feat: add log-metrics command feature

[fukusuket]

What Changed

• Closed log-metrics command #1474

Evidence

Integration-Test

• https://github.com/Yamato-Security/hayabusa/actions/runs/11794771512

[fukusuket]

I created prototype! The following features have not yet been implemented🤔

• Timeformat
• Filtering
• Abbreviation

@YamatoSecurity
I would appreciate your comments when you have time🙏(Sort order of output results, column order, ... etc)

Terminal Output

CSV Output

[fukusuket]

The following three issues may be better separated as separate issues and will be addressed in a separate pull request.

• Add --disable-abbreviations option  #1485
• [bug] Terminal Table output's tail of metrics command is broken #1486
• Invalid: -x option in logon-summary and eid-metrics will result in duplicate results #1478

[YamatoSecurity]

@fukusuket Thanks! Looking good. Just two things about the table besides what you mentioned.

1. Can you rename "Event Count" to just "Events" because this column title is long it is making the column width wider than necessary.
2. Can you separate the Computers, Channels and Providers by newline instead of commas when there are multiple results? (Make them multi-lined) I think this will be easier to read than separating by commas as well as might make the width narrower.

[YamatoSecurity]

When writing to CSV file, maybe we should separate by the broken pipe character like we do for Hayabusa results?

[YamatoSecurity]

One more bug I noticed is that the progress bar does not reach 100% for some reason.

[fukusuket]

@YamatoSecurity
Thank you for comment! I updated following points! Could you check it?🙏

• feat: add log-metrics command feature #1484 (comment)
• feat: add log-metrics command feature #1484 (comment)

Also, I implemented Timeformat/Filter!

[fukusuket]

I created #1484 (comment) issue as separate one.

• [bug] Progress bar does not complete(eid-metrics/computer-metrics/logon-summary) #1487

[YamatoSecurity]

@fukusuket Thanks! It seems that --timeline-offset is not working. Can you check this?

[YamatoSecurity]

Sorry, just a few small things.

1. Can you change the ¦ separator to ¦ with spaces around it?
2. Does the abbreviations first check the channel_abbreviations.txt file before generic_abbreviations.txt? I see MS-Win-PwrShell/Op but it should be PwSh/Op. Also, provider abbreviations should first check provider_abbreviations.txt and then after that use generic_abbreviations.txt.
3. Could you add a -M, --multiline Output event field information in multiple rows under Output that uses newlines instead of ¦ like we do for csv-timeline?

[fukusuket]

@YamatoSecurity
Thank you for checking! I fixed following four points! Could you check it?🙏

It seems that --timeline-offset is not working. Can you check this?

1. Can you change the ¦ separator to ¦ with spaces around it?
2. Does the abbreviations first check the channel_abbreviations.txt file before generic_abbreviations.txt? I see MS-Win-PwrShell/Op but it should be PwSh/Op. Also, provider abbreviations should first check provider_abbreviations.txt and then after that use generic_abbreviations.txt.
3. Could you add a -M, --multiline Output event field information in multiple rows under Output that uses newlines instead of ¦ like we do for csv-timeline?

[YamatoSecurity]

@fukusuket LGTM! Thanks so much!