plaso.storage.redis package

Submodules

plaso.storage.redis.merge_reader module

Redis merge reader.

class plaso.storage.redis.merge_reader.RedisMergeReader(storage_writer, task, redis_client=None)[source]

Bases: plaso.storage.interface.StorageMergeReader

Redis store reader for merging.

MergeAttributeContainers(callback=None, maximum_number_of_containers=0)[source]

Reads attribute containers from a task store into the writer.

Parameters
  • callback (Optional[function[StorageWriter, AttributeContainer]]) – function to call after each attribute container is deserialized.

  • maximum_number_of_containers (Optional[int]) – maximum number of containers to merge, where 0 represent no limit.

Returns

True if the entire task storage file has been merged.

Return type

bool

Raises

RuntimeError – if the add method for the active attribute container type is missing.

plaso.storage.redis.reader module

Redis reader.

class plaso.storage.redis.reader.RedisStorageReader(task)[source]

Bases: plaso.storage.interface.StorageReader

Redis storage file reader.

Close()[source]

Closes the storage reader.

GetAnalysisReports()[source]

Retrieves the analysis reports.

Returns

analysis report generator.

Return type

generator(AnalysisReport)

GetEventData()[source]

Retrieves the event data.

Returns

event data generator.

Return type

generator(EventData)

GetEventDataByIdentifier(identifier)[source]

Retrieves specific event data.

Parameters

identifier (AttributeContainerIdentifier) – event data identifier.

Returns

event data or None if not available.

Return type

EventData

GetEventDataStreamByIdentifier(identifier)[source]

Retrieves a specific event data stream.

Parameters

identifier (AttributeContainerIdentifier) – event data stream identifier.

Returns

event data stream or None if not available.

Return type

EventDataStream

GetEventDataStreams()[source]

Retrieves the event data streams.

Returns

event data stream generator.

Return type

generator(EventDataStream)

GetEventSources()[source]

Retrieves event sources.

Returns

event source generator.

Return type

generator(EventSource)

GetEventTagByIdentifier(identifier)[source]

Retrieves a specific event tag.

Parameters

identifier (AttributeContainerIdentifier) – event tag identifier.

Returns

event tag or None if not available.

Return type

EventTag

GetEventTags()[source]

Retrieves the event tags.

Returns

event tag generator.

Return type

generator(EventSource)

GetEvents()[source]

Retrieves the events.

Returns

event generator.

Return type

generator(EventObject)

GetNumberOfAnalysisReports()[source]

Retrieves the number analysis reports.

Returns

number of analysis reports.

Return type

int

GetNumberOfEventSources()[source]

Retrieves the number of event sources.

Returns

number of event sources.

Return type

int

GetSessions()[source]

Retrieves the sessions.

Returns

session generator.

Return type

generator(Session)

GetSortedEvents(time_range=None)[source]

Retrieves the events in increasing chronological order.

This includes all events written to the storage including those pending being flushed (written) to the storage.

Parameters

time_range (Optional[TimeRange]) – time range used to filter events that fall in a specific period.

Returns

event generator.

Return type

generator(EventObject)

GetWarnings()[source]

Retrieves the warnings.

Returns

extraction warning generator.

Return type

generator(ExtractionWarning)

HasAnalysisReports()[source]

Determines if a store contains analysis reports.

Returns

True if the store contains analysis reports.

Return type

bool

HasEventTags()[source]

Determines if a store contains event tags.

Returns

True if the store contains event tags.

Return type

bool

HasWarnings()[source]

Determines if a store contains extraction warnings.

Returns

True if the store contains extraction warnings.

Return type

bool

IsFinalized()[source]

Checks if the store has been finalized.

Returns

True if the store has been finalized.

Return type

bool

Open()[source]

Opens the storage reader.

ReadSystemConfiguration(knowledge_base)[source]

Reads system configuration information.

The system configuration contains information about various system specific configuration data, for example the user accounts.

Parameters

knowledge_base (KnowledgeBase) – is used to store the preprocessing information.

SetSerializersProfiler(serializers_profiler)[source]

Sets the serializers profiler.

Parameters

serializers_profiler (SerializersProfiler) – serializers profiler.

SetStorageProfiler(storage_profiler)[source]

Sets the storage profiler.

Parameters

storage_profiler (StorageProfiler) – storage profile.

plaso.storage.redis.redis_store module

Redis store.

Only supports task storage at the moment.

class plaso.storage.redis.redis_store.RedisStore(storage_type='task', session_identifier=None, task_identifier=None)[source]

Bases: plaso.storage.interface.BaseStore

Redis store.

Attribute containers are stored as Redis Hashes. All keys are prefixed with the session identifier to avoid collisions. Event identifiers are also stored in an index to enable sorting.

AddEvent(event, serialized_data=None)[source]

Adds an event.

Parameters
  • event (EventObject) – event.

  • serialized_data (Optional[bytes]) – serialized form of the event.

Close()[source]

Closes the store.

DEFAULT_REDIS_URL = 'redis://127.0.0.1/0'
Finalize()[source]

Marks a store as finalized.

No further attribute containers will be written to a finalized store.

GetSerializedAttributeContainers(container_type, cursor, maximum_number_of_items)[source]

Fetches serialized attribute containers.

Parameters
  • container_type (str) – attribute container type.

  • cursor (int) – Redis cursor.

  • maximum_number_of_items (int) – maximum number of containers to retrieve, where 0 represent no limit.

Returns

containing:

int: Redis cursor. list[bytes]: serialized attribute containers.

Return type

tuple

GetSortedEvents(time_range=None)[source]

Retrieves the events in increasing chronological order.

Parameters

time_range (Optional[TimeRange]) – This argument is not supported by the Redis store.

Yields

EventObject – event.

Raises

RuntimeError – if a time_range argument is specified.

IsFinalized()[source]

Checks if a store has been finalized.

Returns

True if the store has been finalized.

Return type

bool

classmethod MarkTaskAsMerging(task_identifier, session_identifier, redis_client=None, url=None)[source]

Marks a finalized task as pending merge.

Parameters
  • task_identifier (str) – identifier of the task.

  • session_identifier (str) – session identifier, formatted as a UUID.

  • redis_client (Optional[Redis]) – Redis client to query. If specified, no new client will be created.

  • url (Optional[str]) – URL for a Redis database. If not specified, REDIS_DEFAULT_URL will be used.

Raises
  • IOError – if the task being updated is not finalized.

  • OSError – if the task being updated is not finalized.

Open(redis_client=None, url=None, **unused_kwargs)[source]

Opens the store.

Parameters
  • redis_client (Optional[Redis]) – Redis client to query. If specified, no new client will be created. If no client is specified a new client will be opened connected to the Redis instance specified by ‘url’.

  • url (Optional[str]) – URL for a Redis database. If not specified, the DEFAULT_REDIS_URL will be used.

Raises
  • IOError – if the store is already connected to a Redis instance.

  • OSError – if the store is already connected to a Redis instance.

Remove()[source]

Removes the contents of the store from Redis.

RemoveAttributeContainer(container_type, identifier)[source]

Removes an attribute container from the store.

Parameters
  • container_type (str) – container type attribute of the container being removed.

  • identifier (AttributeContainerIdentifier) – event data identifier.

RemoveAttributeContainers(container_type, container_identifiers)[source]

Removes multiple attribute containers from the store.

Parameters
  • container_type (str) – container type attribute of the container being removed.

  • container_identifiers (list[AttributeContainerIdentifier]) – event data identifier.

classmethod ScanForProcessedTasks(session_identifier, redis_client=None, url=None)[source]

Scans a Redis database for processed tasks.

Parameters
  • session_identifier (str) – session identifier, formatted as a UUID.

  • redis_client (Optional[Redis]) – Redis client to query. If specified, no new client will be created.

  • url (Optional[str]) – URL for a Redis database. If not specified, REDIS_DEFAULT_URL will be used.

Returns

containing
list[str]: identifiers of processed tasks, which may be empty if the

connection to Redis times out.

Redis: Redis client used for the query.

Return type

tuple

plaso.storage.redis.writer module

Storage writer for Redis.

class plaso.storage.redis.writer.RedisStorageWriter(session, storage_type='task', task=None)[source]

Bases: plaso.storage.interface.StorageWriter

Redis-based storage writer.

AddAnalysisReport(analysis_report)[source]

Adds an analysis report.

Parameters

analysis_report (AnalysisReport) – a report.

AddEvent(event, serialized_data=None)[source]

Adds an event.

Parameters
  • event (EventObject) – an event.

  • serialized_data (Optional[bytes]) – serialized form of the event.

AddEventData(event_data, serialized_data=None)[source]

Adds an event data.

Parameters
  • event_data (EventData) – an event.

  • serialized_data (Optional[bytes]) – serialized form of the event data.

AddEventDataStream(event_data_stream, serialized_data=None)[source]

Adds an event data stream.

Parameters
  • event_data_stream (EventDataStream) – event data stream.

  • serialized_data (Optional[bytes]) – serialized form of the event data stream.

AddEventSource(event_source, serialized_data=None)[source]

Adds an event source.

Parameters
  • event_source (EventSource) – an event source.

  • serialized_data (Optional[bytes]) – serialized form of the event source.

AddEventTag(event_tag, serialized_data=None)[source]

Adds an event tag.

Parameters
  • event_tag (EventTag) – an event tag.

  • serialized_data (Optional[bytes]) – serialized form of the event tag.

AddWarning(warning, serialized_data=None)[source]

Adds a warning.

Parameters
  • warning (ExtractionWarning) – a warning.

  • serialized_data (Optional[bytes]) – serialized form of the warning.

CheckTaskReadyForMerge(task)[source]

Checks if a task is ready for merging into the store.

Parameters

task (Task) – task.

Returns

True if the task is ready to be merged.

Return type

bool

Close()[source]

Closes the storage writer.

Raises
  • IOError – if the storage writer is closed.

  • OSError – if the storage writer is closed.

CreateTaskStorage(task, task_storage_format)[source]

Creates a task storage.

Parameters
  • task (Task) – task.

  • task_storage_format (str) – storage format to store task results.

Raises
  • IOError – always, as creating a task is not supported by the Redis store.

  • OSError – always, as creating a task is not supported by the Redis store.

FinalizeTaskStorage(task)[source]

Finalizes a processed task storage.

Parameters

task (Task) – task.

Raises
  • IOError – always, as creating a finalizing a task storage is not supported by the Redis store.

  • OSError – always, as creating a finalizing a task storage is not supported by the Redis store.

GetEventDataByIdentifier(identifier)[source]

Retrieves specific event data.

Parameters

identifier (AttributeContainerIdentifier) – event data identifier.

Returns

event data or None if not available.

Return type

EventData

GetEventDataStreamByIdentifier(identifier)[source]

Retrieves a specific event data stream.

Parameters

identifier (AttributeContainerIdentifier) – event data stream identifier.

Returns

event data stream or None if not available.

Return type

EventDataStream

GetEvents()[source]

Retrieves the events.

Returns

event generator.

Return type

generator(EventObject)

GetFirstWrittenEventSource()[source]

Retrieves the first event source that was written after open.

Using GetFirstWrittenEventSource and GetNextWrittenEventSource newly added event sources can be retrieved in order of addition.

Returns

None as there are no newly written event sources.

Return type

EventSource

Raises
  • IOError – if the storage writer is closed.

  • OSError – if the storage writer is closed.

GetNextWrittenEventSource()[source]

Retrieves the next event source that was written after open.

Returns

None as there are no newly written event sources.

Return type

EventSource

Raises
  • IOError – if the storage writer is closed.

  • OSError – if the storage writer is closed.

GetSortedEvents(time_range=None)[source]

Retrieves the events in increasing chronological order.

This includes all events written to the storage including those pending being flushed (written) to the storage.

Parameters

time_range (Optional[TimeRange]) – time range used to filter events that fall in a specific period.

Returns

event generator.

Return type

generator(EventObject)

Raises
  • IOError – if the storage writer is closed.

  • OSError – if the storage writer is closed.

Open(redis_client=None, **unused_kwargs)[source]

Opens the storage writer.

Raises
  • IOError – if the storage writer is already opened.

  • OSError – if the storage writer is already opened.

PrepareMergeTaskStorage(task)[source]

Prepares a task storage for merging.

Parameters

task (Task) – task.

ReadSystemConfiguration(knowledge_base)[source]

Reads system configuration information.

The system configuration contains information about various system specific configuration data, for example the user accounts.

Parameters

knowledge_base (KnowledgeBase) – is used to store the preprocessing information.

Raises
  • IOError – always, as the Redis store does not support preprocessing information.

  • OSError – always, as the Redis store does not support preprocessing information.

RemoveProcessedTaskStorage(task)[source]

Removes a processed task storage.

Parameters

task (Task) – task.

Raises
  • IOError – always, as the Redis store does not support removing a task store.

  • OSError – always, as the Redis store does not support removing a task store.

SetSerializersProfiler(serializers_profiler)[source]

Sets the serializers profiler.

Parameters

serializers_profiler (SerializersProfiler) – serializers profiler.

SetStorageProfiler(storage_profiler)[source]

Sets the storage profiler.

Parameters

storage_profiler (StorageProfiler) – storage profiler.

WritePreprocessingInformation(knowledge_base)[source]

Writes preprocessing information.

Parameters

knowledge_base (KnowledgeBase) – contains the preprocessing information.

Raises
  • IOError – always as the Redis store does not support preprocessing information.

  • OSError – always as the Redis store does not support preprocessing information.

WriteSessionCompletion(aborted=False)[source]

Writes session completion information.

Parameters

aborted (Optional[bool]) – True if the session was aborted.

Raises
  • IOError – always, as the Redis store does not support writing a session completion.

  • OSError – always, as the Redis store does not support writing a session completion.

WriteSessionConfiguration()[source]

Writes session configuration information.

Raises
  • IOError – always, as the Redis store does not support writing a session configuration.

  • OSError – always, as the Redis store does not support writing a session configuration.

WriteSessionStart()[source]

Writes session start information.

Raises
  • IOError – always, as the Redis store does not support writing a session start.

  • OSError – always, as the Redis store does not support writing a session start.

WriteTaskCompletion(aborted=False)[source]

Writes task completion information.

Parameters

aborted (Optional[bool]) – True if the session was aborted.

Raises
  • IOError – if the storage type is not supported or when the storage writer is closed.

  • OSError – if the storage type is not supported or when the storage writer is closed.

WriteTaskStart()[source]

Writes task start information.

Raises
  • IOError – if the storage type does not support writing a task start or when the storage writer is closed.

  • OSError – if the storage type does not support writing a task start or when the storage writer is closed.

Module contents