(self)
return 'Windows Crash analyzer completed, ' + \
            '{0:d} crashed application{1:s} identified: {2:s}'.format(
                len(filenames),
                's' if len(filenames) > 1 else '',
                ', '.join(filenames))
Entry point for the analyzer.

        Returns:
            String with summary of the analyzer result
Entry point for the analyzer.
Entry point for the analyzer .
def run(self):
        """Entry point for the analyzer.

        Returns:
            String with summary of the analyzer result
        """
        query = self.formulate_query(self.QUERY_ELEMENTS)

        return_fields = ['data_type', 'message', 'filename']

        # Generator of events based on your query.
        events = self.event_stream(
            query_string=query, return_fields=return_fields)

        # Container for filenames of crashed applications.
        filenames = set()

        for event in events:
            data_type = event.source.get('data_type')
            event_text = None

            # Tag entries that show the crash reporting has been disabled.
            if data_type == 'windows:registry:key_value':
                event.add_comment(
                    'WARNING: The crash reporting was disabled. '
                    'It could be indicative of attacker activity. '
                    'For details refer to page 16 from '
                    'https://assets.documentcloud.org/documents/3461560/'
                    'Google-Aquarium-Clean.pdf.')
                event.commit()
                continue

            # Search event log entries for filenames of crashed applications.
            if data_type == 'windows:evtx:record':
                event_text = event.source.get('message')

            # Search file system entries for filenames of crashed applications.
            elif data_type == 'fs:stat':
                event_text = event.source.get('filename')

            # If found the filename, tag the entry as crash-related
            filename = self.extract_filename(event_text)
            if filename:
                self.mark_as_crash(event, filename)
                filenames.add(filename)
                event.commit()

        # Create a saved view with our query.
        if filenames:
            self.sketch.add_view(
                'Windows Crash activity', 'win_crash',
                query_string='tag:"win_crash"')

        return 'Windows Crash analyzer completed, ' + \
            '{0:d} crashed application{1:s} identified: {2:s}'.format(
                len(filenames),
                's' if len(filenames) > 1 else '',
                ', '.join(filenames))
def run ( self ) : query = self . formulate_query ( self . QUERY_ELEMENTS ) return_fields = [ 'data_type' , 'message' , 'filename' ] # Generator of events based on your query. events = self . event_stream ( query_string = query , return_fields = return_fields ) # Container for filenames of crashed applications. filenames = set ( ) for event in events : data_type = event . source . get ( 'data_type' ) event_text = None # Tag entries that show the crash reporting has been disabled. if data_type == 'windows:registry:key_value' : event . add_comment ( 'WARNING: The crash reporting was disabled. ' 'It could be indicative of attacker activity. ' 'For details refer to page 16 from ' 'https://assets.documentcloud.org/documents/3461560/' 'Google-Aquarium-Clean.pdf.' ) event . commit ( ) continue # Search event log entries for filenames of crashed applications. if data_type == 'windows:evtx:record' : event_text = event . source . get ( 'message' ) # Search file system entries for filenames of crashed applications. elif data_type == 'fs:stat' : event_text = event . source . get ( 'filename' ) # If found the filename, tag the entry as crash-related filename = self . extract_filename ( event_text ) if filename : self . mark_as_crash ( event , filename ) filenames . add ( filename ) event . commit ( ) # Create a saved view with our query. if filenames : self . sketch . add_view ( 'Windows Crash activity' , 'win_crash' , query_string = 'tag:"win_crash"' ) return 'Windows Crash analyzer completed, ' + '{0:d} crashed application{1:s} identified: {2:s}' . format ( len ( filenames ) , 's' if len ( filenames ) > 1 else '' , ', ' . join ( filenames ) )