Skip to content

[bug] Counting expand rules as valid rules even when config/expand/xxx.txt does not exists #1606

@fukusuket

Description

@fukusuket

Describe the bug
Counting expand rules as valid rules even when config/expand/xxx.txt does not exists.

Step to Reproduce

status: test
description: test
author: TEST
date: 2024-12-07
logsource:
    product: windows
    service: security
    definition: TEST
detection:
    selection:
        Channel: Security
        EventID: 4624
        LogonType|expand: '%LogonType%'
    condition: selection
level: informational

./hayabusa csv-timeline -d ../hayabusa-sample-evtx -r test.yml -w -q

Expected behavior

Test rules: 1 (100.00%)

Expand rules: 1 (100.00%)
Enabled expand rules: 0 (0.00%)

Total detection rules: 0

Creating the channel filter. Please wait.

Evtx files loaded after channel filter: 248
Detection rules enabled after channel filter: 0

Actual behavior

Test rules: 1 (100.00%)

Expand rules: 1 (100.00%)
Other rules: 1
Total detection rules: 1

Creating the channel filter. Please wait.

Evtx files loaded after channel filter: 248
Detection rules enabled after channel filter: 1

Environment

  • OS: macOS Sequoia 15.3.1
  • hayabusa version 3.1.0

Additional context
N/A

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions