 3 07 47

% ./hayabusa csv-timeline -d ../hayabusa-sample-evtx -w -o timeline.csv

スクリーンショット 2024-10-25 3 09 10

I would appreciate it if you could check it out when you have time🙏

YamatoSecurity commented 4 weeks ago

@fukusuket Thanks so much! I check that it is working well for both csv-timeline and json-timeline.

For json-timeline, the output at the end is like this:

        "Count": 14,
        "TargetUserName": "jlake/ssims/edygert/bking/mdouglas/jorchilles/bgalbraith/baker/cspizor/cragoso/smisenar/bgreenwood/dmashburn/drook",
        "IpAddress": "172.16.144.128"
    },
    "ExtraFieldInfo": {}
}
{
    "Timestamp": "2016-09-20 01:50:06.513 +09:00",
    "RuleTitle": "PW Guessing",
    "Level": "med",
    "Computer": "DESKTOP-M5SN04R",
    "Channel": "Sec",
    "EventID": 4625,
    "RecordID": "-",
    "Details": {
        "Count": 3558,
        "TargetUserName": "Administrator",
        "TargetDomainName": ".",
        "IpAddress": "192.168.198.149",
        "LogonType": 3,
        "ProcessName": "-",
        "LogonProcessName": "NtLmSsp"
    },
    "ExtraFieldInfo": {}
}
[00:00:19] 584 / 584   [========================================] 100%

Scanning finished.

Rule Authors:

Is it possible to add a space just before the progress bar?

Ex:

}

[00:00:19] 584 / 584   [========================================] 100%
fukusuket commented 4 weeks ago

@YamatoSecurity Thank you for checking :) I fixed it!!

% ./hayabusa json-timeline -d ../hayabusa-sample-evtx/YamatoSecurity -w -q
...
        "CVEID": "[CVE-2020-0601] cert validation"
    }
}

[00:00:00] 13 / 13   [========================================] 100%

Scanning finished.

Rule Authors: