(self)
return self.graph
Generate the graph.

        Returns:
            Graph object instance.
Generate the graph.
Generate the graph .
def generate(self):
        """Generate the graph.

        Returns:
            Graph object instance.
        """
        query = 'event_identifier:7045'
        return_fields = ['computer_name', 'username', 'strings']

        events = self.event_stream(
            query_string=query, return_fields=return_fields)

        for event in events:
            computer_name = event['_source'].get('computer_name', 'UNKNOWN')
            username = event['_source'].get('username', 'UNKNOWN')
            event_strings = event['_source'].get('strings', [])

            # Skip event if we don't have enough data to build the graph.
            try:
                service_name = event_strings[0]
                image_path = event_strings[1]
                service_type = event_strings[2]
                start_type = event_strings[3]
            except IndexError:
                continue

            computer = self.graph.add_node(computer_name, {'type': 'computer'})
            user = self.graph.add_node(username, {'type': 'user'})
            service = self.graph.add_node(service_name, {
                'type': 'winservice', 'image_path': image_path
            })

            self.graph.add_edge(user, service, start_type, event)
            self.graph.add_edge(service, computer, service_type, event)

        self.graph.commit()

        return self.graph
def generate ( self ) : query = 'event_identifier:7045' return_fields = [ 'computer_name' , 'username' , 'strings' ] events = self . event_stream ( query_string = query , return_fields = return_fields ) for event in events : computer_name = event [ '_source' ] . get ( 'computer_name' , 'UNKNOWN' ) username = event [ '_source' ] . get ( 'username' , 'UNKNOWN' ) event_strings = event [ '_source' ] . get ( 'strings' , [ ] ) # Skip event if we don't have enough data to build the graph. try : service_name = event_strings [ 0 ] image_path = event_strings [ 1 ] service_type = event_strings [ 2 ] start_type = event_strings [ 3 ] except IndexError : continue computer = self . graph . add_node ( computer_name , { 'type' : 'computer' } ) user = self . graph . add_node ( username , { 'type' : 'user' } ) service = self . graph . add_node ( service_name , { 'type' : 'winservice' , 'image_path' : image_path } ) self . graph . add_edge ( user , service , start_type , event ) self . graph . add_edge ( service , computer , service_type , event ) self . graph . commit ( ) return self . graph