From 1bd632450d68aa99ef85cebe1753e8bd027a6921 Mon Sep 17 00:00:00 2001 From: Joachim Metz Date: Fri, 30 Dec 2016 15:41:27 +0100 Subject: [PATCH] Added event data attribute container #910 --- plaso/containers/events.py | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/plaso/containers/events.py b/plaso/containers/events.py index 6b0c41d794..bb38b28c77 100644 --- a/plaso/containers/events.py +++ b/plaso/containers/events.py @@ -9,6 +9,29 @@ from plaso.lib import py2to3 +class EventData(interface.AttributeContainer): + """Class to represent an event data attribute container. + + Attributes: + data_type (str): event data type indicator. + offset (int): offset relative to the start of the data stream where + the event data is stored. + query (str): query that was used to obtain the event data. + """ + CONTAINER_TYPE = u'event_data' + + def __init__(self, data_type=None): + """Initializes an event data attribute container. + + Args: + data_type (Optional[str]): event data type indicator. + """ + super(EventData, self).__init__() + self.data_type = data_type + self.offset = None + self.query = None + + # TODO: split event into source and event components. # https://github.com/log2timeline/plaso/wiki/Scribbles-about-events @@ -205,7 +228,7 @@ def GetAttributeNames(self): list[str]: attribute names. """ attribute_names = [] - for attribute_name in iter(self.__dict__.keys()): + for attribute_name in self.__dict__.keys(): attribute_value = getattr(self, attribute_name, None) if attribute_value is not None: attribute_names.append(attribute_name) @@ -365,4 +388,4 @@ def GetAttributes(self): manager.AttributeContainersManager.RegisterAttributeContainers([ - EventObject, EventTag]) + EventData, EventObject, EventTag])