feat: Support cidr rule

[fukusuket]

What Changed

• Fixed Support |cidr #955

Evidence

Environment

• OS: macOS montery version 13.1
• Hard: Macbook Air(M1, 2020) , Memory 8GB, Core 8

Test

test.yml is as follows.(no cidr match)

detection:
    selection:
        Channel: Security
        EventID: 4624
    condition: selection 

then SrcIP uniq count is as follows
./hayabuse json-timeline -d ./hayabusa-sample-evtx -r test.yml -o result.json
cat result.json | jq .Details.SrcIP | sort | uniq -c

 518 "-"
  10 "10.0.2.17"
  63 "10.23.123.11"
  99 "10.23.23.9"
   1 "10.23.42.18"
   5 "10.23.42.22"
   1 "10.23.42.30"
   6 "10.23.42.38"
  67 "127.0.0.1"
   3 "172.16.66.142"
   4 "172.16.66.19"
   2 "172.16.66.25"
   5 "172.16.66.37"
   1 "192.168.1.100"
   2 "192.168.1.2"
   1 "192.168.1.200"
   4 "192.168.1.219"
   1 "192.168.111.87"
   1 "192.168.20.11"
  38 "::1"
   4 "fe80::1cae:5aa4:9d8d:106a"
   6 "fe80::7191:d555:270f:4d0b"
   4 "fe80::79bf:8ee2:433c:2567"
   5 "fe80::e50e:b89e:4718:3aa"

test.yml is as follows.(with cidr match)

detection:
    selection:
        Channel: Security
        EventID: 4624
    filter:
        IpAddress|cidr: 10.0.0.0/8
    condition: selection and filter

then SrcIP uniq count is as follows
./hayabuse json-timeline -d ./hayabusa-sample-evtx -r test.yml -o result.json
cat result.json | jq .Details.SrcIP | sort | uniq -c

  10 "10.0.2.17"
  63 "10.23.123.11"
  99 "10.23.23.9"
   1 "10.23.42.18"
   5 "10.23.42.22"
   1 "10.23.42.30"
   6 "10.23.42.38"

I confirm that the number of SrcIP matches before and after the cidr filter

I would appreciate it if you could review🙏

[YamatoSecurity]

@fukusuket Thanks so much!
Looks good. Just one bug. When the IpAddress field does not exist, hayabusa crashes.
Test rule:

title: Test CIDR
id: 259a9cdf-c4dd-4fa2-b243-2269e5ab18a4
status: experimental
description: 
references:
author: hoge
date: 2023/01/19
tags:
logsource:
    product: windows
    service: security
detection:
    selection:
        IpAddress|cidr:
            - 10.0.0.0/8
            - 172.16.0.0/12
            - 192.168.0.0/16
            - 224.0.0.0/4
            - 127.0.0.0/8
    condition: selection
level: medium

When I run ./target/release/hayabusa csv-timeline -d ../hayabusa-sample-evtx -r ../hayabusa-rules/hayabusa/test.yml I get the following error:

thread 'hayabusa-thread' panicked at 'called `Option::unwrap()` on a `None` value', src/detections/rule/matchers.rs:507:43
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: JoinError::Panic(Id(5017), ...)', src/detections/detection.rs:167:41

If I change IpAddress|cidr to IpAddress, IpAddress|contains, etc.. it does not crash.
Could you check this?

[codecov]

Codecov Report

Patch coverage: 93.67% and project coverage change: +0.15 🎉

Comparison is base (c9a165b) 75.08% compared to head (f024bb8) 75.24%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #961      +/-   ##
==========================================
+ Coverage   75.08%   75.24%   +0.15%     
==========================================
  Files          24       24              
  Lines       16624    16719      +95     
==========================================
+ Hits        12482    12580      +98     
+ Misses       4142     4139       -3     

Impacted Files	Coverage Δ
src/detections/rule/matchers.rs	96.43% <93.67%> (+0.26%)	⬆️

... and 1 file with indirect coverage changes

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

[hitenkoku]

@fukusuket Thank you for the pull request.
Please check the following points that have been brought to our attention.

[hitenkoku]

Please check the comments added about the test cases.

[YamatoSecurity]

LGTM! Thank you!

[fukusuket]

Thank you so much for quick review and test :)
@hitenkoku I've fixed the parts you reviewed. I would appreciate it if you could check🙇

[hitenkoku]

Thanks.LGTM.