How to write an output module

Create file and class

Write minimal tests

  • Write a test that loads your output module.

  • It will fail initially, but running the test while you’re developing your plugin gives you a quick way to see if your code is doing what you expect.

Develop plugin

  • Implement your subclass of plaso.output.interface.OutputModule

  • You’ll need to define/overwrite:

    • NAME


    • WriteEventBody

  • You may also want to override:

    • Open()

    • Close()

    • GetMissingArguments()

    • WriteHeader()

    • WriteFooter()

Expand tests

  • Add additional tests that test your plugin

Register classes

  • Edit plaso/output/ to import your plugin in the correct alphabetical order.

Code review/submit

  • Create a PR to have the changes reviewed and merged with the main branch.