(self)
return (
            'Browser Search completed with {0:d} search results '
            'extracted.').format(simple_counter)
Entry point for the browser search analyzer.

        Returns:
            String with summary of the analyzer result
Entry point for the browser search analyzer.
Entry point for the browser search analyzer .
def run(self):
        """Entry point for the browser search analyzer.

        Returns:
            String with summary of the analyzer result
        """
        query = 'source_short:"WEBHIST" OR source:"WEBHIST"'
        return_fields = ['url', 'datetime']
        search_emoji = emojis.get_emoji('MAGNIFYING_GLASS')

        # Generator of events based on your query.
        events = self.event_stream(
            query_string=query, return_fields=return_fields)

        simple_counter = 0
        for event in events:
            url = event.source.get('url')

            if url is None:
                continue

            for engine, expression, method_name, parameter in self._URL_FILTERS:
                callback_method = getattr(self, method_name, None)
                if not callback_method:
                    continue

                match = expression.search(url)
                if not match:
                    continue

                if parameter:
                    search_query = callback_method(url, parameter)
                else:
                    search_query = callback_method(url)

                if not search_query:
                    continue

                simple_counter += 1
                datetime = event.source.get('datetime')
                day, _, _ = datetime.partition('T')
                event.add_attributes({
                    'search_string': search_query,
                    'search_engine': engine,
                    'search_day': 'D:{0:s}'.format(day)})

                event.add_human_readable('{0:s} search query: {1:s}'.format(
                    engine, search_query), self.NAME)
                event.add_emojis([search_emoji])
                event.add_tags(['browser-search'])
                # We break at the first hit of a successful search engine.
                break

            # Commit the event to the datastore.
            event.commit()

        if simple_counter > 0:
            view = self.sketch.add_view(
                view_name='Browser Search', analyzer_name=self.NAME,
                query_string='tag:"browser-search"',
                additional_fields=self._FIELDS_TO_INCLUDE)

            params = {
                'field': 'search_string',
                'limit': 20,
                'index': [self.timeline_id],
            }
            agg_obj = self.sketch.add_aggregation(
                name='Top 20 browser search queries ({0:s})'.format(
                    self.timeline_name),
                agg_name='field_bucket', agg_params=params, view_id=view.id,
                chart_type='table',
                description='Created by the browser search analyzer')

            params = {
                'field': 'search_day',
                'index': [self.timeline_id],
                'limit': 20,
            }
            agg_days = self.sketch.add_aggregation(
                name='Top 20 days of search queries ({0:s})'.format(
                    self.timeline_name), agg_name='field_bucket',
                agg_params=params, chart_type='table',
                description='Created by the browser search analyzer',
                label='informational')

            params = {
                'query_string': 'tag:"browser-search"',
                'index': [self.timeline_id],
                'field': 'domain',
            }
            agg_engines = self.sketch.add_aggregation(
                name='Top Search Engines ({0:s})'.format(self.timeline_name),
                agg_name='query_bucket', agg_params=params, view_id=view.id,
                chart_type='hbarchart',
                description='Created by the browser search analyzer')

            story = self.sketch.add_story('{0:s} - {1:s}'.format(
                utils.BROWSER_STORY_TITLE, self.timeline_name))
            story.add_text(utils.BROWSER_STORY_HEADER, skip_if_exists=True)

            story.add_text(
                '## Browser Search Analyzer.\n\nThe browser search '
                'analyzer takes URLs usually resevered for browser '
                'search queries and extracts the search string.'
                'In this timeline the analyzer discovered {0:d} '
                'browser searches.\n\nThis is a summary of '
                'it\'s findings for the timeline **{1:s}**.'.format(
                    simple_counter, self.timeline_name))

            story.add_text(
                'The top 20 most commonly discovered searches were:')
            story.add_aggregation(agg_obj)
            story.add_text('The domains used to search:')
            story.add_aggregation(agg_engines, 'hbarchart')
            story.add_text('And the most common days of search:')
            story.add_aggregation(agg_days)
            story.add_text(
                'And an overview of all the discovered search terms:')
            story.add_view(view)

        return (
            'Browser Search completed with {0:d} search results '
            'extracted.').format(simple_counter)
def run ( self ) : query = 'source_short:"WEBHIST" OR source:"WEBHIST"' return_fields = [ 'url' , 'datetime' ] search_emoji = emojis . get_emoji ( 'MAGNIFYING_GLASS' ) # Generator of events based on your query. events = self . event_stream ( query_string = query , return_fields = return_fields ) simple_counter = 0 for event in events : url = event . source . get ( 'url' ) if url is None : continue for engine , expression , method_name , parameter in self . _URL_FILTERS : callback_method = getattr ( self , method_name , None ) if not callback_method : continue match = expression . search ( url ) if not match : continue if parameter : search_query = callback_method ( url , parameter ) else : search_query = callback_method ( url ) if not search_query : continue simple_counter += 1 datetime = event . source . get ( 'datetime' ) day , _ , _ = datetime . partition ( 'T' ) event . add_attributes ( { 'search_string' : search_query , 'search_engine' : engine , 'search_day' : 'D:{0:s}' . format ( day ) } ) event . add_human_readable ( '{0:s} search query: {1:s}' . format ( engine , search_query ) , self . NAME ) event . add_emojis ( [ search_emoji ] ) event . add_tags ( [ 'browser-search' ] ) # We break at the first hit of a successful search engine. break # Commit the event to the datastore. event . commit ( ) if simple_counter > 0 : view = self . sketch . add_view ( view_name = 'Browser Search' , analyzer_name = self . NAME , query_string = 'tag:"browser-search"' , additional_fields = self . _FIELDS_TO_INCLUDE ) params = { 'field' : 'search_string' , 'limit' : 20 , 'index' : [ self . timeline_id ] , } agg_obj = self . sketch . add_aggregation ( name = 'Top 20 browser search queries ({0:s})' . format ( self . timeline_name ) , agg_name = 'field_bucket' , agg_params = params , view_id = view . id , chart_type = 'table' , description = 'Created by the browser search analyzer' ) params = { 'field' : 'search_day' , 'index' : [ self . timeline_id ] , 'limit' : 20 , } agg_days = self . sketch . add_aggregation ( name = 'Top 20 days of search queries ({0:s})' . format ( self . timeline_name ) , agg_name = 'field_bucket' , agg_params = params , chart_type = 'table' , description = 'Created by the browser search analyzer' , label = 'informational' ) params = { 'query_string' : 'tag:"browser-search"' , 'index' : [ self . timeline_id ] , 'field' : 'domain' , } agg_engines = self . sketch . add_aggregation ( name = 'Top Search Engines ({0:s})' . format ( self . timeline_name ) , agg_name = 'query_bucket' , agg_params = params , view_id = view . id , chart_type = 'hbarchart' , description = 'Created by the browser search analyzer' ) story = self . sketch . add_story ( '{0:s} - {1:s}' . format ( utils . BROWSER_STORY_TITLE , self . timeline_name ) ) story . add_text ( utils . BROWSER_STORY_HEADER , skip_if_exists = True ) story . add_text ( '## Browser Search Analyzer.\n\nThe browser search ' 'analyzer takes URLs usually resevered for browser ' 'search queries and extracts the search string.' 'In this timeline the analyzer discovered {0:d} ' 'browser searches.\n\nThis is a summary of ' 'it\'s findings for the timeline **{1:s}**.' . format ( simple_counter , self . timeline_name ) ) story . add_text ( 'The top 20 most commonly discovered searches were:' ) story . add_aggregation ( agg_obj ) story . add_text ( 'The domains used to search:' ) story . add_aggregation ( agg_engines , 'hbarchart' ) story . add_text ( 'And the most common days of search:' ) story . add_aggregation ( agg_days ) story . add_text ( 'And an overview of all the discovered search terms:' ) story . add_view ( view ) return ( 'Browser Search completed with {0:d} search results ' 'extracted.' ) . format ( simple_counter )