Skipped loading detection rules when running search, logon-summary, eid-metrics, and computer-metrics

CHANGELOG-Japanese.md

@@ -13,6 +13,7 @@
 - `json-timeline`コマンドの標準出力でJSONフォーマットを出力するように修正した。 (#1197) (@hitenkoku)
 - JSON入力でデータが配列内にある場合に解析できるようにした。 (#1248) (@hitenkoku)
 - 古いターミナルでも正しく表示されるように、また読みやすくするために、`‖`区切り文字を`·`区切り文字に変更した。(#1258) (@YamatoSecurity)
+-  ルールをロードする必要のないコマンドを実行した場合、検出ルールのロードをスキップするようにした。 (#1263) (@hitenkoku)
 
 **バグ修正:**
 

CHANGELOG.md

@@ -13,6 +13,7 @@
 - The `json-timeline` command now outputs in JSON format when outputting to the terminal. (#1197) (@hitenkoku)
 - Added support for parsing JSON input when the data is inside an array. (#1248) (@hitenkoku)
 - Changed the `‖` separator into a `·` separator to make it easier to read and render properly on older terminals. (#1258) (@YamatoSecurity)
+- Skiped loading detection rules when running to command which is no need to load rule. (#1263) (@hitenkoku)
 
 **Bug Fixes:**
 

README.md

@@ -774,7 +774,7 @@ Filtering:
 Output:
   -J, --JSON-output    Save the search results in JSON format (ex: -J -o results.json)
   -L, --JSONL-output   Save the search results in JSONL format (ex: -L -o results.jsonl)
-  -M, --multiline      Output event field information in multiple rows
+  -M, --multiline      Output event field information in multiple rows for CSV output
   -o, --output <FILE>  Save the search results in CSV format (ex: search.csv)
 
 General Options:

src/detections/configs.rs

@@ -951,6 +951,7 @@ pub struct DefaultProfileOption {
 }
 
 #[derive(Args, Clone, Debug)]
+#[clap(group(ArgGroup::new("search_input_filtering").args(["keywords", "regex"]).required(true)))]
 pub struct SearchOption {
     #[clap(flatten)]
     pub common_options: CommonOptions,
@@ -1055,7 +1056,7 @@ pub struct SearchOption {
     #[arg(help_heading = Some("Display Settings"), short = 'v', long, display_order = 480)]
     pub verbose: bool,
 
-    /// Output event field information in multiple rows
+    /// Output event field information in multiple rows for CSV output
     #[arg(help_heading = Some("Output"), short = 'M', long="multiline", display_order = 390)]
     pub multiline: bool,
 
@@ -1064,11 +1065,11 @@ pub struct SearchOption {
     pub clobber: bool,
 
     /// Save the search results in JSON format (ex: -J -o results.json)
-    #[arg(help_heading = Some("Output"), short = 'J', long = "JSON-output", conflicts_with = "jsonl_output", requires = "output", display_order = 100)]
+    #[arg(help_heading = Some("Output"), short = 'J', long = "JSON-output", conflicts_with_all = ["jsonl_output", "multiline"], requires = "output", display_order = 100)]
     pub json_output: bool,
 
     /// Save the search results in JSONL format (ex: -L -o results.jsonl)
-    #[arg(help_heading = Some("Output"), short = 'L', long = "JSONL-output", conflicts_with = "jsonl_output", requires = "output", display_order = 100)]
+    #[arg(help_heading = Some("Output"), short = 'L', long = "JSONL-output", conflicts_with_all = ["jsonl_output", "multiline"], requires = "output", display_order = 100)]
     pub jsonl_output: bool,
 
     /// Output timestamp in European time format (ex: 22-02-2022 22:00:00.123 +02:00)

src/main.rs

@@ -1282,9 +1282,6 @@
         } else {
             stored_static.include_status.insert("*".into());
         }
-        println!();
-        println!("Loading detection rules. Please wait.");
-        println!();
 
         if stored_static.html_report_flag {
             let mut output_data = Nested::<String>::new();
@@ -1317,28 +1314,53 @@
             .min_level
             .to_uppercase();
 
-        let rule_files = detection::Detection::parse_rule_files(
-            &level,
-            &target_level,
-            &stored_static.output_option.as_ref().unwrap().rules,
-            &filter::exclude_ids(stored_static),
-            stored_static,
-        );
-        CHECKPOINT
-            .lock()
-            .as_mut()
-            .unwrap()
-            .rap_check_point("Rule Parse Processing Time");
-        let unused_rules_option = stored_static.logon_summary_flag
+        println!();
+        if !(stored_static.logon_summary_flag
             || stored_static.search_flag
-            || stored_static.computer_metrics_flag
-            || stored_static.metrics_flag;
-        if !unused_rules_option && rule_files.is_empty() {
-            AlertMessage::alert(
-                "No rules were loaded. Please download the latest rules with the update-rules command.\r\n",
-            )
-            .ok();
-            return;
+            || stored_static.metrics_flag
+            || stored_static.computer_metrics_flag)
+        {
+            println!("Loading detection rules. Please wait.");
+        } else if stored_static.logon_summary_flag {
+            println!("Currently analyzing Logon Summary. Please wait.");
+        } else if stored_static.search_flag {
+            println!("Currently searching. Please wait.");
+        } else if stored_static.metrics_flag {
+            println!("Currently analyzing Event ID Metrics. Please wait.");
+        } else if stored_static.computer_metrics_flag {
+            println!("Currently analyzing Compute Metrics. Please wait.");
+        }
+        println!();
+
+        let mut rule_files = vec![];
+        if !(stored_static.logon_summary_flag
+            || stored_static.search_flag
+            || stored_static.metrics_flag
+            || stored_static.computer_metrics_flag)
+        {
+            rule_files = detection::Detection::parse_rule_files(
+                &level,
+                &target_level,
+                &stored_static.output_option.as_ref().unwrap().rules,
+                &filter::exclude_ids(stored_static),
+                stored_static,
+            );
+            CHECKPOINT
+                .lock()
+                .as_mut()
+                .unwrap()
+                .rap_check_point("Rule Parse Processing Time");
+            let unused_rules_option = stored_static.logon_summary_flag
+                || stored_static.search_flag
+                || stored_static.computer_metrics_flag
+                || stored_static.metrics_flag;
+            if !unused_rules_option && rule_files.is_empty() {
+                AlertMessage::alert(
+                        "No rules were loaded. Please download the latest rules with the update-rules command.\r\n",
+                    )
+                    .ok();
+                return;
+            }
         }
 
         let template =