plaso.storage package
Subpackages
- plaso.storage.fake package
- plaso.storage.redis package
- Submodules
- plaso.storage.redis.reader module
- plaso.storage.redis.redis_store module
BaseRedisAttributeContainerStore
BaseRedisAttributeContainerStore.format_version
BaseRedisAttributeContainerStore.serialization_format
BaseRedisAttributeContainerStore.Close()
BaseRedisAttributeContainerStore.DEFAULT_REDIS_URL
BaseRedisAttributeContainerStore.GetAttributeContainerByIdentifier()
BaseRedisAttributeContainerStore.GetAttributeContainerByIndex()
BaseRedisAttributeContainerStore.GetAttributeContainers()
BaseRedisAttributeContainerStore.GetNumberOfAttributeContainers()
BaseRedisAttributeContainerStore.HasAttributeContainers()
BaseRedisAttributeContainerStore.Open()
BaseRedisAttributeContainerStore.__init__()
RedisAttributeContainerStore
- plaso.storage.redis.writer module
- Module contents
- plaso.storage.sqlite package
Submodules
plaso.storage.factory module
This file contains the storage factory class.
- class plaso.storage.factory.StorageFactory[source]
Bases:
object
Storage factory.
- classmethod CreateStorageFile(storage_format)[source]
Creates a storage file.
- Parameters:
storage_format (str) – storage format.
- Returns:
- a storage file or None if the storage file cannot be
opened or the storage format is not supported.
- Return type:
StorageFile
- classmethod CreateStorageReaderForFile(path)[source]
Creates a storage reader based on the file.
- Parameters:
path (str) – path to the storage file.
- Returns:
- a storage reader or None if the storage file cannot be
opened or the storage format is not supported.
- Return type:
- classmethod CreateStorageWriter(storage_format)[source]
Creates a storage writer.
- Parameters:
storage_format (str) – storage format.
- Returns:
- a storage writer or None if the storage file cannot be
opened or the storage format is not supported.
- Return type:
- classmethod CreateStorageWriterForFile(path)[source]
Creates a storage writer based on the file.
- Parameters:
path (str) – path to the storage file.
- Returns:
- a storage writer or None if the storage file cannot be
opened or the storage format is not supported.
- Return type:
- classmethod CreateTaskStorageReader(storage_format, task, path)[source]
Creates a task storage reader.
- Parameters:
storage_format (str) – storage format.
task (Task) – task the storage changes are part of.
path (str) – path to the storage file.
- Returns:
- a storage reader or None if the storage file cannot be
opened or the storage format is not supported.
- Return type:
plaso.storage.logger module
The storage sub module logger.
plaso.storage.reader module
The storage reader.
- class plaso.storage.reader.StorageReader[source]
Bases:
object
Storage reader interface.
- GetAttributeContainerByIdentifier(container_type, identifier)[source]
Retrieves a specific type of container with a specific identifier.
- Parameters:
container_type (str) – container type.
identifier (AttributeContainerIdentifier) – attribute container identifier.
- Returns:
attribute container or None if not available.
- Return type:
AttributeContainer
- GetAttributeContainerByIndex(container_type, index)[source]
Retrieves a specific attribute container.
- Parameters:
container_type (str) – attribute container type.
index (int) – attribute container index.
- Returns:
attribute container or None if not available.
- Return type:
AttributeContainer
- GetAttributeContainers(container_type, filter_expression=None)[source]
Retrieves a specific type of attribute containers.
- Parameters:
container_type (str) – attribute container type.
filter_expression (Optional[str]) – expression to filter the resulting attribute containers by.
- Returns:
attribute container generator.
- Return type:
generator(AttributeContainers)
- GetEventTagByEventIdentifer(event_identifier)[source]
Retrieves the event tag of a specific event.
- Parameters:
event_identifier (AttributeContainerIdentifier) – event attribute container identifier.
- Returns:
event tag or None if the event has no event tag.
- Return type:
- GetFormatVersion()[source]
Retrieves the format version of the underlying storage file.
- Returns:
the format version.
- Return type:
int
- GetNumberOfAttributeContainers(container_type)[source]
Retrieves the number of a specific type of attribute containers.
- Parameters:
container_type (str) – attribute container type.
- Returns:
the number of containers of a specified type.
- Return type:
int
- GetSerializationFormat()[source]
Retrieves the serialization format of the underlying storage file.
- Returns:
the serialization format.
- Return type:
str
- GetSortedEvents(time_range=None)[source]
Retrieves the events in increasing chronological order.
This includes all events written to the storage including those pending being flushed (written) to the storage.
- Parameters:
time_range (Optional[TimeRange]) – time range used to filter events that fall in a specific period.
- Returns:
event generator.
- Return type:
generator(EventObject)
- HasAttributeContainers(container_type)[source]
Determines if a store contains a specific type of attribute container.
- Parameters:
container_type (str) – attribute container type.
- Returns:
- True if the store contains the specified type of attribute
containers.
- Return type:
bool
- SetSerializersProfiler(serializers_profiler)[source]
Sets the serializers profiler.
- Parameters:
serializers_profiler (SerializersProfiler) – serializers profiler.
- SetStorageProfiler(storage_profiler)[source]
Sets the storage profiler.
- Parameters:
storage_profiler (StorageProfiler) – storage profiler.
plaso.storage.serializers module
This file contains the attribute container store serializers.
- class plaso.storage.serializers.JSONDateTimeAttributeSerializer(*args: Any, **kwargs: Any)[source]
Bases:
AttributeSerializer
JSON date time values attribute serializer.
- class plaso.storage.serializers.JSONPathSpecAttributeSerializer(*args: Any, **kwargs: Any)[source]
Bases:
AttributeSerializer
JSON path specification attribute serializer.
- class plaso.storage.serializers.JSONValueListAttributeSerializer(*args: Any, **kwargs: Any)[source]
Bases:
AttributeSerializer
JSON value list attribute serializer.
plaso.storage.time_range module
Storage time range objects.
- class plaso.storage.time_range.TimeRange(start_timestamp, end_timestamp)[source]
Bases:
object
Date and time range.
The timestamp are integers containing the number of microseconds since January 1, 1970, 00:00:00 UTC.
- duration
duration of the range in microseconds.
- Type:
int
- end_timestamp
timestamp that marks the end of the range.
- Type:
int
- start_timestamp
timestamp that marks the start of the range.
- Type:
int
- __init__(start_timestamp, end_timestamp)[source]
Initializes a date and time range.
The timestamp are integers containing the number of microseconds since January 1, 1970, 00:00:00 UTC.
- Parameters:
start_timestamp (int) – timestamp that marks the start of the range.
end_timestamp (int) – timestamp that marks the end of the range.
- Raises:
ValueError – If the time range is badly formed.
plaso.storage.writer module
The storage writer.
- class plaso.storage.writer.StorageWriter(storage_type='session')[source]
Bases:
StorageReader
Storage writer interface.
- AddAttributeContainer(container)[source]
Adds an attribute container.
- Parameters:
container (AttributeContainer) – attribute container.
- Raises:
IOError – when the storage writer is closed.
OSError – when the storage writer is closed.
- AddOrUpdateEventTag(event_tag)[source]
Adds a new or updates an existing event tag.
- Parameters:
event_tag (EventTag) – event tag.
- Raises:
IOError – when the storage writer is closed.
OSError – when the storage writer is closed.
- Close()[source]
Closes the storage writer.
- Raises:
IOError – when the storage writer is closed.
OSError – when the storage writer is closed.
- abstract GetFirstWrittenEventData()[source]
Retrieves the first event data that was written after open.
Using GetFirstWrittenEventData and GetNextWrittenEventData newly added event data can be retrieved in order of addition.
- Returns:
event data or None if there are no newly written ones.
- Return type:
- abstract GetFirstWrittenEventSource()[source]
Retrieves the first event source that was written after open.
Using GetFirstWrittenEventSource and GetNextWrittenEventSource newly added event sources can be retrieved in order of addition.
- Returns:
event source or None if there are no newly written ones.
- Return type:
- abstract GetNextWrittenEventData()[source]
Retrieves the next event data that was written after open.
- Returns:
event data or None if there are no newly written ones.
- Return type:
- abstract GetNextWrittenEventSource()[source]
Retrieves the next event source that was written after open.
- Returns:
event source or None if there are no newly written ones.
- Return type: