How to write an output module

Create file and class

  • Plugin file in plaso/output/
    • Create an empty subclass of plaso.output.interface.OutputModule
    • Register it with the output module manager by calling OutputManager.RegisterOutput
  • Test file in tests/output/
    • Create an empty subclass of tests.output.test_lib.OutputModuleTestCase

Write minimal tests

  • Write a test that loads your output module.
  • It will fail initially, but running the test while you’re developing your plugin gives you a quick way to see if your code is doing what you expect.

Develop plugin

  • Implement your subclass of plaso.output.interface.OutputModule
  • You’ll need to define/overwrite:
    • NAME
    • WriteEventBody
  • You may also want to override:
    • Open()
    • Close()
    • GetMissingArguments()
    • WriteHeader()
    • WriteEventStart()
    • WriteEventEnd()
    • WriteEventMACBGroup()
    • WriteFooter()

Expand tests

  • Add additional tests that test your plugin

Register classes

  • Edit plaso/output/ to import your plugin in the correct alphabetical order.

Code review/submit