|
PySpark Plaso
Release 2019
A tool for distributed extraction of timestamps from various files using extractors adapted from the Plaso engine to Apache Spark.
|


Public Member Functions | |
| def | get_name (cls) |
| def | get_description (cls) |
| def | filter (cls, path) |
| def | extract (cls, path) |
Serve as a dummy extractor for its sub-classes.
| def plaso.tarzan.app.extractors.extractor.Extractor.extract | ( | cls, | |
| path | |||
| ) |
Extract events from a file given by its HDFS path. :param path: the HDFS path of the file :return: the list of events
Reimplemented in plaso.tarzan.app.extractors.winreg.WinReg, plaso.tarzan.app.extractors.pe.PE, and plaso.tarzan.app.extractors.sqlite.SQLite.
| def plaso.tarzan.app.extractors.extractor.Extractor.filter | ( | cls, | |
| path | |||
| ) |
Check if a file given by its HDFS path can be processed by this extractor. :param path: the HDFS path of the file :return: true iff the file can be processed
Reimplemented in plaso.tarzan.app.extractors.pe.PE, plaso.tarzan.app.extractors.sqlite.SQLite, and plaso.tarzan.app.extractors.winreg.WinReg.
| def plaso.tarzan.app.extractors.extractor.Extractor.get_description | ( | cls | ) |
Get a description of the extractor. :return: the description of the extractor
| def plaso.tarzan.app.extractors.extractor.Extractor.get_name | ( | cls | ) |
Get a name of the extractor. :return: the name of the extractor
1.8.15