plaso.parsers.jsonl_plugins package

Submodules

plaso.parsers.jsonl_plugins.aws_cloudtrail_log module

JSON-L parser plugin for AWS CloudTrail log files.

class plaso.parsers.jsonl_plugins.aws_cloudtrail_log.AWSCloudTrailEventData(*args: Any, **kwargs: Any)

Bases: EventData

AWS CloudTrail log event data.

access_key

access key identifier.

Type:

str

account_identifier

AWS account identifier.

Type:

str

cloud_trail_event

CloudTrail event.

Type:

str

event_name

event name.

Type:

str

event_source

AWS service.

Type:

str

recorded_time

date and time the log entry was recorded.

Type:

dfdatetime.DateTimeValues

resources

resources.

Type:

str

source_ip

source IP address.

Type:

str

user_identity_arn

AWS ARN of the user.

Type:

str

user_name

name of the AWS user.

Type:

str

DATA_TYPE = 'aws:cloudtrail:entry'

__init__()

Initializes event data.

class plaso.parsers.jsonl_plugins.aws_cloudtrail_log.AWSCloudTrailLogJSONLPlugin

Bases: JSONLPlugin

JSON-L parser plugin for AWS CloudTrail log files.

CheckRequiredFormat(json_dict)

Check if the log record has the minimal structure required by the plugin.

Parameters:

json_dict (dict) – JSON dictionary of the log record.

Returns:

True if this is the correct parser, False otherwise.

Return type:

bool

DATA_FORMAT = 'AWS CloudTrail Log'

NAME = 'aws_cloudtrail_log'

plaso.parsers.jsonl_plugins.azure_activity_log module

JSON-L parser plugin for Azure activity log files.

class plaso.parsers.jsonl_plugins.azure_activity_log.AzureActivityLogEventData(*args: Any, **kwargs: Any)

Bases: EventData

Azure activity log event data.

caller

Azure identity.

Type:

str

client_ip

client IP address.

Type:

str

correlation_identifier

Correlation identifier.

Type:

str

event_data_identifier

Event data identifier.

Type:

str

event_name

name of the event.

Type:

str

level

log level.

Type:

str

operation_identifier

Operation identifier.

Type:

str

operation_name

operation name.

Type:

str

recorded_time

date and time the log entry was recorded.

Type:

dfdatetime.DateTimeValues

resource_group

resource group.

Type:

str

resource_identifier

resource.

Type:

str

resource_provider

API service.

Type:

str

resource_type

resource type.

Type:

str

subscription_identifier

subscription identifier.

Type:

str

tenant_identifier

tenant identifier.

Type:

str

DATA_TYPE = 'azure:activitylog:entry'

__init__()

Initializes event data.

class plaso.parsers.jsonl_plugins.azure_activity_log.AzureActivityLogJSONLPlugin

Bases: JSONLPlugin

JSON-L parser plugin for Azure activity log files.

CheckRequiredFormat(json_dict)

Check if the log record has the minimal structure required by the plugin.

Parameters:

json_dict (dict) – JSON dictionary of the log record.

Returns:

True if this is the correct parser, False otherwise.

Return type:

bool

DATA_FORMAT = 'Azure Activity Log'

NAME = 'azure_activity_log'

plaso.parsers.jsonl_plugins.azure_application_gateway_log module

JSON-L parser plugin for Azure application gateway access log files.

class plaso.parsers.jsonl_plugins.azure_application_gateway_log.AzureApplicationGatewayAccessEventData(*args: Any, **kwargs: Any)

Bases: EventData

Azure application gateway access log event data.

client_ip

Client IP address of the request.

Type:

str

client_port

Client TCP/UDP port for the request.

Type:

int

client_response_time

Duration, in seconds, from the first byte of a client request to be processed up to the first byte sent as response to the client.

Type:

int

host

Address listed in the host header of the request. If rewritten using header rewrite, contains the updated host name.

Type:

str

http_method

HTTP method used by the request.

Type:

str

http_status

HTTP status code returned to the client from application gateway.

Type:

int

http_version

HTTP version of the request.

Type:

str

instance_identifier

Application gateway instance that served the request.

Type:

str

original_host

Original request host name.

Type:

str

original_request_uri

Original request URL, including arguments.

Type:

str

received_bytes

Size of packet received, in bytes.

Type:

int

recorded_time

date and time the log entry was recorded.

Type:

dfdatetime.DateTimeValues

request_query

Server-Routed: Back-end pool instance that was sent the request. X-AzureApplicationGateway-LOG-ID: Correlation ID used for the request. It can be used to troubleshoot traffic issues on the back-end servers. SERVER-STATUS: HTTP response code that application gateway received from the back-end.

Type:

str

request_uri

URI of the received request.

Type:

str

sent_bytes

Size of packet sent, in bytes.

Type:

int

server_response_latency

Latency of the response (in seconds) from the back-end server.

Type:

str

server_routed

The back-end server that application gateway routes the request to.

Type:

str

server_status

HTTP status code of the back-end server.

Type:

str

ssl_cipher

Cipher suite being used for TLS communication.

Type:

str

ssl_client_certificate_fingerprint

Fingerprint of the SSL client certificate.

Type:

str

ssl_client_certificate_issuer_name

Name of the issuer of the SSL client certificate.

Type:

str

ssl_client_verify

TODO.

Type:

str

ssl_enabled

Whether communication to the back-end pools used TLS. Valid values are on and off.

Type:

str

ssl_protocol

The SSL/TLS protocol used.

Type:

str

time_taken

Duration, in seconds, that it takes for the first byte of a client request to be processed and its last-byte sent in the response to the client. It’s important to note that the Time-Taken field usually includes the time that the request and response packets are traveling over the network.

Type:

double

transaction_id

Unique identifier to correlate the request received from the client

Type:

str

user_agent

User agent from the HTTP request header.

Type:

str

waf_evaluation_time

Duration, in seconds, that it takes for the request to be processed by the WAF.

Type:

str

waf_mode

Value can be either Detection or Prevention.

Type:

str

DATA_TYPE = 'azure:application_gateway_access:entry'

__init__()

Initializes event data.

class plaso.parsers.jsonl_plugins.azure_application_gateway_log.AzureApplicationGatewayAccessLogJSONLPlugin

Bases: JSONLPlugin

JSON-L parser plugin for Azure application gateway access log files.

CheckRequiredFormat(json_dict)

Check if the log record has the minimal structure required by the plugin.

Parameters:

json_dict (dict) – JSON dictionary of the log record.

Returns:

True if this is the correct parser, False otherwise.

Return type:

bool

DATA_FORMAT = 'Azure Application Gateway access log'

NAME = 'azure_application_gateway_access_log'

plaso.parsers.jsonl_plugins.docker_container_config module

JSON-L parser plugin for Docker container configuration files.

class plaso.parsers.jsonl_plugins.docker_container_config.DockerContainerConfigurationEventData(*args: Any, **kwargs: Any)

Bases: EventData

Docker container configuration event data.

action

whether the container was created, started, or finished.

Type:

str

container_identifier

identifier of the container (SHA256).

Type:

str

container_name

name of the container.

Type:

str

creation_time

date and time the container was created (added).

Type:

dfdatetime.DateTimeValues

end_time

date and time the container was stopped.

Type:

dfdatetime.DateTimeValues

start_time

date and time the container was started.

Type:

dfdatetime.DateTimeValues

DATA_TYPE = 'docker:container:configuration'

__init__()

Initializes event data.

class plaso.parsers.jsonl_plugins.docker_container_config.DockerContainerConfigurationJSONLPlugin

Bases: JSONLPlugin

JSON-L parser plugin for Docker container configuration files.

This parser handles per Docker container configuration files stored in: DOCKER_DIR/containers/<container_identifier>/config.json

CheckRequiredFormat(json_dict)

Check if the record has the minimal structure required by the plugin.

Parameters:

json_dict (dict) – JSON dictionary of the configuration record.

Returns:

True if this is the correct parser, False otherwise.

Return type:

bool

DATA_FORMAT = 'Docker container configuration file'

NAME = 'docker_container_config'

plaso.parsers.jsonl_plugins.docker_container_log module

JSON-L parser plugin for Docker container log files.

class plaso.parsers.jsonl_plugins.docker_container_log.DockerContainerLogEventData(*args: Any, **kwargs: Any)

Bases: EventData

Docker container log event data.

container_identifier

identifier of the container (SHA256).

Type:

str

log_line

log line.

Type:

str

log_source

log source.

Type:

str

written_time

date and time the entry was written.

Type:

dfdatetime.DateTimeValues

DATA_TYPE = 'docker:container:log:entry'

__init__()

Initializes event data.

class plaso.parsers.jsonl_plugins.docker_container_log.DockerContainerLogJSONLPlugin

Bases: JSONLPlugin

JSON-L parser plugin for Docker container log files.

This parser handles per Docker container log files stored in: DOCKER_DIR/containers/<container_identifier>/<container_identifier>-json.log

CheckRequiredFormat(json_dict)

Check if the log record has the minimal structure required by the plugin.

Parameters:

json_dict (dict) – JSON dictionary of the log record.

Returns:

True if this is the correct parser, False otherwise.

Return type:

bool

DATA_FORMAT = 'Docker container log file'

NAME = 'docker_container_log'

__init__()

Initializes a JSON-L parser plugin.

plaso.parsers.jsonl_plugins.docker_layer_config module

JSON-L parser plugin for Docker layer configuration files.

class plaso.parsers.jsonl_plugins.docker_layer_config.DockerLayerConfigurationEventData(*args: Any, **kwargs: Any)

Bases: EventData

Docker layer configuration event data.

command

the command used which made Docker create a new layer.

creation_time

date and time the layer was created (added).

Type:

dfdatetime.DateTimeValues

layer_identifier

the identifier of the current Docker layer (SHA-1).

DATA_TYPE = 'docker:layer:configuration'

__init__()

Initializes event data.

class plaso.parsers.jsonl_plugins.docker_layer_config.DockerLayerConfigurationJSONLPlugin

Bases: JSONLPlugin

JSON-L parser plugin for Docker layer configuration files.

This parser handles per Docker layer configuration files stored in: DOCKER_DIR/graph/<layer_identifier>/json

CheckRequiredFormat(json_dict)

Check if the record has the minimal structure required by the plugin.

Parameters:

json_dict (dict) – JSON dictionary of the configuration record.

Returns:

True if this is the correct parser, False otherwise.

Return type:

bool

DATA_FORMAT = 'Docker layer configuration file'

NAME = 'docker_layer_config'

plaso.parsers.jsonl_plugins.gcp_log module

JSON-L parser plugin for Google Cloud (GCP) log files.

class plaso.parsers.jsonl_plugins.gcp_log.GCPLogEventData(*args: Any, **kwargs: Any)

Bases: EventData

Google Cloud (GCP) log event data.

container

TODO

Type:

str

event_subtype

JSON event sub type or protocol buffer method.

Type:

str

event_type

TODO

Type:

str

filename

TODO

Type:

str

firewall_rules

firewall rules.

Type:

list[str]

firewall_source_ranges

firewall source ranges.

Type:

list[str]

log_name

name of the log entry.

Type:

str

message

TODO

Type:

str

policy_deltas

TODO

Type:

list[str]

recorded_time

date and time the log entry was recorded.

Type:

dfdatetime.DateTimeValues

request_account_identifier

GCP account identifier of the request.

Type:

str

request_description

description of the request.

Type:

str

request_direction

direction of the request.

Type:

str

request_email

email address of the request.

Type:

str

request_member

member of the request.

Type:

str

request_metadata

request metadata values.

Type:

list[str]

request_name

name of the request.

Type:

str

request_target_tags

TODO

Type:

str

resource_labels

resource labels.

Type:

list[str]

resource_name

name of the resource.

Type:

str

service_account_display_name

display name of the service account.

Type:

str

service_name

name of the servie.

Type:

str

severity

log entry severity.

Type:

str

text_payload

text payload for logs not using a JSON or proto payload.

Type:

str

user

user principal performing the logged action.

Type:

str

DATA_TYPE = 'gcp:log:entry'

__init__()

Initializes event data.

class plaso.parsers.jsonl_plugins.gcp_log.GCPLogJSONLPlugin

Bases: JSONLPlugin

JSON-L parser plugin for Google Cloud (GCP) log files.

CheckRequiredFormat(json_dict)

Check if the log record has the minimal structure required by the plugin.

Parameters:

json_dict (dict) – JSON dictionary of the log record.

Returns:

True if this is the correct parser, False otherwise.

Return type:

bool

DATA_FORMAT = 'Google Cloud (GCP) log'

NAME = 'gcp_log'

plaso.parsers.jsonl_plugins.interface module

Interface for JSON-L parser plugins.

class plaso.parsers.jsonl_plugins.interface.JSONLPlugin

Bases: BasePlugin

This is an abstract class from which plugins should be based.

The following are the attributes and methods expected to be overridden by a JSON-L parser plugin.

abstract CheckRequiredFormat(json_dict)

Check if the log record has the minimal structure required by the plugin.

Parameters:

json_dict (dict) – JSON dictionary of the log record.

Returns:

True if this is the correct parser, False otherwise.

Return type:

bool

NAME = 'jsonl_plugin'

Process(parser_mediator, file_object=None, **kwargs)

Extracts events from a JSON-L log file.

Parameters:

• parser_mediator (ParserMediator) – mediates interactions between parsers and other components, such as storage and dfVFS.

• file_object (Optional[dfvfs.FileIO]) – a file-like object.

plaso.parsers.jsonl_plugins.ios_app_privacy module

JSON-L parser plugin for iOS application privacy report files.

class plaso.parsers.jsonl_plugins.ios_app_privacy.IOSAppPrivacPlugin

Bases: JSONLPlugin

JSON-L parser plugin for iOS application privacy report files.

CheckRequiredFormat(json_dict)

Check if the log record has the minimal structure required by the plugin.

Parameters:

json_dict (dict) – JSON dictionary of the log record.

Returns:

True if this is the correct parser, False otherwise.

Return type:

bool

DATA_FORMAT = 'iOS Application Privacy report'

NAME = 'ios_application_privacy'

class plaso.parsers.jsonl_plugins.ios_app_privacy.IOSAppPrivacyAccessEvent(*args: Any, **kwargs: Any)

Bases: EventData

iOS application privacy report event of type access.

accessor_identifier

identifier of process accessing the resource

Type:

str

accessor_identifier_type

type of identifier

Type:

str

recorded_time

date and time the log entry was recorded.

Type:

dfdatetime.DateTimeValues

resource_category

category of the accessed resource

Type:

str

resource_identifier

GUID of the resource being accessed

Type:

str

DATA_TYPE = 'ios:app_privacy:access'

__init__()

Initializes event data.

class plaso.parsers.jsonl_plugins.ios_app_privacy.IOSAppPrivacyNetworkEvent(*args: Any, **kwargs: Any)

Bases: EventData

iOS application privacy report event of type network activity.

bundle_identifier

bundle identifier that accesssed the resource

Type:

str

domain

domain name accessed

Type:

str

recorded_time

date and time the log entry was recorded.

Type:

dfdatetime.DateTimeValues

DATA_TYPE = 'ios:app_privacy:network'

__init__()

Initializes event data.

plaso.parsers.jsonl_plugins.microsoft365_audit_log module

JSON-L parser plugin for Microsoft (Office) 365 audit log files.

class plaso.parsers.jsonl_plugins.microsoft365_audit_log.Microsoft365AuditLogEventData(*args: Any, **kwargs: Any)

Bases: EventData

Microsoft (Office) 365 audit log event data.

audit_record_identifier

audit record identifier.

Type:

str

application_access_context

application access context

Type:

str

client_ip

client IP address.

Type:

str

object_identifier

object identifier

Type:

str

operation_name

operation name.

Type:

str

organization_identifier

organization identifier.

Type:

str

record_type

record type.

Type:

int

recorded_time

date and time the log entry was recorded.

Type:

dfdatetime.DateTimeValues

result_status

result status

Type:

str

scope

scope.

Type:

str

user_identifier

user identifier

Type:

str

user_key

user key.

Type:

str

user_type

user type.

Type:

int

workload

Microsoft (Office) 365 service

Type:

str

DATA_TYPE = 'microsoft365:audit_log:entry'

__init__()

Initializes event data.

class plaso.parsers.jsonl_plugins.microsoft365_audit_log.Microsoft365AuditLogJSONLPlugin

Bases: JSONLPlugin

JSON-L parser plugin for Microsoft (Office) 365 audit log files.

CheckRequiredFormat(json_dict)

Check if the log record has the minimal structure required by the plugin.

Parameters:

json_dict (dict) – JSON dictionary of the log record

Returns:

True if this is the correct parsers, False otherwise.

Return type:

bool

DATA_FORMAT = 'Microsoft (Office) 365 audit log'

NAME = 'microsoft_audit_log'

Module contents

Imports for the JSON-L parser plugins.