(self)
return ('GCP ServiceKey analyzer completed with '
                '{0:d} service key marked').format(simple_counter)
Entry point for the analyzer.

        Returns:
            String with summary of the analyzer result
Entry point for the analyzer.
Entry point for the analyzer .
def run(self):
        """Entry point for the analyzer.

        Returns:
            String with summary of the analyzer result
        """
        # TODO: update dftimewolf stackdriver module to produce more detailed
        # attributes
        query = ('principalEmail:*gserviceaccount.com')
        return_fields = ['message', 'methodName']

        events = self.event_stream(
            query_string=query, return_fields=return_fields)

        simple_counter = 0

        for event in events:
            # Fields to analyze.
            method_name = event.source.get('methodName')

            if 'CreateServiceAccount' in method_name:
                event.add_tags(['service-account-created'])

            if 'compute.instances.insert' in method_name:
                event.add_tags(['gce-instance-created'])

            if 'compute.firewalls.insert' in method_name:
                event.add_tags(['fw-rule-created'])

            if 'compute.networks.insert' in method_name:
                event.add_tags(['network-created'])

            # Commit the event to the datastore.
            event.commit()
            simple_counter += 1

        # Create a saved view with our query.
        if simple_counter:
            self.sketch.add_view(
                view_name='GCP ServiceKey activity', analyzer_name=self.NAME,
                query_string=query)

        return ('GCP ServiceKey analyzer completed with '
                '{0:d} service key marked').format(simple_counter)
def run ( self ) : # TODO: update dftimewolf stackdriver module to produce more detailed # attributes query = ( 'principalEmail:*gserviceaccount.com' ) return_fields = [ 'message' , 'methodName' ] events = self . event_stream ( query_string = query , return_fields = return_fields ) simple_counter = 0 for event in events : # Fields to analyze. method_name = event . source . get ( 'methodName' ) if 'CreateServiceAccount' in method_name : event . add_tags ( [ 'service-account-created' ] ) if 'compute.instances.insert' in method_name : event . add_tags ( [ 'gce-instance-created' ] ) if 'compute.firewalls.insert' in method_name : event . add_tags ( [ 'fw-rule-created' ] ) if 'compute.networks.insert' in method_name : event . add_tags ( [ 'network-created' ] ) # Commit the event to the datastore. event . commit ( ) simple_counter += 1 # Create a saved view with our query. if simple_counter : self . sketch . add_view ( view_name = 'GCP ServiceKey activity' , analyzer_name = self . NAME , query_string = query ) return ( 'GCP ServiceKey analyzer completed with ' '{0:d} service key marked' ) . format ( simple_counter )