fix: sort count rule's result filed value

.github/workflows/timeline-diff.yml

@@ -29,8 +29,8 @@ jobs:
       - name: Run on dev branch
         run: |
           cargo run --release -- update-rules -q
-          cargo run --release -- csv-timeline -d ./hayabusa-sample-evtx -o dev.csv -p super-verbose -q -w -D -n -u
-          cargo run --release -- json-timeline -d ./hayabusa-sample-evtx -o dev.jsonl -L -p super-verbose -q -w -D -n -u
+          cargo run --release -- csv-timeline -d ./hayabusa-sample-evtx -o dev.csv -p super-verbose -q -w -D -n -u -s
+          cargo run --release -- json-timeline -d ./hayabusa-sample-evtx -o dev.jsonl -L -p super-verbose -q -w -D -n -u -s
 
       - name: Run on dev branch(encoded_rules)
         run: |
@@ -41,8 +41,8 @@ jobs:
           curl -O https://raw.githubusercontent.com/Yamato-Security/hayabusa-encoded-rules/refs/heads/main/encoded_rules.yml
           curl -O https://raw.githubusercontent.com/Yamato-Security/hayabusa-encoded-rules/refs/heads/main/rules_config_files.txt
           ./hayabusa update-rules -q
-          ./hayabusa csv-timeline -d ./hayabusa-sample-evtx -o dev-encoded.csv -p super-verbose -q -w -D -n -u
-          ./hayabusa json-timeline -d ./hayabusa-sample-evtx -o dev-encoded.jsonl -L -p super-verbose -q -w -D -n -u
+          ./hayabusa csv-timeline -d ./hayabusa-sample-evtx -o dev-encoded.csv -p super-verbose -q -w -D -n -u -s
+          ./hayabusa json-timeline -d ./hayabusa-sample-evtx -o dev-encoded.jsonl -L -p super-verbose -q -w -D -n -u -s
           mv ../config ./
           mv ../rules ./
           mv encoded_rules.yml ../

CHANGELOG-Japanese.md

@@ -13,6 +13,7 @@
 **バグ修正:**
 
 - `csv-timeline`と`json-timeline`コマンドで、結果をターミナルに出力すると、プログレスバーの後にいくつかの結果が表示されていた。 (#1459) (@fukusuket)
+- 集計ルールのアラートの詳細フィールド値の結果がソートされていないため、`csv-timeline`と`json-timeline`は、毎回完全に正確な結果を出力しなかった。 (#1466) (@fukusuket)
 
 ## 2.18.0 [2024/10/23] - SecTor Release
 

CHANGELOG.md

@@ -13,6 +13,7 @@
 **Bug Fixes:**
 
 - Some results would be displayed after the progress bar when outputting results to the terminal with `csv-timeline` and `json-timeline`. (#1459) (@fukusuket)
+- The detailed field value results in aggregation rule alerts were not sorted so `csv-timeline` and `json-timeline` would not output completely exact results each time. (#1466) (@fukusuket)
 
 ## 2.18.0 [2024/10/23] - SecTor Release
 

src/detections/detection.rs

@@ -1067,12 +1067,14 @@ impl Detection {
         // この関数が呼び出されている段階で既にaggregation conditionは存在する前提なのでagg_conditionの配列の長さは2となる
         let agg_condition = rule.get_agg_condition().unwrap();
         write!(ret, "Count:{}", agg_result.data).ok();
+        let mut sorted_filed_values = agg_result.field_values.clone();
+        sorted_filed_values.sort();
         if agg_condition._field_name.is_some() {
             write!(
                 ret,
                 " ¦ {}:{}",
                 agg_condition._field_name.as_ref().unwrap(),
-                agg_result.field_values.join("/")
+                sorted_filed_values.join("/")
             )
             .ok();
         }