PySpark Plaso
Release 2019
A tool for distributed extraction of timestamps from various files using extractors adapted from the Plaso engine to Apache Spark.
|
Public Member Functions | |
def | get_name (cls) |
def | get_description (cls) |
def | filter (cls, path) |
def | extract (cls, path) |
Serve as a dummy extractor for its sub-classes.
def plaso.tarzan.app.extractors.extractor.Extractor.extract | ( | cls, | |
path | |||
) |
Extract events from a file given by its HDFS path. :param path: the HDFS path of the file :return: the list of events
Reimplemented in plaso.tarzan.app.extractors.winreg.WinReg, plaso.tarzan.app.extractors.pe.PE, and plaso.tarzan.app.extractors.sqlite.SQLite.
def plaso.tarzan.app.extractors.extractor.Extractor.filter | ( | cls, | |
path | |||
) |
Check if a file given by its HDFS path can be processed by this extractor. :param path: the HDFS path of the file :return: true iff the file can be processed
Reimplemented in plaso.tarzan.app.extractors.pe.PE, plaso.tarzan.app.extractors.sqlite.SQLite, and plaso.tarzan.app.extractors.winreg.WinReg.
def plaso.tarzan.app.extractors.extractor.Extractor.get_description | ( | cls | ) |
Get a description of the extractor. :return: the description of the extractor
def plaso.tarzan.app.extractors.extractor.Extractor.get_name | ( | cls | ) |
Get a name of the extractor. :return: the name of the extractor