fix: output Events with hits when agg/correlation rule

[fukusuket]

What Changed

• Closed Sigma correlation rule count does not show up in 'Events with hits' #1373
• Closed [bug] aggregation condition rule count does not show up in Events with hits #1375

This PR only fix the following problem 2.

2. Events with hits / Total events: 0 / 26,341 (Data reduction: 26,341 events (100.00%)) should say Events with hits / Total events: 2 / 26,341 (Data reduction: 26,339 events (99.99%))

I would appreciate it if the following problem 1 could be fixed in a separate PR, as it would be better to fix it with #1342.

1. Top 5 computers with most unique detections shows only n/a but should include the correlation rule results

Evidence

% ./hayabusa csv-timeline -d ../hayabusa-sample-evtx -r rules/hayabusa/builtin/Security/LogonLogoff/Logon/Sec_4625_Med_LogonFail_WrongPW_PW-Guessing_Cnt.yml -w -q
Start time: 2024/06/25 23:57

Total event log files: 585
Total file size: 137.2 MB

Loading detection rules. Please wait.


Stable rules: 1 (100.00%)

Hayabusa rules: 1
Total detection rules: 1

Creating the channel filter. Please wait.

Evtx files loaded after channel filter: 241
Detection rules enabled after channel filter: 1

Output profile: standard

Scanning in progress. Please wait.

[00:00:00] 241 / 241   [========================================] 100%

Scanning finished. Please wait while the results are being saved.

Timestamp · RuleTitle · Level · Computer · Channel · EventID · RecordID · Details · ExtraFieldInfo
2016-09-20 01:50:06.513 +09:00 · PW Guessing · med · - · - · - · - · Count: 3558 ¦ IpAddress: 192.168.198.149 · -


Rule Authors:

╭─────────────────╮
│ Zach Mathis (1) │
╰─────────────────╯

Results Summary:

Events with hits / Total events: 1 / 26,341 (Data reduction: 26,340 events (100.00%))

Total | Unique detections: 1 | 1
Total | Unique critical detections: 0 (0.00%) | 0 (0.00%)
Total | Unique high detections: 0 (0.00%) | 0 (0.00%)
Total | Unique medium detections: 1 (100.00%) | 1 (0.00%)
Total | Unique low detections: 0 (0.00%) | 0 (100.00%)
Total | Unique informational detections: 0 (0.00%) | 0 (0.00%)

Dates with most total detections:
critical: n/a, high: n/a, medium: 2016-09-20 (1), low: n/a, informational: n/a

Top 5 computers with most unique detections:
critical: n/a
high: n/a
medium: n/a
low: n/a
informational: n/a

I would appreciate it if you could check it out when you have time🙏

[fukusuket]

hayabusa-sample-evtx

I confirmed that there is no difference compared to main.

% ./hayabusa-main csv-timeline -d ../hayabusa-sample-evtx -w -q -D -n -u -C -o old.csv
% ./hayabusa-new csv-timeline -d ../hayabusa-sample-evtx -w -q -D -n -u -C -o new.csv
% diff new.csv old.csv
%

[fukusuket]

Sorry, I will check the correlation count and the aggregation count as they are different...

[fukusuket]

This one is closed because it looks like a different implementation would be better than this pull request implementation.