Skip to content

Instantly share code, notes, and snippets.

@armbues
Created July 8, 2015 15:45
Show Gist options
  • Save armbues/a3863fdadffb8b8c8cde to your computer and use it in GitHub Desktop.
Save armbues/a3863fdadffb8b8c8cde to your computer and use it in GitHub Desktop.
Example of importing ioc-parser as a module and using a custom output handler
#!/usr/bin/env python
import argparse
import iocp
import output
class MyOutputHandler(output.OutputHandler):
def print_match(self, fpath, page, name, match):
obj = {}
obj['fpath'] = fpath
obj['page'] = page
obj['name'] = name
obj['match'] = match
print obj
if __name__ == "__main__":
argparser = argparse.ArgumentParser()
argparser.add_argument('PATH', action='store', help='File/directory/URL to report(s)')
argparser.add_argument('-p', dest='INI', default=None, help='Pattern file')
argparser.add_argument('-i', dest='INPUT_FORMAT', default='pdf', help='Input format (pdf/txt)')
argparser.add_argument('-o', dest='OUTPUT_FORMAT', default='csv', help='Output format (csv/json/yara)')
argparser.add_argument('-d', dest='DEDUP', action='store_true', default=False, help='Deduplicate matches')
argparser.add_argument('-l', dest='LIB', default='pdfminer', help='PDF parsing library (pypdf2/pdfminer)')
args = argparser.parse_args()
handler = MyOutputHandler()
parser = iocp.IOC_Parser(args.INI, args.INPUT_FORMAT, args.DEDUP, args.LIB, args.OUTPUT_FORMAT, output_handler=handler)
parser.parse(args.PATH)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment