Added channel names shorter in the metrics/csv-timeline/json-timeline command

[hitenkoku]

What Changed

• Added channel names shorter in the metrics/csv-timeline/json-timeline command.

Evidence

main branch result

Analyzing event files: 584
Total file size: 137.1 MB

584 / 584 [==========================================================================] 100.00 %

Total Event Records: 47471

╭───────┬─────────┬────────────────────────────────────────────────────────────┬───────┬────────────────────────────────────────────────────────────────────────────────────────╮
│ Count ┆ Percent ┆ Channel                                                    ┆ ID    ┆ Event                                                                                  │
╞═══════╪═════════╪════════════════════════════════════════════════════════════╪═══════╪════════════════════════════════════════════════════════════════════════════════════════╡
...
│ 7     ┆ 0.0%    ┆ Microsoft-Windows-Application-Experience/Program-Telemetry ┆ 500   ┆ Unknown                                                                                │
├╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
...
Elapsed time: 00:00:02.682

>./923.exe metrics -d ..\hayabusa-sample-evtx\
...
Analyzing event files: 584
Total file size: 137.1 MB

584 / 584 [==========================================================================] 100.00 %

Total Event Records: 47471

╭───────┬─────────┬─────────────────────────────────────────┬───────┬─────────╮
│ Count ┆ Percent ┆ Channel                                 ┆ ID    ┆ Event   │
╞═══════╪═════════╪═════════════════════════════════════════╪═══════╪═════════╡
...
│ 7     ┆ 0.0%    ┆ MS-Win-App-Experience/Program-Telemetry ┆ 500   ┆ Unknown │
├╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌...
Elapsed time: 00:00:02.763

[codecov]

Codecov Report

Base: 74.82% // Head: 74.80% // Decreases project coverage by -0.03% ⚠️

Coverage data is based on head (bda8a0e) compared to base (ed6bd86).
Patch coverage: 66.66% of modified lines in pull request are covered.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #927      +/-   ##
==========================================
- Coverage   74.82%   74.80%   -0.03%     
==========================================
  Files          24       24              
  Lines       15935    15973      +38     
==========================================
+ Hits        11924    11948      +24     
- Misses       4011     4025      +14     

Impacted Files	Coverage Δ
src/timeline/metrics.rs	20.60% <10.52%> (-3.24%)	⬇️
src/timeline/timelines.rs	9.91% <41.17%> (-1.99%)	⬇️
src/main.rs	27.16% <50.00%> (-0.18%)	⬇️
src/detections/message.rs	91.98% <92.30%> (+0.28%)	⬆️
src/afterfact.rs	36.79% <100.00%> (+0.07%)	⬆️
src/detections/configs.rs	57.89% <100.00%> (+1.08%)	⬆️
src/detections/detection.rs	69.14% <100.00%> (+0.13%)	⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

[YamatoSecurity]

LGTM!
I like how it does not give an error before a user updates and adds the new config file.
When I ran the update-rules command, it did give an error saying it could not find the config file. Why is this?

./target/release/hayabusa update-rules
[ERROR] Cannot open file. [file:rules/config/channel_abbreviations_generic.txt]

The speed does decrease a little bit: 4:30 -> 4:20 but this is ok.

@fukusuket Please let us know if you know any ways to improve performance, etc...

[fukusuket]

I checked the json result before and after commit with the following command:

fukusuke@fukusukenoAir hayabusa-2.2.0-all-platforms % cat main.json | jq '.Channel' | sort | uniq -c | sort -n
   4 "App"
   5 "WinRM"
   6 "RDS-RCM"
  13 "PwShClassic"
  62 "RDS-LSM"
  64 "Microsoft-Windows-Storage-Storport/Operational"
 108 "-"
 120 "BitsCli"
 166 "TaskSch"
 251 "Sys"
 267 "PwSh"
 293 "Firewall"
 776 "WMI"
7103 "Sec"
1617909 "Sysmon"

fukusuke@fukusukenoAir hayabusa-2.2.0-all-platforms % cat new.json | jq '.Channel' | sort | uniq -c | sort -n
   4 "App"
   5 "WinRM"
   6 "RDS-RCM"
  13 "PwShClassic"
  62 "RDS-LSM"
  64 "MS-Win-Storage-Storport/Op"
 108 "-"
 120 "BitsCli"
 166 "TaskSch"
 251 "Sys"
 267 "PwSh"
 293 "Firewall"
 776 "WMI"
7103 "Sec"
1617909 "Sysmon"

LGTM!! 🚀

[fukusuket]

I'll look for processes that can improve perf then create another PR :) 💪