Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def testGetUnformattedAttributes(self):
"""Tests the GetUnformattedAttributes function."""
manager.FormattersManager.RegisterFormatter(test_lib.TestEventFormatter)
_, event_data = containers_test_lib.CreateEventFromValues(
self._TEST_EVENTS[0])
unformatted_attributes = manager.FormattersManager.GetUnformattedAttributes(
event_data)
self.assertEqual(unformatted_attributes, ['random'])
manager.FormattersManager.DeregisterFormatter(test_lib.TestEventFormatter)
'a_binary_field: binary; my_number: 123; some_additional_foo: True']
event, event_data = containers_test_lib.CreateEventFromValues(
self._TEST_EVENTS[0])
output_values = self._formatter._GetOutputValues(event, event_data, None)
self.assertEqual(len(output_values), 17)
self.assertEqual(output_values, expected_output_values)
event.timestamp = -9223372036854775808
output_values = self._formatter._GetOutputValues(event, event_data, None)
self.assertEqual(len(output_values), 17)
expected_output_values[0] = '00/00/0000'
expected_output_values[1] = '--:--:--'
self.assertEqual(output_values, expected_output_values)
formatters_manager.FormattersManager.DeregisterFormatter(
L2TTestEventFormatter)
'Username: {username}',
'Full name: {fullname}',
'Comments: {comments}',
'RID: {account_rid}',
'Login count: {login_count}']
FORMAT_STRING_SHORT_PIECES = [
'{username}',
'RID: {account_rid}',
'Login count: {login_count}']
SOURCE_LONG = 'Registry Key: User Account Information'
SOURCE_SHORT = 'REG'
manager.FormattersManager.RegisterFormatter(
SAMUsersWindowsRegistryEventFormatter)
from plaso.formatters import manager
class MactimeFormatter(interface.EventFormatter):
"""Formatter for a mactime event."""
DATA_TYPE = 'fs:mactime:line'
# The format string.
FORMAT_STRING = '{filename}'
SOURCE_LONG = 'Mactime Bodyfile'
SOURCE_SHORT = 'FILE'
manager.FormattersManager.RegisterFormatter(MactimeFormatter)
FORMAT_STRING_PIECES = [
'Computer: {computer_name}',
'Agent: {agent}',
'Status: {status}',
'Process name: {process_name}',
'Log: {action}']
FORMAT_STRING_SHORT_PIECES = [
'Process name: {process_name}',
'Status: {status}']
SOURCE_LONG = 'Mac AppFirewall Log'
SOURCE_SHORT = 'LOG'
manager.FormattersManager.RegisterFormatter(MacAppFirewallLogFormatter)
FORMAT_STRING_PIECES = [
'{url}',
'({cookie_name})',
'Flags:',
'[HTTP only] = {httponly}',
'[Persistent] = {persistent}']
FORMAT_STRING_SHORT_PIECES = [
'{host}',
'({cookie_name})']
SOURCE_LONG = 'Chrome Cookies'
SOURCE_SHORT = 'WEBHIST'
manager.FormattersManager.RegisterFormatter(ChromeCookieFormatter)
def GetEventFormatter(self, event):
"""Retrieves the event formatter for a specific event type.
Args:
event (EventObject): event.
Returns:
EventFormatter: event formatter or None.
"""
data_type = getattr(event, 'data_type', None)
if not data_type:
return None
return formatters_manager.FormattersManager.GetFormatterObject(
event.data_type)
class ApplicationUsageFormatter(interface.EventFormatter):
"""Formatter for a MacOS Application usage event."""
DATA_TYPE = 'macosx:application_usage'
FORMAT_STRING = (
'{application} v.{app_version} (bundle: {bundle_id}). '
'Launched: {count} time(s)')
FORMAT_STRING_SHORT = '{application} ({count} time(s))'
SOURCE_LONG = 'Application Usage'
SOURCE_SHORT = 'LOG'
manager.FormattersManager.RegisterFormatter(ApplicationUsageFormatter)
service_enums = human_readable_service_enums.SERVICE_ENUMS
# Check if we need to can make the value more human readable.
if service_value_name in service_enums.keys():
service_enum = service_enums[service_value_name]
# Find the human readable version of the name and fall back to the
# raw value if it's not found.
human_readable_value = service_enum.get(
regvalue[service_value_name],
regvalue[service_value_name])
regvalue[service_value_name] = human_readable_value
return super(WinRegistryServiceFormatter, self).GetMessages(
formatter_mediator, event_data)
manager.FormattersManager.RegisterFormatter(WinRegistryServiceFormatter)
class JavaIDXFormatter(interface.ConditionalEventFormatter):
"""Formatter for an Java WebStart Cache IDX download event."""
DATA_TYPE = 'java:download:idx'
FORMAT_STRING_PIECES = [
'IDX Version: {idx_version}',
'Host IP address: ({ip_address})',
'Download URL: {url}']
SOURCE_LONG = 'Java Cache IDX'
SOURCE_SHORT = 'JAVA_IDX'
manager.FormattersManager.RegisterFormatter(JavaIDXFormatter)