Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
from tests import test_lib as shared_test_lib
from tests.containers import test_lib as containers_test_lib
class PfilterFakeFormatter(formatters_interface.EventFormatter):
"""A formatter for this fake class."""
DATA_TYPE = 'Weirdo:Made up Source:Last Written'
FORMAT_STRING = '{text}'
FORMAT_STRING_SHORT = '{text_short}'
SOURCE_LONG = 'Fake Parsing Source'
SOURCE_SHORT = 'REG'
formatters_manager.FormattersManager.RegisterFormatter(PfilterFakeFormatter)
class TestBinaryOperator(filters.GenericBinaryOperator):
"""Binary operator for testing.
Attributes:
values (list[str]): event values passed to the _CompareValue function.
"""
def __init__(self, arguments=None, **kwargs):
"""Initializes a binary operator.
Args:
arguments (Optional[object]): operands of the filter.
"""
super(TestBinaryOperator, self).__init__(arguments=arguments, **kwargs)
WrongFormatter: if the event data cannot be formatted by the formatter.
"""
if self.DATA_TYPE != event_data.data_type:
raise errors.WrongFormatter('Unsupported data type: {0:s}.'.format(
event_data.data_type))
event_values = event_data.CopyToDict()
presented = event_values.get('presented', None)
if presented is not None:
event_values['presented'] = (
self._BOOLEAN_PRETTY_PRINT.get(presented, 'UNKNOWN'))
return self._ConditionalFormatMessages(event_values)
manager.FormattersManager.RegisterFormatter(MacNotificationCenterFormatter)
class DpkgFormatter(interface.ConditionalEventFormatter):
"""Formatter for a dpkg log file event."""
DATA_TYPE = 'dpkg:line'
FORMAT_STRING_SEPARATOR = ''
FORMAT_STRING_PIECES = [
'{body}']
SOURCE_LONG = 'dpkg log File'
SOURCE_SHORT = 'LOG'
manager.FormattersManager.RegisterFormatter(DpkgFormatter)
'{text}',
'[',
'URL: {url}',
'Event ID: {record_id}',
'Room: {room}',
']']
FORMAT_STRING_SHORT_PIECES = [
'<{event_type}>',
'{text}']
SOURCE_LONG = 'MacKeeper Cache'
SOURCE_SHORT = 'LOG'
manager.FormattersManager.RegisterFormatter(MacKeeperCacheFormatter)
DATA_TYPE = 'mac:document_versions:file'
FORMAT_STRING_PIECES = [
'Version of [{name}]',
'({path})',
'stored in {version_path}',
'by {user_sid}']
FORMAT_STRING_SHORT_PIECES = [
'Stored a document version of [{name}]']
SOURCE_LONG = 'Document Versions'
SOURCE_SHORT = 'HISTORY'
manager.FormattersManager.RegisterFormatter(MacDocumentVersionsFormatter)
from plaso.formatters import manager
class ChromeCacheEntryEventFormatter(interface.ConditionalEventFormatter):
"""Formatter for a Chrome Cache entry event."""
DATA_TYPE = 'chrome:cache:entry'
FORMAT_STRING_PIECES = [
'Original URL: {original_url}']
SOURCE_LONG = 'Chrome Cache'
SOURCE_SHORT = 'WEBHIST'
manager.FormattersManager.RegisterFormatter(ChromeCacheEntryEventFormatter)
DATA_TYPE = 'software_management:sccm:log'
FORMAT_STRING_SEPARATOR = ' '
FORMAT_STRING_PIECES = [
'{component}',
'{text}']
FORMAT_STRING_SHORT_PIECES = ['{text}']
SOURCE_LONG = 'SCCM Event'
SOURCE_SHORT = 'LOG'
manager.FormattersManager.RegisterFormatter(SCCMEventFormatter)