plaso.filters package

Submodules

plaso.filters.event_filter module

The event filter.

class plaso.filters.event_filter.EventObjectFilter[source]

Bases: plaso.filters.interface.FilterObject

Event filter.

CompileFilter(filter_expression)[source]

Compiles the filter expression.

The filter expression contains an object filter expression.

Parameters:filter_expression (str) – filter expression.
Raises:WrongPlugin – if the filter could not be compiled.
Match(event)[source]

Determines if an event matches the filter.

Parameters:event (EventObject) – an event.
Returns:True if the event matches the filter.
Return type:bool

plaso.filters.file_entry module

File entry filters.

class plaso.filters.file_entry.DateTimeFileEntryFilter[source]

Bases: plaso.filters.file_entry.FileEntryFilter

Date and time-based file entry filter.

AddDateTimeRange(time_value, start_time_string=None, end_time_string=None)[source]

Adds a date time filter range.

The time strings are formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:## Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3 or 6 digits. The time of day, seconds fraction and timezone offset are optional. The default timezone is UTC.

Parameters:
  • time_value (str) – time value, such as, atime, ctime, crtime, dtime, bkup and mtime.
  • start_time_string (str) – start date and time value string.
  • end_time_string (str) – end date and time value string.
Raises:

ValueError – If the filter is badly formed.

Matches(file_entry)[source]

Compares the file entry against the filter.

Parameters:file_entry (dfvfs.FileEntry) – file entry to compare.
Returns:
True if the file entry matches the filter, False if not or
None if the filter does not apply.
Return type:bool
Print(output_writer)[source]

Prints a human readable version of the filter.

Parameters:output_writer (CLIOutputWriter) – output writer.
class plaso.filters.file_entry.ExtensionsFileEntryFilter(extensions)[source]

Bases: plaso.filters.file_entry.FileEntryFilter

Extensions-based file entry filter.

Matches(file_entry)[source]

Compares the file entry against the filter.

Parameters:file_entry (dfvfs.FileEntry) – file entry to compare.
Returns:
True if the file entry matches the filter, False if not or
None if the filter does not apply.
Return type:bool
Print(output_writer)[source]

Prints a human readable version of the filter.

Parameters:output_writer (CLIOutputWriter) – output writer.
class plaso.filters.file_entry.FileEntryFilter[source]

Bases: object

File entry filter interface.

Matches(file_entry)[source]

Compares the file entry against the filter.

Parameters:file_entry (dfvfs.FileEntry) – file entry to compare.
Returns:
True if the file entry matches the filter, False if not or
None if the filter does not apply.
Return type:bool
Print(output_writer)[source]

Prints a human readable version of the filter.

Parameters:output_writer (CLIOutputWriter) – output writer.
class plaso.filters.file_entry.FileEntryFilterCollection[source]

Bases: object

Collection of file entry filters.

AddFilter(file_entry_filter)[source]

Adds a file entry filter to the collection.

Parameters:file_entry_filter (FileEntryFilter) – file entry filter.
HasFilters()[source]

Determines if filters are defined.

Returns:True if filters are defined.
Return type:bool
Matches(file_entry)[source]

Compares the file entry against the filter collection.

Parameters:file_entry (dfvfs.FileEntry) – file entry to compare.
Returns:
True if the file entry matches one of the filters. If no filters
are provided or applicable the result will be True.
Return type:bool
Print(output_writer)[source]

Prints a human readable version of the filter.

Parameters:output_writer (CLIOutputWriter) – output writer.
class plaso.filters.file_entry.NamesFileEntryFilter(names)[source]

Bases: plaso.filters.file_entry.FileEntryFilter

Names-based file entry filter.

Matches(file_entry)[source]

Compares the file entry against the filter.

Parameters:file_entry (dfvfs.FileEntry) – file entry to compare.
Returns:True if the file entry matches the filter.
Return type:bool
Print(output_writer)[source]

Prints a human readable version of the filter.

Parameters:output_writer (CLIOutputWriter) – output writer.
class plaso.filters.file_entry.SignaturesFileEntryFilter(specification_store, signature_identifiers)[source]

Bases: plaso.filters.file_entry.FileEntryFilter

Signature-based file entry filter.

Matches(file_entry)[source]

Compares the file entry against the filter.

Parameters:file_entry (dfvfs.FileEntry) – file entry to compare.
Returns:
True if the file entry matches the filter, False if not or
None if the filter does not apply.
Return type:bool
Print(output_writer)[source]

Prints a human readable version of the filter.

Parameters:output_writer (CLIOutputWriter) – output writer.

plaso.filters.interface module

Filter interface.

class plaso.filters.interface.FilterObject[source]

Bases: object

Filter object interface.

CompileFilter(filter_expression)[source]

Compiles the filter expression.

Parameters:filter_expression (str) – filter expression.
Raises:WrongPlugin – if the filter could not be compiled.
Match(event)[source]

Determines if an event matches the filter.

Parameters:event (EventObject) – event.
Returns:True if the there is a match.
Return type:bool
fields

list[str] – name of the fields.

filter_expression

object – compiled filter expression or None.

filter_name

str – name of the filter.

limit

int – row limit.

separator

str – output field separator.

plaso.filters.path_filter module

A scan tree-based path filter implementation.

The scan tree is a tree based on multiple paths that contains the path segments per node. The most significant path segment is at the root and therefore compared first. More information can be found here: https://github.com/libyal/libsigscan/wiki/Internals #scanning-tree-based-signature-scanning

The scan tree is used in the filter to filter provided paths.

class plaso.filters.path_filter.PathFilterScanTree(paths, case_sensitive=True, path_segment_separator=u'/')[source]

Bases: object

Class that implements a path filter scan tree.

CheckPath(path, path_segment_separator=None)[source]

Checks if a path matches the scan tree-based path filter.

Parameters:
  • path – a string containing the path.
  • path_segment_separator – optional string containing the path segment separator. None defaults to the path segment separator that was set when the path filter scan tree was initialized.
Returns:

A boolean indicating if the path matches the filter.

class plaso.filters.path_filter.PathFilterScanTreeNode(path_segment_index)[source]

Bases: object

Class that implements a path filter scan tree node.

The path filter scan tree node defines the path segments for a specific path segment index to filter. Each path segment will point to a scan object that indicates the next part of the path filter. A default value indicates the scan object to use next when there was no match.

default_value

the default scan object, either a scan tree sub node (instance of PathFilterScanTreeNode) or a string containing a path.

parent

the parent path filter scan tree node or None.

path_segment_index

an integer containing the path segment index represented by the node.

AddPathSegment(path_segment, scan_object)[source]

Adds a path segment.

Parameters:
  • path_segment – a string containing the path segment.
  • scan_object – a scan object, either a scan tree sub node (instance of PathFilterScanTreeNode) or a string containing a path.
Raises:

ValueError – if the node already contains a scan object for the path segment.

GetScanObject(path_segment)[source]

Retrieves the scan object for a specific path segment.

Parameters:path_segment – a string containing the path segment.
Returns:A scan object, which can be a scan tree sub node (instance of PathFilterScanTreeNode), a path or the default value.
SetDefaultValue(scan_object)[source]

Sets the default (non-match) value.

Parameters:

scan_object – a scan object, either a scan tree sub node (instance of PathFilterScanTreeNode) or a string containing a path.

Raises:
  • TypeError – if the scan object is of an unsupported type.
  • ValueError – if the default value is already set.
ToDebugString(indentation_level=1)[source]

Converts the path filter scan tree node into a debug string.

Parameters:indentation_level – an integer containing the text indentation level.
Returns:A string containing a debug representation of the path filter scan tree node.
path_segments

A list of strings containing the path segments.

Module contents