How to write an output module
Create file and class
Plugin file in
plaso/output/
Create an empty subclass of plaso.output.interface.OutputModule
Register it with the output module manager by calling OutputManager.RegisterOutput
Test file in
tests/output/
Create an empty subclass of
tests.output.test_lib.OutputModuleTestCase
Write minimal tests
Write a test that loads your output module.
It will fail initially, but running the test while you’re developing your plugin gives you a quick way to see if your code is doing what you expect.
Develop plugin
Implement your subclass of plaso.output.interface.OutputModule
You’ll need to define/overwrite:
NAME
DESCRIPTION
WriteEventBody
You may also want to override:
Open()
Close()
GetMissingArguments()
WriteHeader()
WriteFooter()
Expand tests
Add additional tests that test your plugin
Register classes
Edit
plaso/output/__init__.py
to import your plugin in the correct alphabetical order.
Code review/submit
Create a PR to have the changes reviewed and merged with the main branch.