Source code for plaso.formatters.winevt
# -*- coding: utf-8 -*-
"""Windows EventLog custom event formatter helpers."""
from plaso.formatters import interface
from plaso.formatters import logger
from plaso.formatters import manager
[docs]class WindowsEventLogMessageFormatterHelper(
interface.CustomEventFormatterHelper):
"""Windows EventLog message formatter helper."""
IDENTIFIER = 'windows_eventlog_message'
def __init__(self):
"""Initialized a indows EventLog message formatter helper."""
super(WindowsEventLogMessageFormatterHelper, self).__init__()
self._winevt_resources_helper = None
[docs] def FormatEventValues(self, output_mediator, event_values):
"""Formats event values using the helper.
Args:
output_mediator (OutputMediator): output mediator.
event_values (dict[str, object]): event values.
"""
if not self._winevt_resources_helper:
self._winevt_resources_helper = output_mediator.GetWinevtResourcesHelper()
message_string = None
provider_identifier = event_values.get('provider_identifier', None)
source_name = event_values.get('source_name', None)
message_identifier = event_values.get('message_identifier', None)
event_version = event_values.get('event_version', None)
if (provider_identifier or source_name) and message_identifier:
message_string_template = self._winevt_resources_helper.GetMessageString(
provider_identifier, source_name, message_identifier, event_version)
if message_string_template:
string_values = [
string or '' for string in event_values.get('strings', [])]
try:
message_string = message_string_template.format(*string_values)
except (IndexError, TypeError) as exception:
logger.error((
'Unable to format message: 0x{0:08x} of provider: {1:s} '
'template: "{2:s}" and strings: "{3:s}" with error: '
'{4!s}').format(
message_identifier, provider_identifier or '',
message_string_template, ', '.join(string_values), exception))
# Unable to create the message string.
# TODO: consider returning the unformatted message string.
event_values['message_string'] = message_string
manager.FormattersManager.RegisterEventFormatterHelper(
WindowsEventLogMessageFormatterHelper)