render: do not display lib rules (or make display optional)

[mike-hunhoff]

We no longer filter library rules when rendering vverbose. This can be problematic because some library rules can have many matches, polluting the output and in some cases making it unreadable e.g.

...
contain loop (530 matches)
namespace
author     moritz.raabe@mandiant.com
scope      function
...

and

...
contain loop (7054 matches)
namespace
author     moritz.raabe@mandiant.com
scope      function
...

This is also problematic for capa explorer when trying to display, e.g. 7,054 rule matches, in a GUI.

Proposed alternatives:

• Do not display lib rule matches (as before)
• Make it optional to display lib rule matches (off by default)

The following code supports rendering all rule matches, including lib rules.

capa/capa/render/vverbose.py

Lines 225 to 233 in 5960f51

	for (_, _, rule) in sorted(
	map(lambda rule: (rule.meta.namespace or "", rule.meta.name, rule), doc.rules.values())
	):
	# default scope hides things like lib rules, malware-category rules, etc.
	# but in vverbose mode, we really want to show everything.
	#
	# still ignore subscope rules because they're stitched into the final document.
	if rule.meta.is_subscope_rule:
	continue

[mr-tz]

This changed in 6555257. I think lib rules add little value by themselves and we should not display them even in vverbose mode.

[williballenthin]

agree with moritz, lets not display them

[mr-tz]

capa explorer does not display lib rules. If there are regular rules with too many hits, we could think about not displaying them all at once.