Add --disable-abbreviations option

[fukusuket]

#1474 (comment)

3. I would like to do channel and provider abbreviation by default but add a -a --disable-abbreviations Disable abbreviations option under General Options to preserve the names as-is. I'd like to add this opiton to eid-metrics and csv-timeline and json-timeline as well as sometimes it is necessary to look up the original Channel and Provider names. We could create a separate issue for this though.

[fukusuket]

memo

command

The following command takes effect when this option is set.

• csv-timeline
• json-timeline
• search
• eid-metrics
• log-metrics

The following command does not require this option.

• computer-metrics
• level-tuning
• list-contributors
• list-profiles
• logon-summary
• pivot-keywords-list
• set-default-profile
• update-rules
• help

Among the commands that do not require this option, the following command uses the General Option

• computer-metrics
• logon-summary
• pivot-keywords-list

impl

• https://github.com/Yamato-Security/hayabusa/blob/main/src/detections/configs.rs#L103
• https://github.com/Yamato-Security/hayabusa/blob/main/src/detections/configs.rs#L106

• hayabusa/src/timeline/timelines.rs

  Lines 630 to 649 in c7f1ecf

  	fn replace_channel_abbr(stored_static: &StoredStatic, fmted_channel: &CompactString) -> String {
  	stored_static.disp_abbr_generic.replace_all(
  	stored_static
  	.ch_config
  	.get(&fmted_channel.to_ascii_lowercase())
  	.unwrap_or(fmted_channel)
  	.as_str(),
  	&stored_static.disp_abbr_general_values,
  	)
  	}
  	fn replace_provider_abbr(stored_static: &StoredStatic, fmted_provider: &CompactString) -> String {
  	stored_static.disp_abbr_generic.replace_all(
  	stored_static
  	.provider_abbr_config
  	.get(fmted_provider)
  	.unwrap_or(fmted_provider),
  	&stored_static.disp_abbr_general_values,
  	)
  	}

• hayabusa/src/detections/detection.rs

  Lines 524 to 544 in c7f1ecf

  	Provider(_) => {
  	let provider_value = CompactString::from(
  	record_info.record["Event"]["System"]["Provider_attributes"]["Name"]
  	.to_string()
  	.replace('\"', ""),
  	);
  	profile_converter.insert(
  	key.as_str(),
  	Provider(
  	stored_static
  	.disp_abbr_generic
  	.replace_all(
  	stored_static
  	.provider_abbr_config
  	.get(&provider_value)
  	.unwrap_or(&provider_value),
  	&stored_static.disp_abbr_general_values,
  	)
  	.into(),
  	),
  	);