(self)
return (
            'Total number of login events processed: {0:d} and '
            'logoff events: {1:d}').format(login_counter, logoff_counter)
Entry point for the analyzer.

        Returns:
            String with summary of the analyzer result
Entry point for the analyzer.
Entry point for the analyzer .
def run(self):
        """Entry point for the analyzer.

        Returns:
            String with summary of the analyzer result
        """
        login_emoji = emojis.get_emoji('unlock')
        logoff_emoji = emojis.get_emoji('lock')
        screen_emoji = emojis.get_emoji('screen')
        screensaver_logon = LOGON_TYPES.get('7')
        login_counter = 0
        logoff_counter = 0

        # TODO: Add EVT lookups, ID 528 for logon and 538, 540 for logoff.
        # TODO: Add RDP EVT lookups, ID 682 for logon and 683 for logoff.
        query = (
            'data_type:"windows:evtx:record" AND (event_identifier:4624 OR '
            'event_identifier:4778 OR event_identifier:4779 OR '
            'event_identifier:4634 OR event_identifier:4647)')

        return_fields = [
            'message', 'data_type', 'strings', 'strings_parsed',
            'event_identifier']

        # Generator of events based on your query.
        events = self.event_stream(
            query_string=query, return_fields=return_fields)

        for event in events:
            strings = event.source.get('strings')
            strings_parsed = event.source.get('strings_parsed')
            identifier = event.source.get('event_identifier')
            emojis_to_add = []
            tags_to_add = []
            attribute_dict = {}

            if isinstance(identifier, six.text_type):
                try:
                    identifier = int(identifier, 10)
                except ValueError:
                    logger.warning((
                        'Unable to convert EVTX identifier to an integer, '
                        'value is {0:s}').format(identifier))
                    continue

            if identifier == 4624:
                attribute_dict = parse_evtx_logon_event(
                    strings, strings_parsed)
                if not attribute_dict:
                    continue
                emojis_to_add.append(login_emoji)
                tags_to_add.append('logon-event')
                login_counter += 1

            elif identifier in (4634, 4647):
                attribute_dict = parse_evtx_logoff_event(strings)
                if not attribute_dict:
                    continue
                emojis_to_add.append(logoff_emoji)
                tags_to_add.append('logoff-event')
                logoff_counter += 1

            # TODO: Add support for RDP events, ID 4778 (logon) and 4779
            # (logoff).
            if not attribute_dict:
                continue
            event.add_attributes(attribute_dict)

            # Want to add an emoji in case this is a screensaver unlock.
            if attribute_dict.get('logon_type', '') == screensaver_logon:
                emojis_to_add.append(screen_emoji)

            event.add_emojis(emojis_to_add)
            event.add_tags(tags_to_add)

            # Commit the event to the datastore.
            event.commit()

        # TODO: Add support for Linux syslog logon/logoff events.
        # TODO: Add support for Mac OS X logon/logoff events.

        return (
            'Total number of login events processed: {0:d} and '
            'logoff events: {1:d}').format(login_counter, logoff_counter)
def run ( self ) : login_emoji = emojis . get_emoji ( 'unlock' ) logoff_emoji = emojis . get_emoji ( 'lock' ) screen_emoji = emojis . get_emoji ( 'screen' ) screensaver_logon = LOGON_TYPES . get ( '7' ) login_counter = 0 logoff_counter = 0 # TODO: Add EVT lookups, ID 528 for logon and 538, 540 for logoff. # TODO: Add RDP EVT lookups, ID 682 for logon and 683 for logoff. query = ( 'data_type:"windows:evtx:record" AND (event_identifier:4624 OR ' 'event_identifier:4778 OR event_identifier:4779 OR ' 'event_identifier:4634 OR event_identifier:4647)' ) return_fields = [ 'message' , 'data_type' , 'strings' , 'strings_parsed' , 'event_identifier' ] # Generator of events based on your query. events = self . event_stream ( query_string = query , return_fields = return_fields ) for event in events : strings = event . source . get ( 'strings' ) strings_parsed = event . source . get ( 'strings_parsed' ) identifier = event . source . get ( 'event_identifier' ) emojis_to_add = [ ] tags_to_add = [ ] attribute_dict = { } if isinstance ( identifier , six . text_type ) : try : identifier = int ( identifier , 10 ) except ValueError : logger . warning ( ( 'Unable to convert EVTX identifier to an integer, ' 'value is {0:s}' ) . format ( identifier ) ) continue if identifier == 4624 : attribute_dict = parse_evtx_logon_event ( strings , strings_parsed ) if not attribute_dict : continue emojis_to_add . append ( login_emoji ) tags_to_add . append ( 'logon-event' ) login_counter += 1 elif identifier in ( 4634 , 4647 ) : attribute_dict = parse_evtx_logoff_event ( strings ) if not attribute_dict : continue emojis_to_add . append ( logoff_emoji ) tags_to_add . append ( 'logoff-event' ) logoff_counter += 1 # TODO: Add support for RDP events, ID 4778 (logon) and 4779 # (logoff). if not attribute_dict : continue event . add_attributes ( attribute_dict ) # Want to add an emoji in case this is a screensaver unlock. if attribute_dict . get ( 'logon_type' , '' ) == screensaver_logon : emojis_to_add . append ( screen_emoji ) event . add_emojis ( emojis_to_add ) event . add_tags ( tags_to_add ) # Commit the event to the datastore. event . commit ( ) # TODO: Add support for Linux syslog logon/logoff events. # TODO: Add support for Mac OS X logon/logoff events. return ( 'Total number of login events processed: {0:d} and ' 'logoff events: {1:d}' ) . format ( login_counter , logoff_counter )