diff --git a/src/detections/configs.rs b/src/detections/configs.rs index 1b0603116..3b1956370 100644 --- a/src/detections/configs.rs +++ b/src/detections/configs.rs @@ -918,7 +918,7 @@ impl Action { #[derive(Args, Clone, Debug)] pub struct DetectCommonOption { /// Scan JSON formatted logs instead of .evtx (.json or .jsonl) - #[arg(help_heading = Some("Input"), short = 'J', long = "JSON-input", conflicts_with = "live_analysis", display_order = 390)] + #[arg(help_heading = Some("General Options"), short = 'J', long = "JSON-input", conflicts_with = "live_analysis", display_order = 390)] pub json_input: bool, /// Specify additional evtx file extensions (ex: evtx_data) @@ -1535,7 +1535,7 @@ pub struct OutputOption { /// Duplicate field data will be replaced with "DUP" #[arg( - help_heading = Some("General Options"), + help_heading = Some("Output"), short = 'R', long = "remove-duplicate-data", conflicts_with = "low_memory_mode", @@ -1544,7 +1544,7 @@ pub struct OutputOption { pub remove_duplicate_data: bool, /// Remove duplicate detections (default: disabled) - #[arg(help_heading = Some("General Options"), short = 'X', long = "remove-duplicate-detections", conflicts_with = "low_memory_mode", display_order = 441)] + #[arg(help_heading = Some("Output"), short = 'X', long = "remove-duplicate-detections", conflicts_with = "low_memory_mode", display_order = 441)] pub remove_duplicate_detections: bool, /// Do not ask questions. Scan for all events and alerts. @@ -1587,7 +1587,7 @@ pub struct InputOption { pub live_analysis: bool, /// Carve evtx records from slack space (default: disabled) - #[arg(help_heading = Some("Input"), short = 'x', long = "recover-records", conflicts_with = "json_input", display_order = 440)] + #[arg(help_heading = Some("General Options"), short = 'x', long = "recover-records", conflicts_with = "json_input", display_order = 440)] pub recover_records: bool, /// Scan recent events based on an offset (ex: 1y, 3M, 30d, 24h, 30m) @@ -1657,7 +1657,7 @@ pub struct ComputerMetricsOption { pub common_options: CommonOptions, /// Scan JSON formatted logs instead of .evtx (.json or .jsonl) - #[arg(help_heading = Some("Input"), short = 'J', long = "JSON-input", conflicts_with = "live_analysis", display_order = 390)] + #[arg(help_heading = Some("General Options"), short = 'J', long = "JSON-input", conflicts_with = "live_analysis", display_order = 390)] pub json_input: bool, /// Specify additional evtx file extensions (ex: evtx_data)