"""Windows shell item custom event formatter helpers."""
from plaso.formatters import interface
from plaso.formatters import manager
[docs]
class ShellItemFileEntryNameFormatterHelper(
interface.CustomEventFormatterHelper):
"""Windows shell item file entry formatter helper."""
IDENTIFIER = 'shell_item_file_entry_name'
[docs]
def FormatEventValues(self, output_mediator, event_values):
"""Formats event values using the helper.
Args:
output_mediator (OutputMediator): output mediator.
event_values (dict[str, object]): event values.
"""
event_values['file_entry_name'] = event_values.get('long_name')
if not event_values['file_entry_name']:
event_values['file_entry_name'] = event_values.get('name')
manager.FormattersManager.RegisterEventFormatterHelper(
ShellItemFileEntryNameFormatterHelper)