How to use the plaso.formatters.manager.FormattersManager.RegisterFormatter function in plaso

To help you get started, we’ve selected a few plaso examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github log2timeline / plaso / tests / filters / expression_parser.py View on Github external
from tests import test_lib as shared_test_lib
from tests.containers import test_lib as containers_test_lib


class PfilterFakeFormatter(formatters_interface.EventFormatter):
  """A formatter for this fake class."""
  DATA_TYPE = 'Weirdo:Made up Source:Last Written'

  FORMAT_STRING = '{text}'
  FORMAT_STRING_SHORT = '{text_short}'

  SOURCE_LONG = 'Fake Parsing Source'
  SOURCE_SHORT = 'REG'


formatters_manager.FormattersManager.RegisterFormatter(PfilterFakeFormatter)


class TestBinaryOperator(filters.GenericBinaryOperator):
  """Binary operator for testing.

  Attributes:
    values (list[str]): event values passed to the _CompareValue function.
  """

  def __init__(self, arguments=None, **kwargs):
    """Initializes a binary operator.

    Args:
      arguments (Optional[object]): operands of the filter.
    """
    super(TestBinaryOperator, self).__init__(arguments=arguments, **kwargs)
github log2timeline / plaso / plaso / formatters / mac_notificationcenter.py View on Github external
WrongFormatter: if the event data cannot be formatted by the formatter.
    """
    if self.DATA_TYPE != event_data.data_type:
      raise errors.WrongFormatter('Unsupported data type: {0:s}.'.format(
          event_data.data_type))

    event_values = event_data.CopyToDict()

    presented = event_values.get('presented', None)
    if presented is not None:
      event_values['presented'] = (
          self._BOOLEAN_PRETTY_PRINT.get(presented, 'UNKNOWN'))

    return self._ConditionalFormatMessages(event_values)

manager.FormattersManager.RegisterFormatter(MacNotificationCenterFormatter)
github log2timeline / plaso / plaso / formatters / dpkg.py View on Github external
class DpkgFormatter(interface.ConditionalEventFormatter):
  """Formatter for a dpkg log file event."""

  DATA_TYPE = 'dpkg:line'

  FORMAT_STRING_SEPARATOR = ''

  FORMAT_STRING_PIECES = [
      '{body}']

  SOURCE_LONG = 'dpkg log File'
  SOURCE_SHORT = 'LOG'


manager.FormattersManager.RegisterFormatter(DpkgFormatter)
github log2timeline / plaso / plaso / formatters / mackeeper_cache.py View on Github external
'{text}',
      '[',
      'URL: {url}',
      'Event ID: {record_id}',
      'Room: {room}',
      ']']

  FORMAT_STRING_SHORT_PIECES = [
      '<{event_type}>',
      '{text}']

  SOURCE_LONG = 'MacKeeper Cache'
  SOURCE_SHORT = 'LOG'


manager.FormattersManager.RegisterFormatter(MacKeeperCacheFormatter)
github log2timeline / plaso / plaso / formatters / mac_document_versions.py View on Github external
DATA_TYPE = 'mac:document_versions:file'

  FORMAT_STRING_PIECES = [
      'Version of [{name}]',
      '({path})',
      'stored in {version_path}',
      'by {user_sid}']

  FORMAT_STRING_SHORT_PIECES = [
      'Stored a document version of [{name}]']

  SOURCE_LONG = 'Document Versions'
  SOURCE_SHORT = 'HISTORY'


manager.FormattersManager.RegisterFormatter(MacDocumentVersionsFormatter)
github log2timeline / plaso / plaso / formatters / chrome_cache.py View on Github external
from plaso.formatters import manager


class ChromeCacheEntryEventFormatter(interface.ConditionalEventFormatter):
  """Formatter for a Chrome Cache entry event."""

  DATA_TYPE = 'chrome:cache:entry'

  FORMAT_STRING_PIECES = [
      'Original URL: {original_url}']

  SOURCE_LONG = 'Chrome Cache'
  SOURCE_SHORT = 'WEBHIST'


manager.FormattersManager.RegisterFormatter(ChromeCacheEntryEventFormatter)
github log2timeline / plaso / plaso / formatters / sccm.py View on Github external
DATA_TYPE = 'software_management:sccm:log'

  FORMAT_STRING_SEPARATOR = ' '

  FORMAT_STRING_PIECES = [
      '{component}',
      '{text}']

  FORMAT_STRING_SHORT_PIECES = ['{text}']

  SOURCE_LONG = 'SCCM Event'
  SOURCE_SHORT = 'LOG'


manager.FormattersManager.RegisterFormatter(SCCMEventFormatter)