Skip to content

Instantly share code, notes, and snippets.

@berggren
Last active November 7, 2018 10:06
Show Gist options
  • Save berggren/1a1f8966512c4c03a49e2d7073b74d6a to your computer and use it in GitHub Desktop.
Save berggren/1a1f8966512c4c03a49e2d7073b74d6a to your computer and use it in GitHub Desktop.
Example sketch analyzer for Timesketch
"""TheSketchAnalyzer."""
from __future__ import unicode_literals
from timesketch.lib.analyzers import interface
from timesketch.lib.analyzers import manager
class TheSketchAnalyzer(interface.BaseSketchAnalyzer):
"""The Sketch Analyzer."""
NAME = 'TheSketchAnalyzer'
def __init__(self, sketch_id, index_name):
"""Initialize The Sketch Analyzer.
Args:
sketch_id: Sketch ID
index_name: Elasticsearch index name
"""
self.index_name = index_name
super(TheSketchAnalyzer, self).__init__(sketch_id, index_name)
def run(self):
"""Entry point for the analyzer.
Returns:
String with summary of the analyzer result
"""
# TODO: Add Elasticsearch query to get the events you need.
# Documentation: https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html
query = ''
# TODO: Specify what returned fields you need for your analyzer.
return_fields = ['message']
# Generator of events based on your query.
events = self.event_stream(
query_string=query,
return_fields=return_fields
)
# TODO: Add analyzer logic here.
# Methods available to use for sketch analyzers:
# sketch.get_all_indices()
# sketch.add_view(name, query_string, query_filter={})
# event.add_attributes({'foo': 'bar'})
# event.add_tags(['tag_name'])
# event_add_label('label')
# event.add_star()
# event.add_comment('comment')
for event in events:
pass
# TODO: Return a summary from the analyzer.
return 'String to be returned'
manager.AnalysisManager.register_analyzer(TheSketchAnalyzer)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment