Right now when running html-server we get a generic Cannot open: error message when the rule file is not found, but it would be better to have more explanation: Could not open the sigma rule because the -r option was not used to specify the directory of sigma rules.
Ex:
./takajo html-server -t ../hayabusa/timeline.jsonl
┏━━━━┳━━━┳┓┏━┳━━━┓ ┏┳━━━┓
┃┏┓┏┓┃┏━┓┃┃┃┏┫┏━┓┃ ┃┃┏━┓┃
┗┛┃┃┗┫┃ ┃┃┗┛┛┃┃ ┃┃ ┃┃┃ ┃┃
┃┃ ┃┗━┛┃┏┓┓┃┗━┛┣┓┃┃┃ ┃┃
┃┃ ┃┏━┓┃┃┃┗┫┏━┓┃┗┛┃┗━┛┃
┗┛ ┗┛ ┗┻┛┗━┻┛ ┗┻━━┻━━━┛
by Yamato Security
html-report.sqlite already exists. It looks like you have already processed the JSONL file. Do you want to use this file (Y/n):
n
Started the html-report command
This command will create HTML summary reports for rules and computers with detections
Counting total lines. Please wait.
File: ../hayabusa/challenge1-verbose.jsonl (423.68 MB)
Total lines: 322,973
Scanning the Hayabusa timeline. Please wait.
100%|█████████████████████████| 322973/322973 [17.2s< 0.0s, 34.82k/sec]
Database file created.
You can access the HTML summary reports at http://localhost:8823
cannot open:
Right now when running
html-serverwe get a genericCannot open:error message when the rule file is not found, but it would be better to have more explanation:Could not open the sigma rule because the -r option was not used to specify the directory of sigma rules.Ex: