chg: output agg condition's JSON result as Details's child element

[fukusuket]

What Changed

• Related Improving count rule's output #1342
  • Output the JSON result of the aggregation rule under Details
    • Improving count rule's output #1342 (comment)

#1342's improvements point other than the above will be addressed as separate PRs.
I would appreciate it if you could check it out when you have time🙏

Evidence1

I checked by following the rule.

title: TEST_TITLE
details: ''  #Cannot be used because this is a count rule
description: TEST

id: 5e00cf44-84bb-4083-8ae6-213005b2307a
level: informational
status: test
detection:
    selection:
        Channel: Security
        EventID: 4625
    filter:
       IpAddress: "-"
    condition: selection and not filter | count() by IpAddress,LogonType >= 2
    timeframe: 5d

JSON

% ./hayabusa json-timeline -d ../hayabusa-sample-evtx -r test/test2.yml -w -q

{
    "Timestamp": "2016-09-20 01:50:06.477 +09:00",
    "RuleTitle": "TEST_TITLE",
    "Level": "info",
    "Computer": "-",
    "Channel": "-",
    "EventID": "-",
    "RecordID": "-",
    "Details": {
        "Count": 3561,
        "IpAddress": "192.168.198.149",
        "LogonType": 3
    },
    "ExtraFieldInfo": "-"
}

JSOL

% ./hayabusa json-timeline -d ../hayabusa-sample-evtx -r test/test2.yml -w -q -L -o new.jsonl

{ "Timestamp": "2016-09-20 01:50:06.477 +09:00","RuleTitle": "TEST_TITLE","Level": "info","Computer": "-","Channel": "-","EventID": "-","RecordID": "-","Details": {"Count": 3561,"IpAddress": "192.168.198.149","LogonType": 3},"ExtraFieldInfo": "-" }

Evidence2

% ./hayabusa json-timeline -d ../hayabusa-sample-evtx -q -w -D -n -u -p super-verbose -r rules/sigma/builtin/unsupported/win_security_susp_failed_logons_single_source_kerberos.yml

{
    "Timestamp": "2021-12-02 23:48:16.956 +09:00",
    "RuleTitle": "Valid Users Failing to Authenticate From Single Source Using Kerberos",
    "Level": "med",
    "Computer": "-",
    "Channel": "-",
    "EventID": "-",
    "RuleAuthor": "Mauricio Velazco, frack113",
    "RuleModifiedDate": "2023/03/13",
    "Status": "unsupported",
    "RecordID": "-",
    "Details": {
        "Count": 22,
        "TargetUserName": "svc-ata/svc_nxlog/svc_adfs01/Svc-SQL-DB01/admin-hacker/proabcdef/vuln_scan/HealthMailboxebdc745/adminupn42/admin-te/domadm/HealthMailboxf7e4358/HealthMailboxdabf0a3/HealthMailboxa935ecd/HealthMailbox2cfa5bd/HealthMailboxeb3dc3f/HealthMailboxc9291f7/HealthMailbox9a2d0da/HealthMailbox0ab31b3/HealthMailboxf49e2c8/HealthMailboxe8b0d98/HealthMailboxa99e1bd",
        "IpAddress": "::ffff:10.23.123.11"
    },
    "ExtraFieldInfo": "-",
    "MitreTactics": [
        "InitAccess,03. Initial Access", "PrivEsc,06. Privilege Escalation"
    ],
    "MitreTags": [
        "T1110.003"
    ],
    "Provider": "-",
    "RuleCreationDate": "2021/06/01",
    "RuleFile": "win_security_susp_failed_logons_single_source_kerberos.yml",
    "EvtxFile": "-"
}

[fukusuket]

hayabusa-sample-evtx

CSV

I confirmed that the result of the csv-timeline has no differences.

% ./hayabusa-main csv-timeline -d ../hayabusa-sample-evtx -o old.csv -q -w -D -n -u -C -p super-verbose
% ./hayabusa csv-timeline -d ../hayabusa-sample-evtx -o new.csv -q -w -D -n -u -C -p super-verbose
% diff new.csv old.csv
%

JSONL

I confirmed that the result of the json-timeline -L has no differences except Count rule.

% ./hayabusa-main json-timeline -d ../hayabusa-sample-evtx -o old.jsonl -L -q -w -D -n -u -C -p super-verbose
% ./hayabusa json-timeline -d ../hayabusa-sample-evtx -o new.jsonl -L -q -w -D -n -u -C -p super-verbose
% diff new.jsonl old.jsonl | sort | grep -v Count | uniq
---
1004c1004
1006c1006
1010c1010
...

[hitenkoku]

LGTM

[YamatoSecurity]

@fukusuket LGTM! Thanks so much!