feat: added wild card and exact search in filter option #1240

CHANGELOG-Japanese.md

@@ -2,19 +2,20 @@
 
 ## 2.13.0 [2024/XX/XX] "XXX Release"
 
-**New Features:**
+**新機能:**
 
 - XXX
 
-**Enhancements:**
+**改善:**
 
+- `search` コマンドのフィルタオプションを完全一致にするようにした。加えてフィルタオプションはワイルドカード対応をするようにした。 (#1240) (@hitenkoku)
 - `update-rules`コマンドを実行したときに、検知ルールが変更された場合にルール名を出力するようにした。以前は`modified:`フィールドを更新したルールだけが表示されていた。(#1243) (@hitenkoku)
 
-**Bug Fixes:**
+**バグ修正:**
 
 - XXX
 
-**Other:**
+**その他:**
 
 - XXX
 

CHANGELOG.md

@@ -8,6 +8,7 @@
 
 **Enhancements:**
 
+- Adjusted the `search` command's Filter option to be an exact match and support wildcard characters. (#1240) (@hitenkoku)
 - Any time there is a change in a detection rule, it will be displayed when running the `update-rules` command. Previously, only rules that updated their `modified:` field would be displayed. (#1243) (@hitenkoku)
 
 **Bug Fixes:**
@@ -18,7 +19,7 @@
 
 - XXX
 
-## 2.12.0 [2023/12/24] "SECCON Christmas Release"
+## 2.12.0 [2023/12/23] "SECCON Christmas Release"
 
 **Enhancements:**
 

Cargo.toml

@@ -4,7 +4,7 @@ version = "2.13.0-dev"
 repository = "https://github.com/Yamato-Security/hayabusa"
 authors = ["Yamato Security @SecurityYamato"]
 edition = "2021"
-rust-version = "1.74.1"
+rust-version = "1.75.0"
 include = ["src/**/*", "LICENSE.txt", "README.md", "CHANGELOG.md"]
 
 [dependencies]
@@ -53,6 +53,7 @@ memchr = "2.*"
 num = "0.4.0"
 indexmap = "2.*"
 dialoguer = "*"
+wildmatch = "2.*"
 
 [profile.dev]
 debug = 0

src/detections/configs.rs

@@ -737,7 +737,7 @@ fn check_thread_number(config: &Config) -> Option<usize> {
 pub enum Action {
     #[clap(
         author = "Yamato Security (https://github.com/Yamato-Security/hayabusa - @SecurityYamato)",
-        help_template = "\nHayabusa v2.12.0 - SECCON Christmas Release\n{author-with-newline}\n{usage-heading}\n  hayabusa.exe csv-timeline <INPUT> [OPTIONS]\n\n{all-args}",
+        help_template = "\nHayabusa v2.13.0 - Dev Build\n{author-with-newline}\n{usage-heading}\n  hayabusa.exe csv-timeline <INPUT> [OPTIONS]\n\n{all-args}",
         term_width = 400,
         disable_help_flag = true,
         display_order = 290
@@ -747,7 +747,7 @@ pub enum Action {
 
     #[clap(
         author = "Yamato Security (https://github.com/Yamato-Security/hayabusa - @SecurityYamato)",
-        help_template = "\nHayabusa v2.12.0 - SECCON Christmas Release\n{author-with-newline}\n{usage-heading}\n  hayabusa.exe json-timeline <INPUT> [OPTIONS]\n\n{all-args}",
+        help_template = "\nHayabusa v2.13.0 - Dev Build\n{author-with-newline}\n{usage-heading}\n  hayabusa.exe json-timeline <INPUT> [OPTIONS]\n\n{all-args}",
         term_width = 400,
         disable_help_flag = true,
         display_order = 360
@@ -757,7 +757,7 @@ pub enum Action {
 
     #[clap(
         author = "Yamato Security (https://github.com/Yamato-Security/hayabusa - @SecurityYamato)",
-        help_template = "\nHayabusa v2.12.0 - SECCON Christmas Release\n{author-with-newline}\n{usage-heading}\n  hayabusa.exe logon-summary <INPUT> [OPTIONS]\n\n{all-args}",
+        help_template = "\nHayabusa v2.13.0 - Dev Build\n{author-with-newline}\n{usage-heading}\n  hayabusa.exe logon-summary <INPUT> [OPTIONS]\n\n{all-args}",
         term_width = 400,
         disable_help_flag = true,
         display_order = 383
@@ -767,7 +767,7 @@ pub enum Action {
 
     #[clap(
         author = "Yamato Security (https://github.com/Yamato-Security/hayabusa - @SecurityYamato)",
-        help_template = "\nHayabusa v2.12.0 - SECCON Christmas Release\n{author-with-newline}\n{usage-heading}\n  hayabusa.exe eid-metrics <INPUT> [OPTIONS]\n\n{all-args}",
+        help_template = "\nHayabusa v2.13.0 - Dev Build\n{author-with-newline}\n{usage-heading}\n  hayabusa.exe eid-metrics <INPUT> [OPTIONS]\n\n{all-args}",
         term_width = 400,
         disable_help_flag = true,
         display_order = 310
@@ -777,7 +777,7 @@ pub enum Action {
 
     #[clap(
         author = "Yamato Security (https://github.com/Yamato-Security/hayabusa - @SecurityYamato)",
-        help_template = "\nHayabusa v2.12.0 - SECCON Christmas Release\n{author-with-newline}\n{usage-heading}\n  hayabusa.exe pivot-keywords-list <INPUT> [OPTIONS]\n\n{all-args}",
+        help_template = "\nHayabusa v2.13.0 - Dev Build\n{author-with-newline}\n{usage-heading}\n  hayabusa.exe pivot-keywords-list <INPUT> [OPTIONS]\n\n{all-args}",
         term_width = 400,
         disable_help_flag = true,
         display_order = 420
@@ -787,7 +787,7 @@ pub enum Action {
 
     #[clap(
         author = "Yamato Security (https://github.com/Yamato-Security/hayabusa - @SecurityYamato)",
-        help_template = "\nHayabusa v2.12.0 - SECCON Christmas Release\n{author-with-newline}\n{usage-heading}\n  hayabusa.exe search <INPUT> <--keywords \"<KEYWORDS>\" OR --regex \"<REGEX>\"> [OPTIONS]\n\n{all-args}",
+        help_template = "\nHayabusa v2.13.0 - Dev Build\n{author-with-newline}\n{usage-heading}\n  hayabusa.exe search <INPUT> <--keywords \"<KEYWORDS>\" OR --regex \"<REGEX>\"> [OPTIONS]\n\n{all-args}",
         term_width = 400,
         disable_help_flag = true,
         display_order = 450
@@ -797,7 +797,7 @@ pub enum Action {
 
     #[clap(
         author = "Yamato Security (https://github.com/Yamato-Security/hayabusa - @SecurityYamato)",
-        help_template = "\nHayabusa v2.12.0 - SECCON Christmas Release\n{author-with-newline}\n{usage-heading}\n  {usage}\n\n{all-args}",
+        help_template = "\nHayabusa v2.13.0 - Dev Build\n{author-with-newline}\n{usage-heading}\n  {usage}\n\n{all-args}",
         term_width = 400,
         disable_help_flag = true,
         display_order = 470
@@ -807,7 +807,7 @@ pub enum Action {
 
     #[clap(
         author = "Yamato Security (https://github.com/Yamato-Security/hayabusa - @SecurityYamato)",
-        help_template = "\nHayabusa v2.12.0 - SECCON Christmas Release\n{author-with-newline}\n{usage-heading}\n  {usage}\n\n{all-args}",
+        help_template = "\nHayabusa v2.13.0 - Dev Build\n{author-with-newline}\n{usage-heading}\n  {usage}\n\n{all-args}",
         term_width = 400,
         disable_help_flag = true,
         display_order = 380
@@ -817,7 +817,7 @@ pub enum Action {
 
     #[clap(
         author = "Yamato Security (https://github.com/Yamato-Security/hayabusa - @SecurityYamato)",
-        help_template = "\nHayabusa v2.12.0 - SECCON Christmas Release\n{author-with-newline}\n{usage-heading}\n  {usage}\n\n{all-args}",
+        help_template = "\nHayabusa v2.13.0 - Dev Build\n{author-with-newline}\n{usage-heading}\n  {usage}\n\n{all-args}",
         term_width = 400,
         disable_help_flag = true,
         display_order = 451
@@ -835,7 +835,7 @@ pub enum Action {
 
     #[clap(
         author = "Yamato Security (https://github.com/Yamato-Security/hayabusa - @SecurityYamato)",
-        help_template = "\nHayabusa v2.12.0 - SECCON Christmas Release\n{author-with-newline}\n{usage-heading}\n  {usage}\n\n{all-args}",
+        help_template = "\nHayabusa v2.13.0 - Dev Build\n{author-with-newline}\n{usage-heading}\n  {usage}\n\n{all-args}",
         term_width = 400,
         disable_help_flag = true,
         display_order = 290
@@ -1656,7 +1656,7 @@ pub struct ComputerMetricsOption {
 #[derive(Parser, Clone, Debug)]
 #[clap(
     author = "Yamato Security (https://github.com/Yamato-Security/hayabusa - @SecurityYamato)",
-    help_template = "\nHayabusa v2.12.0 - SECCON Christmas Release\n{author-with-newline}\n{usage-heading}\n  hayabusa.exe <COMMAND> [OPTIONS]\n  hayabusa.exe help <COMMAND>\n\n{all-args}{options}",
+    help_template = "\nHayabusa v2.13.0 - Dev Build\n{author-with-newline}\n{usage-heading}\n  hayabusa.exe <COMMAND> [OPTIONS]\n  hayabusa.exe help <COMMAND>\n\n{all-args}{options}",
     term_width = 400,
     disable_help_flag = true
 )]

src/timeline/search.rs

@@ -18,12 +18,12 @@
 use downcast_rs::__std::process;
 use hashbrown::{HashMap, HashSet};
 use itertools::Itertools;
-use nested::Nested;
 use regex::Regex;
 use std::fs::File;
 use std::io::BufWriter;
 use std::path::PathBuf;
 use termcolor::{BufferWriter, Color, ColorChoice};
+use wildmatch::WildMatch;
 
 #[derive(Debug, Clone)]
 pub struct EventSearch {
@@ -98,7 +98,7 @@
     fn filter_record(
         &mut self,
         record: &EvtxRecordInfo,
-        filter_rule: &HashMap<String, Nested<String>>,
+        filter_rule: &HashMap<String, Vec<WildMatch>>,
         eventkey_alias: &EventKeyAliasConfig,
     ) -> bool {
         filter_rule.iter().all(|(k, v)| {
@@ -109,10 +109,9 @@
             )
             .unwrap_or_else(|| "n/a".into())
             .replace(['"', '\''], "");
-
             // aliasでマッチした場合はaliasに登録されていないフィールドを検索する必要がないためtrueを返す
             if v.iter()
-                .all(|search_target| utils::contains_str(&alias_target_val, search_target))
+                .all(|search_target| search_target.matches(&alias_target_val))
             {
                 return true;
             }
@@ -126,7 +125,7 @@
                 _ => CompactString::new("-"),
             };
             v.iter()
-                .all(|search_target| utils::contains_str(&allfieldinfo, search_target))
+                .all(|search_target| search_target.matches(&allfieldinfo))
         })
     }
 
@@ -238,7 +237,7 @@
 }
 
 /// filters からフィルタリング条件を作成する関数
-fn create_filter_rule(filters: &[String]) -> HashMap<String, Nested<String>> {
+fn create_filter_rule(filters: &[String]) -> HashMap<String, Vec<WildMatch>> {
     filters
         .iter()
         .fold(HashMap::new(), |mut acc, filter_condition| {
@@ -250,10 +249,10 @@
                 .unwrap_or(prefix_trim_condition);
             let condition = trimed_condition.split(':').map(|x| x.trim()).collect_vec();
             if condition.len() != 1 {
-                let acc_val = acc
-                    .entry(condition[0].to_string())
-                    .or_insert(Nested::<String>::new());
-                acc_val.push(condition[1..].join(":"));
+                let acc_val = acc.entry(condition[0].to_string()).or_insert(vec![]);
+                condition[1..]
+                    .iter()
+                    .for_each(|x| acc_val.push(WildMatch::new(x)));
             }
             acc
         })