Skip to content

Update sysShutdown #898

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Oct 24, 2024
Merged

Update sysShutdown #898

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ea663f7
Update sysShutdown.py
stark4n6 Oct 24, 2024
b0280dd
Merge branch 'abrignoni:lava-output' into lava-output
stark4n6 Oct 24, 2024
e4d5477
Merge branch 'abrignoni:lava-output' into lava-output
stark4n6 Oct 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 31 additions & 18 deletions scripts/artifacts/sysShutdown.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
__artifacts_v2__ = {
"sysShutdown": {
"get_sysShutdown": {
"name": "Sysdiagnose - Shutdown Log",
"description": "Parses the shutdown.log file from Sysdiagnose logs, based off work by Kaspersky Lab https://github.com/KasperskyLab/iShutdown",
"author": "@KevinPagano3",
Expand All @@ -9,6 +9,7 @@
"category": "Sysdiagnose",
"notes": "",
"paths": ('*/shutdown.log'),
"output_types": "none", #["html","tsv","timeline","lava"]
"function": "get_sysShutdown"
}
}
Expand All @@ -18,12 +19,15 @@
import re

from scripts.artifact_report import ArtifactHtmlReport
from scripts.lavafuncs import lava_process_artifact, lava_insert_sqlite_data
from scripts.ilapfuncs import logfunc, tsv, timeline, is_platform_windows, convert_ts_int_to_utc, convert_utc_human_to_timezone

def get_sysShutdown(files_found, report_folder, seeker, wrap_text, time_offset):

data_list_shutdown_log = []
data_list_shutdown_reboot = []
category = "Sysdiagnose"
module_name = "get_sysShutdown"

for file_found in files_found:
file_found = str(file_found)
Expand All @@ -44,7 +48,6 @@ def get_sysShutdown(files_found, report_folder, seeker, wrap_text, time_offset):
sigterm_match = re.search(r'SIGTERM: \[(\d+)\]', line)
if sigterm_match:
timestamp = int(sigterm_match.group(1))
#reboot_time = datetime.utcfromtimestamp(timestamp).strftime('%Y-%m-%d %H:%M:%S')
reboot_time = convert_utc_human_to_timezone(convert_ts_int_to_utc(timestamp),time_offset)
data_list_shutdown_reboot.append((reboot_time,reboots,file_found))
reboots += 1
Expand All @@ -57,19 +60,24 @@ def get_sysShutdown(files_found, report_folder, seeker, wrap_text, time_offset):

# Shutdown Log Processes Report
if len(data_list_shutdown_log) > 0:
report = ArtifactHtmlReport('Sysdiagnose - Shutdown Log Processes')
report.start_artifact_report(report_folder, 'Sysdiagnose - Shutdown Log Processes')
report.add_script()
data_headers = ('Timestamp','Entry Number','PID','Path','Source File')
report1 = ArtifactHtmlReport('Sysdiagnose - Shutdown Log Processes')
report1.start_artifact_report(report_folder, 'Sysdiagnose - Shutdown Log Processes')
report1.add_script()
data_headers1 = ('Timestamp','Entry Number','PID','Path','Source File')
data_headers1_lava = (('Timestamp','datetime'),'Entry Number','PID','Path','Source File')

report.write_artifact_data_table(data_headers, data_list_shutdown_log, file_found)
report.end_artifact_report()
report1.write_artifact_data_table(data_headers1, data_list_shutdown_log, file_found)
report1.end_artifact_report()

tsv(report_folder, data_headers1, data_list_shutdown_log, 'Sysdiagnose - Shutdown Log Processes')

timeline(report_folder, 'Sysdiagnose - Shutdown Log Processes', data_list_shutdown_log, data_headers1)

tsvname = f'Sysdiagnose - Shutdown Log Processes'
tsv(report_folder, data_headers, data_list_shutdown_log, tsvname)
#data_headers1[0] = (data_headers1[0], 'datetime')

table_name1, object_columns1, column_map1 = lava_process_artifact(category, module_name, 'Sysdiagnose - Shutdown Log Processes', data_headers1_lava, len(data_list_shutdown_log))
lava_insert_sqlite_data(table_name1, data_list_shutdown_log, object_columns1, data_headers1_lava, column_map1)

tlactivity = f'Sysdiagnose - Shutdown Log Processes'
timeline(report_folder, tlactivity, data_list_shutdown_log, data_headers)
else:
logfunc('No Sysdiagnose - Shutdown Log Processes data available')

Expand All @@ -78,16 +86,21 @@ def get_sysShutdown(files_found, report_folder, seeker, wrap_text, time_offset):
report = ArtifactHtmlReport('Sysdiagnose - Shutdown Log Reboots')
report.start_artifact_report(report_folder, 'Sysdiagnose - Shutdown Log Reboots')
report.add_script()
data_headers = ('Timestamp','Reboot Number','Source File')
data_headers2 = ('Timestamp','Reboot Number','Source File')
data_headers2_lava = (('Timestamp','datetime'),'Reboot Number','Source File')

report.write_artifact_data_table(data_headers, data_list_shutdown_reboot, file_found)
report.write_artifact_data_table(data_headers2, data_list_shutdown_reboot, file_found)
report.end_artifact_report()

tsvname = f'Sysdiagnose - Shutdown Log Reboots'
tsv(report_folder, data_headers, data_list_shutdown_reboot, tsvname)
tsv(report_folder, data_headers2, data_list_shutdown_reboot, 'Sysdiagnose - Shutdown Log Reboots')

timeline(report_folder, 'Sysdiagnose - Shutdown Log Reboots', data_list_shutdown_reboot, data_headers2)

#data_headers2[0] = (data_headers2[0], 'datetime')

table_name2, object_columns2, column_map2 = lava_process_artifact(category, module_name, 'Sysdiagnose - Shutdown Log Reboots', data_headers2_lava, len(data_list_shutdown_reboot))
lava_insert_sqlite_data(table_name2, data_list_shutdown_reboot, object_columns2, data_headers2_lava, column_map2)

tlactivity = f'Sysdiagnose - Shutdown Log Reboots'
timeline(report_folder, tlactivity, data_list_shutdown_reboot, data_headers)
else:
logfunc('No Sysdiagnose - Shutdown Log Reboots data available')