(self)
return ('Sessionizing completed, number of {0:s} sessions created:'
                ' {1:d}'.format(self.session_type, self.session_num))
Entry point for the analyzer.

        Allocates events from a SSH connection with a ssh_session attribute.

        Returns:
            String containing the number of sessions created.
Entry point for the analyzer.
Entry point for the analyzer .
def run(self):
        """Entry point for the analyzer.

        Allocates events from a SSH connection with a ssh_session attribute.

        Returns:
            String containing the number of sessions created.
        """
        return_fields = ['message']

        # event_stream returns an ordered generator of events (by time)
        # therefore no further sorting is needed.
        events = self.event_stream(query_string=self.query,
                                   return_fields=return_fields)

        # Dictionary storing the session IDs about the started SSH sessions.
        started_sessions_ids = {}

        for event in events:
            event_message = event.source.get('message')
            connection_match = SSH_CONNECTION_PATTERN.match(event_message)

            if connection_match:
                process_id = connection_match.group('process_id')
                client_ip = connection_match.group('client_ip')
                client_port = connection_match.group('client_port')

                session_id = '{0:s}_{1:s}'.format(client_ip, client_port)
                started_sessions_ids[process_id] = session_id
                self.session_num += 1

            ssh_match = SSH_PATTERN.match(event_message)
            if ssh_match:
                process_id = ssh_match.group('process_id')
                if process_id in started_sessions_ids.keys():
                    self.annotateEvent(event, started_sessions_ids[process_id])

        if self.session_num:
            self.sketch.add_view(
                'SSH sessions',
                self.NAME,
                query_string='session_id.{0:s}:*'.format(self.session_type))

        return ('Sessionizing completed, number of {0:s} sessions created:'
                ' {1:d}'.format(self.session_type, self.session_num))
def run ( self ) : return_fields = [ 'message' ] # event_stream returns an ordered generator of events (by time) # therefore no further sorting is needed. events = self . event_stream ( query_string = self . query , return_fields = return_fields ) # Dictionary storing the session IDs about the started SSH sessions. started_sessions_ids = { } for event in events : event_message = event . source . get ( 'message' ) connection_match = SSH_CONNECTION_PATTERN . match ( event_message ) if connection_match : process_id = connection_match . group ( 'process_id' ) client_ip = connection_match . group ( 'client_ip' ) client_port = connection_match . group ( 'client_port' ) session_id = '{0:s}_{1:s}' . format ( client_ip , client_port ) started_sessions_ids [ process_id ] = session_id self . session_num += 1 ssh_match = SSH_PATTERN . match ( event_message ) if ssh_match : process_id = ssh_match . group ( 'process_id' ) if process_id in started_sessions_ids . keys ( ) : self . annotateEvent ( event , started_sessions_ids [ process_id ] ) if self . session_num : self . sketch . add_view ( 'SSH sessions' , self . NAME , query_string = 'session_id.{0:s}:*' . format ( self . session_type ) ) return ( 'Sessionizing completed, number of {0:s} sessions created:' ' {1:d}' . format ( self . session_type , self . session_num ) )