Left: | ||
Right: |
OLD | NEW |
---|---|
(Empty) | |
1 # -*- coding: utf-8 -*- | |
2 """The Trend Micro AV Logs file event formatter.""" | |
3 | |
4 from __future__ import unicode_literals | |
5 | |
6 from plaso.formatters import interface | |
7 from plaso.formatters import manager | |
8 | |
9 | |
10 SCAN_RESULTS = { | |
11 0: "Success (clean)", | |
12 1: "Success (move)", | |
13 2: "Success (delete)", | |
14 3: "Success (rename)", | |
15 4: "Pass > Deny access", | |
16 5: "Failure (clean)", | |
17 6: "Failure (move)", | |
18 7: "Failure (delete)", | |
19 8: "Failure (rename)", | |
20 10: "Failure (clean), moved", | |
21 11: "Failure (clean), deleted", | |
22 12: "Failure (clean), renamed", | |
23 13: "Pass > Deny access", | |
24 14: "Failure (clean), move also failed", | |
25 15: "Failure (clean), delete also failed", | |
26 16: "Failure (clean), rename also failed", | |
27 25: "Passed a potential security risk" | |
28 } | |
29 | |
30 SCAN_TYPES = { | |
31 0: "Manual scan", | |
32 1: "Real-time scan", | |
33 2: "Scheduled scan", | |
34 3: "Scan Now scan", | |
35 4: "DCS scan" | |
36 } | |
37 | |
38 | |
39 class OfficeScanVirusDetectionLogEventFormatter( | |
40 interface.ConditionalEventFormatter): | |
41 """Formatter for a Trend Micro Office Scan Virus Detection Log event.""" | |
42 | |
43 DATA_TYPE = 'av:trendmicro:scan' | |
44 | |
45 FORMAT_STRING_PIECES = [ | |
46 'Path: {path}', | |
47 'File name: {filename}', | |
48 '{threat}', | |
49 ': {action}', | |
50 '({scan_type})'] | |
51 | |
52 FORMAT_STRING_SHORT_PIECES = [ | |
53 '{path}', | |
54 '{filename}', | |
55 '{action}'] | |
56 | |
57 SOURCE_LONG = 'Trend Micro Office Scan Virus Detection Log' | |
58 SOURCE_SHORT = 'LOG' | |
59 | |
60 # VALUE_FORMATTERS contains formatting functions for event values that are | |
61 # not ready for human consumption. | |
62 # These functions replace the integer codes for scan types and scan results | |
63 # (a.k.a. actions) with human-readable strings. | |
64 VALUE_FORMATTERS = { | |
65 'scan_type': lambda scan_type: SCAN_TYPES[scan_type], | |
66 'action': lambda action: SCAN_RESULTS[action], | |
67 } | |
68 | |
69 def _ConditionalFormatMessages(self, event_values): | |
onager
2018/03/08 14:46:21
Rather than overriding _ConditionalFormatMessages,
ep
2018/03/08 15:01:53
Done.
| |
70 """Determines the formatted message strings. | |
71 | |
72 If any event values have a matching formatting function in | |
73 VALUE_FORMATTERS, they are run through that function; then the | |
74 dictionary is passed to the superclass's formatting method. | |
75 | |
76 Args: | |
77 event_values: a dictionary object containing the event (object) values. | |
78 | |
79 Returns: | |
80 tuple(str, str): formatted message string and short message string. | |
81 """ | |
82 for formattable_value_name, formatter in self.VALUE_FORMATTERS.items(): | |
83 if formattable_value_name in event_values: | |
84 value = event_values[formattable_value_name] | |
85 event_values[formattable_value_name] = formatter(value) | |
86 | |
87 return super(OfficeScanVirusDetectionLogEventFormatter, self | |
88 )._ConditionalFormatMessages(event_values) | |
89 | |
90 | |
91 manager.FormattersManager.RegisterFormatter( | |
92 OfficeScanVirusDetectionLogEventFormatter) | |
OLD | NEW |