How to use the artifacts.source_type.FileSourceType function in artifacts

To help you get started, we’ve selected a few artifacts examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github ForensicArtifacts / artifacts / tests / source_type.py View on Github external
def testInitialize(self):
    """Tests the __init__ function."""
    source_type.FileSourceType(paths=[u'test'])
    source_type.FileSourceType(paths=[u'test'], separator=u'\\')
github ForensicArtifacts / artifacts / tests / source_type.py View on Github external
def testInitialize(self):
    """Tests the __init__ function."""
    source_type.FileSourceType(paths=[u'test'])
    source_type.FileSourceType(paths=[u'test'], separator=u'\\')
github ForensicArtifacts / artifacts / artifacts / registry.py View on Github external
from __future__ import unicode_literals

from artifacts import definitions
from artifacts import errors
from artifacts import source_type


class ArtifactDefinitionsRegistry(object):
  """Artifact definitions registry."""

  _source_type_classes = {
      definitions.TYPE_INDICATOR_ARTIFACT_GROUP:
          source_type.ArtifactGroupSourceType,
      definitions.TYPE_INDICATOR_COMMAND: source_type.CommandSourceType,
      definitions.TYPE_INDICATOR_DIRECTORY: source_type.DirectorySourceType,
      definitions.TYPE_INDICATOR_FILE: source_type.FileSourceType,
      definitions.TYPE_INDICATOR_PATH: source_type.PathSourceType,
      definitions.TYPE_INDICATOR_WINDOWS_REGISTRY_KEY:
          source_type.WindowsRegistryKeySourceType,
      definitions.TYPE_INDICATOR_WINDOWS_REGISTRY_VALUE:
          source_type.WindowsRegistryValueSourceType,
      definitions.TYPE_INDICATOR_WMI_QUERY: source_type.WMIQuerySourceType,
  }

  def __init__(self):
    """Initializes an artifact definitions registry."""
    super(ArtifactDefinitionsRegistry, self).__init__()
    self._artifact_definitions = {}
    self._artifact_name_references = set()
    self._defined_artifact_names = set()

  @classmethod
github ForensicArtifacts / artifacts / artifacts / source_type.py View on Github external
"""
    source_type_attributes = {'query': self.query}
    if self.base_object:
      source_type_attributes['base_object'] = self.base_object

    return source_type_attributes


class SourceTypeFactory(object):
  """Source type factory."""

  _source_type_classes = {
      definitions.TYPE_INDICATOR_ARTIFACT_GROUP: ArtifactGroupSourceType,
      definitions.TYPE_INDICATOR_COMMAND: CommandSourceType,
      definitions.TYPE_INDICATOR_DIRECTORY: DirectorySourceType,
      definitions.TYPE_INDICATOR_FILE: FileSourceType,
      definitions.TYPE_INDICATOR_PATH: PathSourceType,
      definitions.TYPE_INDICATOR_WINDOWS_REGISTRY_KEY:
          WindowsRegistryKeySourceType,
      definitions.TYPE_INDICATOR_WINDOWS_REGISTRY_VALUE:
          WindowsRegistryValueSourceType,
      definitions.TYPE_INDICATOR_WMI_QUERY: WMIQuerySourceType,
  }

  @classmethod
  def CreateSourceType(cls, type_indicator, attributes):
    """Creates a source type.

    Args:
      type_indicator (str): source type indicator.
      attributes (dict[str, object]): source type attributes.
github ForensicArtifacts / artifacts / artifacts / source_type.py View on Github external
"""Initializes a source type.

    Args:
      paths (Optional[str]): paths relative to the root of the file system.
      separator (Optional[str]): path segment separator.

    Raises:
      FormatError: when paths is not set or not a list type.
    """
    if not paths:
      raise errors.FormatError('Missing paths value.')

    if not isinstance(paths, list):
      raise errors.FormatError('Invalid paths value, not a list.')

    super(FileSourceType, self).__init__()
    self.paths = paths
    self.separator = separator