feat: output field information in green and messages in orange #1498

fukusuket · 2024-11-15T08:39:56Z

What Changed

Closed Output field information in green and messages in orange #1491

Evidence

Integration-Test

https://github.com/Yamato-Security/hayabusa/actions/runs/11853318764

I would appreciate it if you could check it out when you have time🙏

YamatoSecurity · 2024-11-15T09:19:34Z

@fukusuket Thanks so much! Looking great! One small part, I noticed Scanning finished. Please wait while the results are being saved. is still white. Is it possible to display in orange? If it is hard because it is part of the progress bar then we can leave it white or make everything (files being scanned) all orange if possible.

fukusuket · 2024-11-15T09:27:21Z

@YamatoSecurity
Thank you so much for checking!
Unfortunately I tried, but that message was output in the Progress Bar module and I could not change the color... :(

fukusuket · 2024-11-15T09:28:13Z

The color can be changed by erasing the progress bar itself at the end of the progress bar, but I think it is easier to understand if the progress bar is output at 100%.

fukusuket · 2024-11-15T09:29:33Z

Sorry, I noticed that commands other than timeline (metrics/pivot ... etc) still need to be colored, so I'm fixing it!

…keywords-list)

…er-metrics)

…summary)

…rofile)

fukusuket · 2024-11-15T11:53:07Z

@YamatoSecurity
I fixed coloring except for timeline commands as follows! Could you please check it?🙏
https://github.com/Yamato-Security/hayabusa/actions/runs/11855691986

YamatoSecurity · 2024-11-15T23:07:32Z

@fukusuket Thanks! I figured out how to make the "Scanning finished...." message orange but it is still orange when --no-color option is enabled. Do you know how to disable the coloring when this is enabled?
Also, could you add a short-hand option for --no-color. Maybe -k? (anything that is not already used it ok)

…trics)

…ss bar msg)

fukusuket · 2024-11-15T23:29:25Z

@YamatoSecurity
Thank you so much! Great!!🚀 I updated #1498 (comment) :)

https://github.com/Yamato-Security/hayabusa/actions/runs/11864959662

YamatoSecurity · 2024-11-15T23:42:39Z

@fukusuket Thanks!

Could you add a space here:

./target/release/hayabusa list-profiles

┏┓ ┏┳━━━┳┓  ┏┳━━━┳━━┓┏┓ ┏┳━━━┳━━━┓
┃┃ ┃┃┏━┓┃┗┓┏┛┃┏━┓┃┏┓┃┃┃ ┃┃┏━┓┃┏━┓┃
┃┗━┛┃┃ ┃┣┓┗┛┏┫┃ ┃┃┗┛┗┫┃ ┃┃┗━━┫┃ ┃┃
┃┏━┓┃┗━┛┃┗┓┏┛┃┗━┛┃┏━┓┃┃ ┃┣━━┓┃┗━┛┃
┃┃ ┃┃┏━┓┃ ┃┃ ┃┏━┓┃┗━┛┃┗━┛┃┗━┛┃┏━┓┃
┗┛ ┗┻┛ ┗┛ ┗┛ ┗┛ ┗┻━━━┻━━━┻━━━┻┛ ┗┛
   by Yamato Security

Collecting the gold specks in the desert~

Start time: 2024/11/16 08:40
List of available profiles:
- minimal:                 %Timestamp%, %RuleTitle%, %Level%, %Computer%, %Channel%, %EventID%, %RecordID%, %Details%
- standard:                %Timestamp%, %RuleTitle%, %Level%, %Computer%, %Channel%, %EventID%, %RecordID%, %Details%, %ExtraFieldInfo%
- verbose:                 %Timestamp%, %RuleTitle%, %Level%, %Computer%, %Channel%, %EventID%, %MitreTactics%, %MitreTags%, %OtherTags%, %RecordID%, %Details%, %ExtraFieldInfo%, %RuleFile%, %EvtxFile%
- all-field-info:          %Timestamp%, %RuleTitle%, %Level%, %Computer%, %Channel%, %EventID%, %RecordID%, %AllFieldInfo%, %RuleFile%, %EvtxFile%
- all-field-info-verbose:  %Timestamp%, %RuleTitle%, %Level%, %Computer%, %Channel%, %EventID%, %MitreTactics%, %MitreTags%, %OtherTags%, %RecordID%, %AllFieldInfo%, %RuleFile%, %EvtxFile%
- super-verbose:           %Timestamp%, %RuleTitle%, %Level%, %Computer%, %Channel%, %EventID%, %RuleAuthor%, %RuleModifiedDate%, %Status%, %RecordID%, %Details%, %ExtraFieldInfo%, %MitreTactics%, %MitreTags%, %OtherTags%, %Provider%, %RuleCreationDate%, %RuleFile%, %EvtxFile%
- timesketch-minimal:      %Timestamp%, hayabusa, %RuleTitle%, %Level%, %Computer%, %Channel%, %EventID%, %MitreTactics%, %MitreTags%, %OtherTags%, %RecordID%, %Details%, %RuleFile%, %EvtxFile%
- timesketch-verbose:      %Timestamp%, hayabusa, %RuleTitle%, %Level%, %Computer%, %Channel%, %EventID%, %MitreTactics%, %MitreTags%, %OtherTags%, %RecordID%, %Details%, %ExtraFieldInfo%, %RuleFile%, %EvtxFile%
日々是好日 - Nichinichi Kore Koujitsu - Everyday is a good day.

After:

./target/release/hayabusa list-profiles

┏┓ ┏┳━━━┳┓  ┏┳━━━┳━━┓┏┓ ┏┳━━━┳━━━┓
┃┃ ┃┃┏━┓┃┗┓┏┛┃┏━┓┃┏┓┃┃┃ ┃┃┏━┓┃┏━┓┃
┃┗━┛┃┃ ┃┣┓┗┛┏┫┃ ┃┃┗┛┗┫┃ ┃┃┗━━┫┃ ┃┃
┃┏━┓┃┗━┛┃┗┓┏┛┃┗━┛┃┏━┓┃┃ ┃┣━━┓┃┗━┛┃
┃┃ ┃┃┏━┓┃ ┃┃ ┃┏━┓┃┗━┛┃┗━┛┃┗━┛┃┏━┓┃
┗┛ ┗┻┛ ┗┛ ┗┛ ┗┛ ┗┻━━━┻━━━┻━━━┻┛ ┗┛
   by Yamato Security

Collecting the gold specks in the desert~

Start time: 2024/11/16 08:40
List of available profiles:
- minimal:                 %Timestamp%, %RuleTitle%, %Level%, %Computer%, %Channel%, %EventID%, %RecordID%, %Details%
- standard:                %Timestamp%, %RuleTitle%, %Level%, %Computer%, %Channel%, %EventID%, %RecordID%, %Details%, %ExtraFieldInfo%
- verbose:                 %Timestamp%, %RuleTitle%, %Level%, %Computer%, %Channel%, %EventID%, %MitreTactics%, %MitreTags%, %OtherTags%, %RecordID%, %Details%, %ExtraFieldInfo%, %RuleFile%, %EvtxFile%
- all-field-info:          %Timestamp%, %RuleTitle%, %Level%, %Computer%, %Channel%, %EventID%, %RecordID%, %AllFieldInfo%, %RuleFile%, %EvtxFile%
- all-field-info-verbose:  %Timestamp%, %RuleTitle%, %Level%, %Computer%, %Channel%, %EventID%, %MitreTactics%, %MitreTags%, %OtherTags%, %RecordID%, %AllFieldInfo%, %RuleFile%, %EvtxFile%
- super-verbose:           %Timestamp%, %RuleTitle%, %Level%, %Computer%, %Channel%, %EventID%, %RuleAuthor%, %RuleModifiedDate%, %Status%, %RecordID%, %Details%, %ExtraFieldInfo%, %MitreTactics%, %MitreTags%, %OtherTags%, %Provider%, %RuleCreationDate%, %RuleFile%, %EvtxFile%
- timesketch-minimal:      %Timestamp%, hayabusa, %RuleTitle%, %Level%, %Computer%, %Channel%, %EventID%, %MitreTactics%, %MitreTags%, %OtherTags%, %RecordID%, %Details%, %RuleFile%, %EvtxFile%
- timesketch-verbose:      %Timestamp%, hayabusa, %RuleTitle%, %Level%, %Computer%, %Channel%, %EventID%, %MitreTactics%, %MitreTags%, %OtherTags%, %RecordID%, %Details%, %ExtraFieldInfo%, %RuleFile%, %EvtxFile%

日々是好日 - Nichinichi Kore Koujitsu - Everyday is a good day.

YamatoSecurity · 2024-11-15T23:43:47Z

Sorry, it is unrelated to this PR but here:

./target/release/hayabusa list-contributors

┏┓ ┏┳━━━┳┓  ┏┳━━━┳━━┓┏┓ ┏┳━━━┳━━━┓
┃┃ ┃┃┏━┓┃┗┓┏┛┃┏━┓┃┏┓┃┃┃ ┃┃┏━┓┃┏━┓┃
┃┗━┛┃┃ ┃┣┓┗┛┏┫┃ ┃┃┗┛┗┫┃ ┃┃┗━━┫┃ ┃┃
┃┏━┓┃┗━┛┃┗┓┏┛┃┗━┛┃┏━┓┃┃ ┃┣━━┓┃┗━┛┃
┃┃ ┃┃┏━┓┃ ┃┃ ┃┏━┓┃┗━┛┃┗━┛┃┗━┛┃┏━┓┃
┗┛ ┗┻┛ ┗┛ ┗┛ ┗┛ ┗┻━━━┻━━━┻━━━┻┛ ┗┛
   by Yamato Security

Giving you the Windows event logs you've always wanted~

Start time: 2024/11/16 08:42
Hayabusa was possible thanks to the following people (in alphabetical order):

Akira Nishikawa (@nishikawaakira): First lead developer (core hayabusa rule support, etc...)
Fukusuke Takahashi (fukusuket): Core developer (Too many bug fixes to count, hayabusa converter upgrades, new features, etc...)
Garigariganzy (@garigariganzy31): Developer (Event ID metrics implementation, etc...)
ItiB (@itiB_S144):  Core developer (sigmac hayabusa backend, search command, etc...)
James Takai / hachiyone(@hach1yon): Second lead developer (Tokio multi-threading, sigma aggregation logic, sigmac backend, rule creation, sigma count implementation etc…)
Kazuminn (@k47_um1n): Core Developer (Many features.)
Matthew Seyer: adding the ability to carve out records
Tsubokku (@ytsuboi0322): Translations
Yusuke Matsui (@apt773): AD hacking working group leader, rule testing, documentation, research, support, etc...
Zach Mathis (@yamatosecurity, Yamato Security Founder): Project leader, tool and concept design, rule creation and tuning, etc…

Also a big thanks to the following people for projects that make Hayabusa possible:

Omer BenAmram for creating the Rust evtx crate.
The maintainers and contributors of the Sigma project.

Can you remove the Start time: 2024/11/16 08:42 ?

YamatoSecurity · 2024-11-15T23:49:05Z

Sorry, the search command has a -k option for keyword searching. How about we use -K instead?

fukusuket · 2024-11-15T23:56:55Z

Thank you for checking! I fixed above comments!

YamatoSecurity · 2024-11-16T00:00:32Z

thanks! Sorry, one more small thing:

./target/release/hayabusa update-rules

┏┓ ┏┳━━━┳┓  ┏┳━━━┳━━┓┏┓ ┏┳━━━┳━━━┓
┃┃ ┃┃┏━┓┃┗┓┏┛┃┏━┓┃┏┓┃┃┃ ┃┃┏━┓┃┏━┓┃
┃┗━┛┃┃ ┃┣┓┗┛┏┫┃ ┃┃┗┛┗┫┃ ┃┃┗━━┫┃ ┃┃
┃┏━┓┃┗━┛┃┗┓┏┛┃┗━┛┃┏━┓┃┃ ┃┣━━┓┃┗━┛┃
┃┃ ┃┃┏━┓┃ ┃┃ ┃┏━┓┃┗━┛┃┗━┛┃┗━┛┃┏━┓┃
┗┛ ┗┻┛ ┗┛ ┗┛ ┗┛ ┗┻━━━┻━━━┻━━━┻┛ ┗┛
   by Yamato Security

Faster insights, deeper analysis, every time~

Start time: 2024/11/16 08:58
You currently have the latest rules.

柔よく剛を制す - Juu Yoku Gou O Seisu - Softness overcomes hardness.

can you add a space here ->

./target/release/hayabusa update-rules

┏┓ ┏┳━━━┳┓  ┏┳━━━┳━━┓┏┓ ┏┳━━━┳━━━┓
┃┃ ┃┃┏━┓┃┗┓┏┛┃┏━┓┃┏┓┃┃┃ ┃┃┏━┓┃┏━┓┃
┃┗━┛┃┃ ┃┣┓┗┛┏┫┃ ┃┃┗┛┗┫┃ ┃┃┗━━┫┃ ┃┃
┃┏━┓┃┗━┛┃┗┓┏┛┃┗━┛┃┏━┓┃┃ ┃┣━━┓┃┗━┛┃
┃┃ ┃┃┏━┓┃ ┃┃ ┃┏━┓┃┗━┛┃┗━┛┃┗━┛┃┏━┓┃
┗┛ ┗┻┛ ┗┛ ┗┛ ┗┛ ┗┻━━━┻━━━┻━━━┻┛ ┗┛
   by Yamato Security

Faster insights, deeper analysis, every time~

Start time: 2024/11/16 08:58

You currently have the latest rules.

柔よく剛を制す - Juu Yoku Gou O Seisu - Softness overcomes hardness.

YamatoSecurity · 2024-11-16T00:01:20Z

sorry! here as well

./target/release/hayabusa set-default-profile -p super-verbose

┏┓ ┏┳━━━┳┓  ┏┳━━━┳━━┓┏┓ ┏┳━━━┳━━━┓
┃┃ ┃┃┏━┓┃┗┓┏┛┃┏━┓┃┏┓┃┃┃ ┃┃┏━┓┃┏━┓┃
┃┗━┛┃┃ ┃┣┓┗┛┏┫┃ ┃┃┗┛┗┫┃ ┃┃┗━━┫┃ ┃┃
┃┏━┓┃┗━┛┃┗┓┏┛┃┗━┛┃┏━┓┃┃ ┃┣━━┓┃┗━┛┃
┃┃ ┃┃┏━┓┃ ┃┃ ┃┏━┓┃┗━┛┃┗━┛┃┗━┛┃┏━┓┃
┗┛ ┗┻┛ ┗┛ ┗┛ ┗┛ ┗┻━━━┻━━━┻━━━┻┛ ┗┛
   by Yamato Security

Elevating Windows DFIR to new heights~

Start time: 2024/11/16 09:00
Successfully updated the default profile.

不言実行 - Fugen Jikkou - Actions speak louder than words.

->

./target/release/hayabusa set-default-profile -p super-verbose

┏┓ ┏┳━━━┳┓  ┏┳━━━┳━━┓┏┓ ┏┳━━━┳━━━┓
┃┃ ┃┃┏━┓┃┗┓┏┛┃┏━┓┃┏┓┃┃┃ ┃┃┏━┓┃┏━┓┃
┃┗━┛┃┃ ┃┣┓┗┛┏┫┃ ┃┃┗┛┗┫┃ ┃┃┗━━┫┃ ┃┃
┃┏━┓┃┗━┛┃┗┓┏┛┃┗━┛┃┏━┓┃┃ ┃┣━━┓┃┗━┛┃
┃┃ ┃┃┏━┓┃ ┃┃ ┃┏━┓┃┗━┛┃┗━┛┃┗━┛┃┏━┓┃
┗┛ ┗┻┛ ┗┛ ┗┛ ┗┛ ┗┻━━━┻━━━┻━━━┻┛ ┗┛
   by Yamato Security

Elevating Windows DFIR to new heights~

Start time: 2024/11/16 09:00

Successfully updated the default profile.

不言実行 - Fugen Jikkou - Actions speak louder than words.

YamatoSecurity

@fukusuket Perfect! Thanks so much!

feat: output field information in green and messages in orange

9bfe55b

fukusuket added the enhancement New feature or request label Nov 15, 2024

fukusuket added this to the 2.19.0 milestone Nov 15, 2024

fukusuket self-assigned this Nov 15, 2024

fukusuket added 4 commits November 15, 2024 17:51

test: add -C option

8100cd8

fix: --no-color case

bdd77b6

fix: --no-color case

c66945d

fix: --no-color case

5381b7b

fukusuket requested a review from YamatoSecurity November 15, 2024 09:06

fukusuket marked this pull request as ready for review November 15, 2024 09:06

fukusuket marked this pull request as draft November 15, 2024 09:14

YamatoSecurity and others added 5 commits November 15, 2024 18:55

update changelog

33e521d

feat: output field information in green and messages in orange(pivot-…

2b266e8

…keywords-list)

feat: output field information in green and messages in orange(comput…

e298d0a

…er-metrics)

feat: output field information in green and messages in orange(logon-…

bf1d2df

…summary)

feat: output field information in green and messages in orange(search)

6d75d16

fukusuket marked this pull request as ready for review November 15, 2024 11:39

feat: output field information in green and messages in orange(list-p…

8a22b07

…rofile)

make scanning finished orange

a853d79

YamatoSecurity and others added 5 commits November 16, 2024 08:07

cargo fmt

7703228

feat: output field information in green and messages in orange(eid-me…

b4a98f7

…trics)

feat: add no-color short option(-K)

964beb8

feat: add no-color short option(-k)

ba1da35

feat: output field information in green and messages in orange(progre…

81dfe1c

…ss bar msg)

fix: add space

dd29c10

fukusuket added 2 commits November 16, 2024 08:54

chg: do not display start time when list-contributors

2f7ef48

chg: no-color short option

f2f6945

contributor typo

8d3e8bf

chg: add space

b4c56cd

YamatoSecurity approved these changes Nov 16, 2024

View reviewed changes

YamatoSecurity merged commit 684d134 into main Nov 16, 2024
9 checks passed

fukusuket deleted the 1491-output-field-info-in-green-and-msg-in-orange branch November 16, 2024 00:18

fukusuket mentioned this pull request Nov 24, 2024

[bug] Saved file <file name> (file size) message is not output #1504

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: output field information in green and messages in orange #1498

feat: output field information in green and messages in orange #1498

fukusuket commented Nov 15, 2024 •

edited

Loading

YamatoSecurity commented Nov 15, 2024

fukusuket commented Nov 15, 2024

fukusuket commented Nov 15, 2024 •

edited

Loading

fukusuket commented Nov 15, 2024

fukusuket commented Nov 15, 2024

YamatoSecurity commented Nov 15, 2024

fukusuket commented Nov 15, 2024 •

edited

Loading

YamatoSecurity commented Nov 15, 2024

YamatoSecurity commented Nov 15, 2024

YamatoSecurity commented Nov 15, 2024

fukusuket commented Nov 15, 2024

YamatoSecurity commented Nov 16, 2024

YamatoSecurity commented Nov 16, 2024

YamatoSecurity left a comment

feat: output field information in green and messages in orange #1498

feat: output field information in green and messages in orange #1498

Conversation

fukusuket commented Nov 15, 2024 • edited Loading

What Changed

Evidence

Integration-Test

YamatoSecurity commented Nov 15, 2024

fukusuket commented Nov 15, 2024

fukusuket commented Nov 15, 2024 • edited Loading

fukusuket commented Nov 15, 2024

fukusuket commented Nov 15, 2024

YamatoSecurity commented Nov 15, 2024

fukusuket commented Nov 15, 2024 • edited Loading

YamatoSecurity commented Nov 15, 2024

YamatoSecurity commented Nov 15, 2024

YamatoSecurity commented Nov 15, 2024

fukusuket commented Nov 15, 2024

YamatoSecurity commented Nov 16, 2024

YamatoSecurity commented Nov 16, 2024

YamatoSecurity left a comment

Choose a reason for hiding this comment

fukusuket commented Nov 15, 2024 •

edited

Loading

fukusuket commented Nov 15, 2024 •

edited

Loading

fukusuket commented Nov 15, 2024 •

edited

Loading