plaso.output package

Submodules

plaso.output.dynamic module

Dynamic selected delimiter separated values output module.

class plaso.output.dynamic.DynamicFieldFormattingHelper

Bases: FieldFormattingHelper

Dynamic output module field formatting helper.

class plaso.output.dynamic.DynamicOutputModule

Bases: DSVOutputModule

Dynamic selected delimiter separated values (DSV) output module.

DESCRIPTION = 'Dynamic selection of fields for a separated value output format.'

NAME = 'dynamic'

SUPPORTS_ADDITIONAL_FIELDS = True

SUPPORTS_CUSTOM_FIELDS = True

__init__()

Initializes an output module.

plaso.output.formatting_helper module

Output module field formatting helper.

class plaso.output.formatting_helper.EventFormattingHelper

Bases: object

Output module event formatting helper.

abstract GetFieldValues(output_mediator, event, event_data, event_data_stream, event_tag)

Retrieves the output field values.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• event (EventObject) – event.

• event_data (EventData) – event data.

• event_data_stream (EventDataStream) – event data stream.

• event_tag (EventTag) – event tag.

Returns:

output field values.

Return type:

list[str]

class plaso.output.formatting_helper.FieldFormattingHelper

Bases: object

Output module field formatting helper.

GetFormattedField(output_mediator, field_name, event, event_data, event_data_stream, event_tag)

Formats the specified field.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• field_name (str) – name of the field.

• event (EventObject) – event.

• event_data (EventData) – event data.

• event_data_stream (EventDataStream) – event data stream.

• event_tag (EventTag) – event tag.

Returns:

value of the field or None if not available.

Return type:

str

__init__()

Initializes a field formatting helper.

plaso.output.interface module

This file contains the output module interface class.

class plaso.output.interface.OutputModule

Bases: object

Output module interface.

Close()

Closes the output.

DESCRIPTION = ''

abstract GetFieldValues(output_mediator, event, event_data, event_data_stream, event_tag)

Retrieves the output field values.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• event (EventObject) – event.

• event_data (EventData) – event data.

• event_data_stream (EventDataStream) – event data stream.

• event_tag (EventTag) – event tag.

Returns:

output field values per name.

Return type:

dict[str, str]

GetMissingArguments()

Retrieves arguments required by the module that have not been specified.

Returns:

names of argument that are required by the module and have

not been specified.

Return type:

list[str]

NAME = ''

Open(**kwargs)

Opens the output.

SUPPORTS_ADDITIONAL_FIELDS = False

SUPPORTS_CUSTOM_FIELDS = False

WRITES_OUTPUT_FILE = False

abstract WriteFieldValues(output_mediator, field_values)

Writes field values to the output.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• field_values (dict[str, str]) – output field values per name.

WriteFieldValuesOfMACBGroup(output_mediator, macb_group)

Writes field values of a MACB group to the output.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• macb_group (list[tuple[event, event_data, event_data_stream, event_tag]]) – group of event, event_data, event_data_stream and event_tag objects with identical timestamps, attributes and values.

WriteFooter()

Writes the footer to the output.

Can be used for post-processing or output after the last event is written, such as writing a file footer.

WriteHeader(output_mediator)

Writes the header to the output.

Can be used for pre-processing or output before the first event is written, such as writing a file header.

Parameters:

output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

plaso.output.json_line module

Output module that saves data into a JSON line format.

JSON line format is a single JSON entry or event per line instead of grouping all the output into a single JSON entity.

class plaso.output.json_line.JSONLineOutputModule

Bases: SharedJSONOutputModule

Output module for the JSON line format.

DESCRIPTION = 'Saves the events into a JSON line format.'

NAME = 'json_line'

WriteFieldValues(output_mediator, field_values)

Writes field values to the output.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• field_values (dict[str, str]) – output field values per name.

plaso.output.json_out module

Output module that saves data into a JSON format.

class plaso.output.json_out.JSONOutputModule

Bases: SharedJSONOutputModule

Output module for the JSON format.

DESCRIPTION = 'Saves the events into a JSON format.'

NAME = 'json'

WriteFieldValues(output_mediator, field_values)

Writes field values to the output.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• field_values (dict[str, str]) – output field values per name.

WriteFooter()

Writes the footer to the output.

WriteHeader(output_mediator)

Writes the header to the output.

Parameters:

output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

__init__()

Initializes an output module.

plaso.output.kml module

An output module that writes event with geography data to a KML XML file.

The Keyhole Markup Language (KML) is an XML notation for expressing geographic annotation and visualization within Internet-based, two-dimensional maps and three-dimensional Earth browsers.

class plaso.output.kml.KMLOutputModule

Bases: NativePythonOutputModule

Output module for a Keyhole Markup Language (KML) XML file.

DESCRIPTION = 'Saves events with geography data into a KML format.'

NAME = 'kml'

WriteFieldValues(output_mediator, field_values)

Writes field values to the output.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• field_values (dict[str, str]) – output field values per name.

WriteFooter()

Writes the footer to the output.

WriteHeader(output_mediator)

Writes the header to the output.

Parameters:

output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

plaso.output.l2t_csv module

Output module for the log2timeline (L2T) CSV format.

For documentation on the L2T CSV format see:

https://forensics.wiki/l2t_csv

class plaso.output.l2t_csv.L2TCSVEventFormattingHelper(field_formatting_helper, field_names, field_delimiter=',')

Bases: DSVEventFormattingHelper

L2T CSV output module event formatting helper.

GetFormattedMACBGroup(output_mediator, macb_group)

Retrieves a string representation of a MACB group.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• macb_group (list[tuple[event, event_data, event_data_stream, event_tag]]) – group of event, event_data, event_data_stream and event_tag objects with identical timestamps, attributes and values.

Returns:

string representation of the MACB group.

Return type:

str

class plaso.output.l2t_csv.L2TCSVFieldFormattingHelper

Bases: FieldFormattingHelper

L2T CSV output module field formatting helper.

class plaso.output.l2t_csv.L2TCSVOutputModule

Bases: SortedTextFileOutputModule

CSV format used by log2timeline, with 17 fixed fields.

DESCRIPTION = 'CSV format used by legacy log2timeline, with 17 fixed fields.'

NAME = 'l2tcsv'

WriteFieldValuesOfMACBGroup(output_mediator, macb_group)

Writes field values of a MACB group to the output.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• macb_group (list[tuple[event, event_data, event_data_stream, event_tag]]) – group of event, event_data, event_data_stream and event_tag objects with identical timestamps, attributes and values.

WriteHeader(output_mediator)

Writes the header to the output.

Parameters:

output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

__init__()

Initializes an output module.

plaso.output.logger module

The output sub module logger.

plaso.output.manager module

Output plugin manager.

class plaso.output.manager.OutputManager

Bases: object

Output module manager.

classmethod DeregisterOutput(output_class)

Deregisters an output class.

The output classes are identified based on their NAME attribute.

Parameters:

output_class (type) – output module class.

Raises:

KeyError – if output class is not set for the corresponding data type.

classmethod GetDisabledOutputClasses()

Retrieves the disabled output classes and its associated name.

Yields:

tuple[str, type] – output module name and class.

classmethod GetOutputClass(name)

Retrieves the output class for a specific name.

Parameters:

name (str) – name of the output module.

Returns:

output module class.

Return type:

type

Raises:

• KeyError – if there is no output class found with the supplied name.

• ValueError – if name is not a string.

classmethod GetOutputClasses()

Retrieves the available output classes its associated name.

Yields:

tuple[str, type] – output class name and type object.

classmethod HasOutputClass(name)

Determines if a specific output class is registered with the manager.

Parameters:

name (str) – name of the output module.

Returns:

True if the output class is registered.

Return type:

bool

classmethod NewOutputModule(name)

Creates a new output module object for the specified output format.

Parameters:

name (str) – name of the output module.

Returns:

output module.

Return type:

OutputModule

Raises:

• KeyError – if there is no output class found with the supplied name.

• ValueError – if name is not a string.

classmethod RegisterOutput(output_class, disabled=False)

Registers an output class.

The output classes are identified based on their NAME attribute.

Parameters:

• output_class (type) – output module class.

• disabled (Optional[bool]) – True if the output module is disabled due to the module not loading correctly or not.

Raises:

KeyError – if output class is already set for the corresponding name.

classmethod RegisterOutputs(output_classes, disabled=False)

Registers output classes.

The output classes are identified based on their NAME attribute.

Parameters:

• output_classes (list[type]) – output module classes.

• disabled (Optional[bool]) – True if the output module is disabled due to the module not loading correctly or not.

Raises:

KeyError – if output class is already set for the corresponding name.

plaso.output.mediator module

The output mediator object.

class plaso.output.mediator.OutputMediator(storage_reader, data_location=None, dynamic_time=False, preferred_encoding='utf-8')

Bases: object

Output mediator.

data_location

path of the formatter data files.

Type:

Optional[str]

GetDisplayNameForPathSpec(path_spec)

Retrieves the display name for a path specification.

Parameters:

path_spec (dfvfs.PathSpec) – path specification.

Returns:

human readable version of the path specification.

Return type:

str

GetHostname(event_data, default_hostname='-')

Retrieves the hostname related to the event.

Parameters:

• event_data (EventData) – event data.

• default_hostname (Optional[str]) – default hostname.

Returns:

hostname.

Return type:

str

GetMACBRepresentation(event, event_data)

Retrieves the MACB representation.

Parameters:

• event (EventObject) – event.

• event_data (EventData) – event data.

Returns:

MACB representation.

Return type:

str

GetMACBRepresentationFromDescriptions(timestamp_descriptions)

Determines the MACB representation from the timestamp descriptions.

MACB representation is a shorthand for representing one or more of modification, access, change, birth timestamp descriptions as the letters “MACB” or a “.” if the corresponding timestamp is not set.

Note that this is an output format shorthand and does not guarantee that the timestamps represent the same occurrence.

Parameters:

timestamp_descriptions (list[str]) – timestamp descriptions, which are defined in definitions.TIME_DESCRIPTIONS.

Returns:

MACB representation.

Return type:

str

GetMessageFormatter(data_type)

Retrieves the message formatter for a specific data type.

Parameters:

data_type (str) – data type.

Returns:

corresponding message formatter or the default message

formatter if not available.

Return type:

EventFormatter

GetRelativePathForPathSpec(path_spec)

Retrieves the relative path for a path specification.

Parameters:

path_spec (dfvfs.PathSpec) – path specification.

Returns:

relateive path of the path specification.

Return type:

str

GetSourceMapping(data_type)

Retrieves the source mapping for a specific data type.

Parameters:

data_type (str) – data type.

Returns:

short and (long) source mappings or (None, None) if not

available.

Return type:

tuple[str, str]

GetUsername(event_data, default_username='-')

Retrieves the username related to the event data.

Parameters:

• event_data (EventData) – event data.

• default_username (Optional[str]) – default username.

Returns:

username.

Return type:

str

GetWinevtResourcesHelper()

Retrieves a Windows EventLog resources helper.

Returns:

Windows EventLog resources helper.

Return type:

WinevtResourcesHelper

ReadMessageFormattersFromDirectory(path)

Reads message formatters from a directory.

Parameters:

path (str) – path of directory that contains the message formatters configuration files.

Raises:

KeyError – if the message formatter is already set for the corresponding data type.

ReadMessageFormattersFromFile(path, override_existing=False)

Reads message formatters from a file.

Parameters:

• path (str) – path of file that contains the message formatters configuration.

• override_existing (bool) – True if existing message formatters should be overridden.

Raises:

KeyError – if the message formatter is already set for the corresponding data type.

SetPreferredLanguageIdentifier(language_tag)

Sets the preferred language identifier.

Parameters:

language_tag (str) – language tag such as “en-US” for US English or “is-IS” for Icelandic.

Raises:

ValueError – if the language tag is not a string type or no LCID can be determined that corresponds with the language tag.

SetTimeZone(time_zone)

Sets the time zone.

Parameters:

time_zone (str) – time zone.

Raises:

ValueError – if the time zone is not supported.

__init__(storage_reader, data_location=None, dynamic_time=False, preferred_encoding='utf-8')

Initializes an output mediator.

Parameters:

• storage_reader (StorageReader) – storage reader.

• data_location (Optional[str]) – path of the formatter data files.

• dynamic_time (Optional[bool]) – True if date and time values should be represented in their granularity or semantically.

• preferred_encoding (Optional[str]) – preferred encoding to output.

property dynamic_time

True if dynamic time should be used.

Type:

bool

property encoding

preferred encoding to output.

Type:

str

property time_zone

time zone.

Type:

datetime.tzinfo

plaso.output.null module

Null device output module.

class plaso.output.null.NullOutputModule

Bases: OutputModule

Null device output module.

DESCRIPTION = 'Output module that does not output anything.'

GetFieldValues(output_mediator, event, event_data, event_data_stream, event_tag)

Retrieves the output field values.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• event (EventObject) – event.

• event_data (EventData) – event data.

• event_data_stream (EventDataStream) – event data stream.

• event_tag (EventTag) – event tag.

Returns:

output field values per name.

Return type:

dict[str, str]

NAME = 'null'

WriteFieldValues(output_mediator, field_values)

Writes field values to the output.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• field_values (dict[str, str]) – output field values per name.

plaso.output.opensearch module

An output module that saves events to OpenSearch.

class plaso.output.opensearch.OpenSearchOutputModule

Bases: SharedOpenSearchOutputModule

Output module for OpenSearch.

DESCRIPTION = 'Saves the events into an OpenSearch database.'

MAPPINGS_FILENAME = 'opensearch.mappings'

NAME = 'opensearch'

WriteFieldValues(output_mediator, field_values)

Writes field values to the output.

Events are buffered in the form of documents and inserted to OpenSearch when the flush interval (threshold) has been reached.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• field_values (dict[str, str]) – output field values per name.

WriteHeader(output_mediator)

Connects to the OpenSearch server and creates the index.

Parameters:

output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

plaso.output.opensearch_ts module

An output module that saves events to OpenSearch for Timesketch.

class plaso.output.opensearch_ts.OpenSearchTimesketchOutputModule

Bases: SharedOpenSearchOutputModule

Output module for Timesketch OpenSearch.

DESCRIPTION = 'Saves the events into an OpenSearch database for use with Timesketch.'

GetMissingArguments()

Retrieves a list of arguments that are missing from the input.

Returns:

names of arguments that are required by the module and have

not been specified.

Return type:

list[str]

MAPPINGS_FILENAME = 'plaso.mappings'

MAPPINGS_PATH = '/etc/timesketch'

NAME = 'opensearch_ts'

SetTimelineIdentifier(timeline_identifier)

Sets the timeline identifier.

Parameters:

timeline_identifier (int) – timeline identifier.

WriteFieldValues(output_mediator, field_values)

Writes field values to the output.

Events are buffered in the form of documents and inserted to OpenSearch when the flush interval (threshold) has been reached.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• field_values (dict[str, str]) – output field values per name.

WriteHeader(output_mediator)

Connects to the OpenSearch server and creates the index.

Parameters:

output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

__init__()

Initializes an output module.

plaso.output.rawpy module

Output module for the native (or “raw”) Python format.

class plaso.output.rawpy.NativePythonOutputModule

Bases: TextFileOutputModule

Output module for native (or “raw”) Python output format.

DESCRIPTION = 'native (or "raw") Python output.'

GetFieldValues(output_mediator, event, event_data, event_data_stream, event_tag)

Retrieves the output field values.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• event (EventObject) – event.

• event_data (EventData) – event data.

• event_data_stream (EventDataStream) – event data stream.

• event_tag (EventTag) – event tag.

Returns:

output field values per name.

Return type:

dict[str, str]

NAME = 'rawpy'

WriteFieldValues(output_mediator, field_values)

Writes field values to the output.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• field_values (dict[str, str]) – output field values per name.

__init__()

Initializes an output module.

plaso.output.shared_dsv module

Shared functionality for delimiter separated values output modules.

class plaso.output.shared_dsv.DSVEventFormattingHelper(field_formatting_helper, field_names, field_delimiter=',')

Bases: EventFormattingHelper

Delimiter separated values output module event formatting helper.

field_delimiter

field delimiter.

Type:

str

GetFieldValues(output_mediator, event, event_data, event_data_stream, event_tag)

Retrieves the output field values.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• event (EventObject) – event.

• event_data (EventData) – event data.

• event_data_stream (EventDataStream) – event data stream.

• event_tag (EventTag) – event tag.

Returns:

output field values per name.

Return type:

dict[str, str]

GetFormattedFieldNames()

Retrieves a string representation of the field names.

Returns:

string representation of the field names.

Return type:

str

SetAdditionalFields(field_names)

Sets the names of additional fields to output.

Parameters:

field_names (list[str]) – names of additional fields to output.

SetCustomFields(field_names_and_values)

Sets the names and values of custom fields to output.

Parameters:

field_names_and_values (list[tuple[str, str]]) – names and values of custom fields to output.

SetFieldDelimiter(field_delimiter)

Sets the field delimiter.

Parameters:

field_delimiter (str) – field delimiter.

SetFields(field_names)

Sets the names of the fields to output.

Parameters:

field_names (list[str]) – names of the fields to output.

__init__(field_formatting_helper, field_names, field_delimiter=',')

Initializes a delimiter separated values event formatting helper.

Parameters:

• field_formatting_helper (FieldFormattingHelper) – field formatting helper.

• field_names (list[str]) – names of the fields to output.

• field_delimiter (Optional[str]) – field delimiter.

class plaso.output.shared_dsv.DSVOutputModule(field_formatting_helper, names, delimiter=',', header=None)

Bases: SortedTextFileOutputModule

Shared functionality for delimiter separated values output modules.

SetAdditionalFields(field_names)

Sets the names of additional fields to output.

Parameters:

field_names (list[str]) – names of additional fields to output.

SetCustomFields(field_names_and_values)

Sets the names and values of custom fields to output.

Parameters:

field_names_and_values (list[tuple[str, str]]) – names and values of custom fields to output.

SetFieldDelimiter(field_delimiter)

Sets the field delimiter.

Parameters:

field_delimiter (str) – field delimiter.

SetFields(field_names)

Sets the names of the fields to output.

Parameters:

field_names (list[str]) – names of the fields to output.

WriteHeader(output_mediator)

Writes the header to the output.

Parameters:

output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

__init__(field_formatting_helper, names, delimiter=',', header=None)

Initializes a delimiter separated values output module.

Parameters:

• field_formatting_helper (FieldFormattingHelper) – field formatting helper.

• names (list[str]) – names of the fields to output.

• delimiter (Optional[str]) – field delimiter.

• header (Optional[str]) – header, where None will have WriteHeader generate a header from the field names.

plaso.output.shared_json module

Shared functionality for JSON based output modules.

class plaso.output.shared_json.JSONFieldFormattingHelper

Bases: FieldFormattingHelper

JSON output module field formatting helper.

GetFormattedField(output_mediator, field_name, event, event_data, event_data_stream, event_tag)

Formats the specified field.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• field_name (str) – name of the field.

• event (EventObject) – event.

• event_data (EventData) – event data.

• event_data_stream (EventDataStream) – event data stream.

• event_tag (EventTag) – event tag.

Returns:

value of the field or None if not available.

Return type:

object

class plaso.output.shared_json.SharedJSONOutputModule

Bases: TextFileOutputModule

Shared functionality for JSON based output modules.

GetFieldValues(output_mediator, event, event_data, event_data_stream, event_tag)

Retrieves the output field values.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• event (EventObject) – event.

• event_data (EventData) – event data.

• event_data_stream (EventDataStream) – event data stream.

• event_tag (EventTag) – event tag.

Returns:

output field values per name.

Return type:

dict[str, str]

abstract WriteFieldValues(output_mediator, field_values)

Writes field values to the output.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• field_values (dict[str, str]) – output field values per name.

__init__()

Initializes an output module.

plaso.output.shared_opensearch module

Shared functionality for OpenSearch output modules.

class plaso.output.shared_opensearch.SharedOpenSearchFieldFormattingHelper

Bases: FieldFormattingHelper

Shared OpenSearch output module field formatting helper.

GetFormattedField(output_mediator, field_name, event, event_data, event_data_stream, event_tag)

Formats the specified field.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• field_name (str) – name of the field.

• event (EventObject) – event.

• event_data (EventData) – event data.

• event_data_stream (EventDataStream) – event data stream.

• event_tag (EventTag) – event tag.

Returns:

value of the field or None if not set.

Return type:

object

class plaso.output.shared_opensearch.SharedOpenSearchOutputModule

Bases: OutputModule

Shared functionality for an OpenSearch output module.

Close()

Closes connection to OpenSearch.

Inserts any remaining buffered event documents.

GetFieldValues(output_mediator, event, event_data, event_data_stream, event_tag)

Retrieves the output field values.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• event (EventObject) – event.

• event_data (EventData) – event data.

• event_data_stream (EventDataStream) – event data stream.

• event_tag (EventTag) – event tag.

Returns:

output field values per name.

Return type:

dict[str, str]

NAME = 'opensearch_shared'

SUPPORTS_ADDITIONAL_FIELDS = True

SUPPORTS_CUSTOM_FIELDS = True

SetAdditionalFields(field_names)

Sets the names of additional fields to output.

Parameters:

field_names (list[str]) – names of additional fields to output.

SetCACertificatesPath(ca_certificates_path)

Sets the path to the CA certificates.

Parameters:

ca_certificates_path (str) – path to file containing a list of root certificates to trust.

Raises:

BadConfigOption – if the CA certificates file does not exist.

SetCustomFields(field_names_and_values)

Sets the names and values of custom fields to output.

Parameters:

field_names_and_values (list[tuple[str, str]]) – names and values of custom fields to output.

SetFlushInterval(flush_interval)

Sets the flush interval.

Parameters:

flush_interval (int) – number of events to buffer before doing a bulk insert.

SetIndexName(index_name)

Sets the index name.

Parameters:

index_name (str) – name of the index.

SetMappings(mappings)

Sets the mappings.

Parameters:

mappings (dict[str, object]) – mappings of the index.

SetPassword(password)

Sets the password.

Parameters:

password (str) – password to authenticate with.

SetServerInformation(server, port)

Sets the server information.

Parameters:

• server (str) – IP address or hostname of the server.

• port (int) – Port number of the server.

SetURLPrefix(url_prefix)

Sets the URL prefix.

Parameters:

url_prefix (str) – URL prefix.

SetUseSSL(use_ssl)

Sets the use of ssl.

Parameters:

use_ssl (bool) – enforces use of ssl.

SetUsername(username)

Sets the username.

Parameters:

username (str) – username to authenticate with.

__init__()

Initializes an output module.

plaso.output.text_file module

Shared functionality for text file based output modules.

class plaso.output.text_file.SortedStringHeap

Bases: object

Heap to sort output strings.

IsFull()

Determines if the heap is full.

Returns:

True if the heap is full.

Return type:

bool

PopString()

Pops a string from the heap.

Returns:

string.

Return type:

str

PopStrings()

Pops strings from the heap.

Yields:

str – string.

PushString(sort_key, string)

Pushes a string onto the heap.

Parameters:

• sort_key (str) – key for the sort order.

• string (str) – string.

__init__()

Initializes a heap.

class plaso.output.text_file.SortedTextFileOutputModule(event_formatting_helper)

Bases: TextFileOutputModule

Shared functionality of an output module that writes to a text file.

GetFieldValues(output_mediator, event, event_data, event_data_stream, event_tag)

Retrieves the output field values.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• event (EventObject) – event.

• event_data (EventData) – event data.

• event_data_stream (EventDataStream) – event data stream.

• event_tag (EventTag) – event tag.

Returns:

output field values per name.

Return type:

dict[str, str]

WriteFieldValues(output_mediator, field_values)

Writes field values to the output.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• field_values (dict[str, str]) – output field values per name.

WriteFooter()

Writes the footer to the output.

Can be used for post-processing or output after the last event is written, such as writing a file footer.

__init__(event_formatting_helper)

Initializes an output module that writes to a text file.

Parameters:

event_formatting_helper (EventFormattingHelper) – event formatting helper.

class plaso.output.text_file.TextFileOutputModule

Bases: OutputModule

Shared functionality of an output module that writes to a text file.

Close()

Closes the output file.

abstract GetFieldValues(output_mediator, event, event_data, event_data_stream, event_tag)

Retrieves the output field values.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• event (EventObject) – event.

• event_data (EventData) – event data.

• event_data_stream (EventDataStream) – event data stream.

• event_tag (EventTag) – event tag.

Returns:

output field values per name.

Return type:

dict[str, str]

Open(path=None, **kwargs)

Opens the output file.

Parameters:

path (Optional[str]) – path of the output file.

Raises:

• IOError – if the specified output file already exists.

• OSError – if the specified output file already exists.

• ValueError – if path is not set.

WRITES_OUTPUT_FILE = True

abstract WriteFieldValues(output_mediator, field_values)

Writes field values to the output.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• field_values (dict[str, str]) – output field values per name.

WriteLine(text)

Writes a line of text to the output file.

Parameters:

text (str) – text to output.

WriteText(text)

Writes text to the output file.

Parameters:

text (str) – text to output.

__init__()

Initializes an output module that writes to a text file.

plaso.output.tln module

Output module for the TLN format.

For documentation on the TLN format see:

https://forensics.wiki/tln

class plaso.output.tln.L2TTLNOutputModule

Bases: DSVOutputModule

Output module for the log2timeline extended variant of the TLN format.

l2tTLN is an extended variant of TLN introduced log2timeline.pl 0.65.

l2tTLN extends basic TLN to 7 | separated fields, namely: * Time - 32-bit POSIX (or Unix) epoch timestamp. * Source - The name of the parser or plugin that produced the event. * Host - The source host system. * User - The user associated with the data. * Description - Message string describing the data. * TZ - L2T 0.65 field. Timezone of the event. * Notes - L2T 0.65 field. Optional notes field or filename and inode.

DESCRIPTION = 'Extended TLN 7 field | delimited output.'

NAME = 'l2ttln'

__init__()

Initializes an output module.

class plaso.output.tln.TLNFieldFormattingHelper

Bases: FieldFormattingHelper

TLN output module field formatting helper.

class plaso.output.tln.TLNOutputModule

Bases: DSVOutputModule

Output module for the TLN format.

TLN defines 5 | separated fields, namely: * Time - 32-bit POSIX (or Unix) epoch timestamp. * Source - The name of the parser or plugin that produced the event. * Host - The source host system. * User - The user associated with the data. * Description - Message string describing the data.

DESCRIPTION = 'TLN 5 field | delimited output.'

NAME = 'tln'

__init__()

Initializes an output module.

plaso.output.winevt_rc module

Windows EventLog resources database reader.

class plaso.output.winevt_rc.Sqlite3DatabaseFile

Bases: object

Class that defines a sqlite3 database file.

Close()

Closes the database file.

Raises:

RuntimeError – if the database is not opened.

GetValues(table_names, column_names, condition)

Retrieves values from a table.

Parameters:

• table_names (list[str]) – table names.

• column_names (list[str]) – column names.

• condition (str) – query condition such as “log_source == ‘Application Error’”.

Yields:

sqlite3.row – row.

Raises:

RuntimeError – if the database is not opened.

HasTable(table_name)

Determines if a specific table exists.

Parameters:

table_name (str) – table name.

Returns:

True if the table exists.

Return type:

bool

Raises:

RuntimeError – if the database is not opened.

Open(filename, read_only=False)

Opens the database file.

Parameters:

• filename (str) – filename of the database.

• read_only (Optional[bool]) – True if the database should be opened in read-only mode. Since sqlite3 does not support a real read-only mode we fake it by only permitting SELECT queries.

Returns:

True if successful.

Return type:

bool

Raises:

RuntimeError – if the database is already opened.

__init__()

Initializes the database file object.

class plaso.output.winevt_rc.WinevtResourcesAttributeContainerStore(*args: Any, **kwargs: Any)

Bases: SQLiteAttributeContainerStore

Windows EventLog resources attribute container store.

format_version

storage format version.

Type:

int

serialization_format

serialization format.

Type:

str

string_format

string format.

Type:

str

__init__(string_format='wrc')

Initializes a message resource attribute container store.

Parameters:

string_format (Optional[str]) – string format. The default is the Windows Resource (wrc) format.

class plaso.output.winevt_rc.WinevtResourcesEventLogProvider(*args: Any, **kwargs: Any)

Bases: AttributeContainer

Windows Event Log provider.

additional_identifier

additional identifier of the provider, contains a GUID.

Type:

str

category_message_files

paths of the category message files.

Type:

set[str]

event_message_files

paths of the event message files.

Type:

set[str]

identifier

identifier of the provider, contains a GUID.

Type:

str

log_sources

names of the corresponding Event Log sources.

Type:

list[str]

log_types

Windows Event Log types.

Type:

list[str]

name

name of the provider.

Type:

str

parameter_message_files

paths of the parameter message files.

Type:

set[str]

windows_version

Windows version.

Type:

str

CONTAINER_TYPE = 'winevtrc_eventlog_provider'

SCHEMA = {'additional_identifier': 'str', 'category_message_files': 'List[str]', 'event_message_files': 'List[str]', 'identifier': 'str', 'log_sources': 'List[str]', 'log_types': 'List[str]', 'name': 'str', 'parameter_message_files': 'List[str]', 'windows_version': 'str'}

__init__()

Initializes the Windows Event Log provider.

class plaso.output.winevt_rc.WinevtResourcesHelper(storage_reader, data_location, lcid)

Bases: object

Windows EventLog resources helper.

DEFAULT_LCID = 1033

GetMessageString(provider_identifier, log_source, message_identifier, event_version)

Retrieves a specific Windows EventLog message string.

Parameters:

• provider_identifier (str) – EventLog provider identifier.

• log_source (str) – EventLog source, such as “Application Error”.

• message_identifier (int) – message identifier.

• event_version (int) – event version or None if not set.

Returns:

message string or None if not available.

Return type:

str

GetParameterString(provider_identifier, log_source, message_identifier)

Retrieves a specific Windows EventLog parameter string.

Parameters:

• provider_identifier (str) – EventLog provider identifier.

• log_source (str) – EventLog source, such as “Application Error”.

• message_identifier (int) – parameter identifier.

Returns:

parameter string or None if not available.

Return type:

str

__init__(storage_reader, data_location, lcid)

Initializes Windows EventLog resources helper.

Parameters:

• storage_reader (StorageReader) – storage reader.

• data_location (str) – data location of the winevt-rc database.

• lcid (int) – Windows Language Code Identifier (LCID).

class plaso.output.winevt_rc.WinevtResourcesMessageFile(*args: Any, **kwargs: Any)

Bases: AttributeContainer

Windows Event Log message file.

file_version

file version.

Type:

str

product_version

product version.

Type:

str

windows_path

path as defined by the Window Event Log provider.

Type:

str

windows_version

Windows version.

Type:

str

CONTAINER_TYPE = 'winevtrc_message_file'

SCHEMA = {'file_version': 'str', 'product_version': 'str', 'windows_path': 'str', 'windows_version': 'str'}

__init__(file_version=None, product_version=None, windows_path=None, windows_version=None)

Initializes a Windows Event Log message file.

Parameters:

• file_version (Optional[str]) – file version.

• product_version (Optional[str]) – product version.

• windows_path (Optional[str]) – path as defined by the Window Event Log provider.

• windows_version (Optional[str]) – Windows version.

class plaso.output.winevt_rc.WinevtResourcesMessageString(*args: Any, **kwargs: Any)

Bases: AttributeContainer

Windows Event Log message string.

identifier

message identifier.

Type:

int

text

message text.

Type:

str

CONTAINER_TYPE = 'winevtrc_message_string'

GetMessageTableIdentifier()

Retrieves the identifier of the associated message table.

Returns:

message table identifier or None when not

set.

Return type:

AttributeContainerIdentifier

SCHEMA = {'_message_table_identifier': 'AttributeContainerIdentifier', 'language_identifier': 'str', 'message_identifier': 'int', 'text': 'str'}

SetMessageTableIdentifier(message_table_identifier)

Sets the identifier of the associated message table.

Parameters:

message_table_identifier (AttributeContainerIdentifier) – message table identifier.

__init__(message_identifier=None, text=None)

Initializes a Windows Event Log message string.

Parameters:

• message_identifier (Optional[int]) – message identifier.

• text (Optional[int]) – message text.

class plaso.output.winevt_rc.WinevtResourcesMessageStringMapping(*args: Any, **kwargs: Any)

Bases: AttributeContainer

Windows Event Log message string mapping.

event_identifier

event identifier.

Type:

int

event_version

event version.

Type:

int

message_identifier

message identifier.

Type:

int

provider_identifier

Event Log provider identifier.

Type:

str

CONTAINER_TYPE = 'winevtrc_message_string_mapping'

GetMessageFileIdentifier()

Retrieves the identifier of the associated message file.

Returns:

message file identifier or None when

not set.

Return type:

AttributeContainerIdentifier

SCHEMA = {'_message_file_identifier': 'AttributeContainerIdentifier', 'event_identifier': 'int', 'event_version': 'int', 'message_identifier': 'int', 'provider_identifier': 'str'}

SetMessageFileIdentifier(message_file_identifier)

Sets the identifier of the associated message file.

Parameters:

message_file_identifier (AttributeContainerIdentifier) – message file identifier.

__init__(event_identifier=None, event_version=None, message_identifier=None, provider_identifier=None)

Initializes a Windows Event Log message string mapping.

Parameters:

• event_identifier (Optional[int]) – event identifier.

• event_version (Optional[int]) – event version.

• message_identifier (Optional[int]) – message identifier.

• provider_identifier (Optional[str]) – Event Log provider identifier.

class plaso.output.winevt_rc.WinevtResourcesMessageTable(*args: Any, **kwargs: Any)

Bases: AttributeContainer

Windows Event Log message table.

language_identifier

language identifier (LCID).

Type:

int

CONTAINER_TYPE = 'winevtrc_message_table'

GetMessageFileIdentifier()

Retrieves the identifier of the associated message file.

Returns:

message file identifier or None when not

set.

Return type:

AttributeContainerIdentifier

SCHEMA = {'_message_file_identifier': 'AttributeContainerIdentifier', 'language_identifier': 'int'}

SetMessageFileIdentifier(message_file_identifier)

Sets the identifier of the associated message file.

Parameters:

message_file_identifier (AttributeContainerIdentifier) – message file identifier.

__init__(language_identifier=None)

Initializes a Windows Event Log message table descriptor.

Parameters:

language_identifier (Optional[int]) – language identifier (LCID).

class plaso.output.winevt_rc.WinevtResourcesSqlite3DatabaseReader

Bases: object

Windows EventLog resources SQLite database reader.

Close()

Closes the database reader object.

GetMessage(log_source, lcid, message_identifier)

Retrieves a specific message for a specific EventLog source.

Parameters:

• log_source (str) – EventLog source, such as “Application Error”.

• lcid (int) – language code identifier (LCID).

• message_identifier (int) – message identifier.

Returns:

message string or None if not available.

Return type:

str

GetMetadataAttribute(attribute_name)

Retrieves the metadata attribute.

Parameters:

attribute_name (str) – name of the metadata attribute.

Returns:

the metadata attribute or None.

Return type:

str

Raises:

RuntimeError – if more than one value is found in the database.

Open(filename)

Opens the database reader object.

Parameters:

filename (str) – filename of the database.

Returns:

True if successful.

Return type:

bool

Raises:

RuntimeError – if the version or string format of the database is not supported.

__init__()

Initializes a Windows EventLog resources SQLite database reader.

plaso.output.xlsx module

Output module for the Excel Spreadsheet (XLSX) output format.

class plaso.output.xlsx.XLSXOutputModule

Bases: OutputModule

Output module for the Excel Spreadsheet (XLSX) output format.

Close()

Closes the workbook.

DESCRIPTION = 'Excel Spreadsheet (XLSX) output'

GetFieldValues(output_mediator, event, event_data, event_data_stream, event_tag)

Retrieves the output field values.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• event (EventObject) – event.

• event_data (EventData) – event data.

• event_data_stream (EventDataStream) – event data stream.

• event_tag (EventTag) – event tag.

Returns:

output field values per name.

Return type:

dict[str, str]

NAME = 'xlsx'

Open(path=None, **kwargs)

Creates a new workbook.

Parameters:

path (Optional[str]) – path of the output file.

Raises:

• IOError – if the specified output file already exists.

• OSError – if the specified output file already exists.

• ValueError – if path is not set.

SUPPORTS_ADDITIONAL_FIELDS = True

SUPPORTS_CUSTOM_FIELDS = True

SetAdditionalFields(field_names)

Sets the names of additional fields to output.

Parameters:

field_names (list[str]) – names of additional fields to output.

SetCustomFields(field_names_and_values)

Sets the names and values of custom fields to output.

Parameters:

field_names_and_values (list[tuple[str, str]]) – names and values of custom fields to output.

SetFields(field_names)

Sets the names of the fields to output.

Parameters:

field_names (list[str]) – names of the fields to output.

SetTimestampFormat(timestamp_format)

Set the timestamp format to use for the datetime column.

Parameters:

timestamp_format (str) – format string of date and time values.

WRITES_OUTPUT_FILE = True

WriteFieldValues(output_mediator, field_values)

Writes field values to the output.

Parameters:

• output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

• field_values (dict[str, str]) – output field values per name.

WriteHeader(output_mediator)

Writes the header to the spreadsheet.

Parameters:

output_mediator (OutputMediator) – mediates interactions between output modules and other components, such as storage and dfVFS.

__init__()

Initializes an output module.

Module contents

This file imports Python modules that register output modules.