Autopsy  4.9.1
Graphical digital forensics platform for The Sleuth Kit and other tools.
Public Member Functions | Static Public Member Functions | Private Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.modules.stix.STIXReportModule Class Reference

Inherits org.sleuthkit.autopsy.report.GeneralReportModule.

Public Member Functions

void generateReport (String baseReportDir, ReportProgressPanel progressPanel)
 
JPanel getConfigurationPanel ()
 
String getDescription ()
 
String getName ()
 
String getRelativeFilePath ()
 

Static Public Member Functions

static synchronized STIXReportModule getDefault ()
 

Private Member Functions

 STIXReportModule ()
 
ObservableResult evaluateObject (ObjectType obj, String spacing, String id)
 
ObservableResult evaluateObservableComposition (ObservableCompositionType comp, String spacing) throws TskCoreException
 
ObservableResult evaluateSingleObservable (Observable obs, String spacing) throws TskCoreException
 
STIXPackage loadSTIXFile (String stixFileName) throws JAXBException
 
String makeMapKey (Observable obs)
 
void printFileHeader (String a_fileName, BufferedWriter output)
 
void processFile (String stixFile, ReportProgressPanel progressPanel, BufferedWriter output) throws JAXBException, TskCoreException
 
void processIndicators (STIXPackage stix, BufferedWriter output) throws TskCoreException
 
void processObservables (STIXPackage stix)
 
void saveResultsAsArtifacts (Indicator ind, ObservableResult result) throws TskCoreException
 
void saveToObjectMap (Observable obs)
 
void writeResultsToFile (Indicator ind, String resultStr, boolean found, BufferedWriter output)
 

Private Attributes

STIXReportModuleConfigPanel configPanel
 
Map< String, ObjectType > idToObjectMap = new HashMap<String, ObjectType>()
 
Map< String, ObservableResult > idToResult = new HashMap<String, ObservableResult>()
 
List< EvalRegistryObj.RegistryFileInfo > registryFileData = null
 
boolean reportAllResults
 
String reportPath
 
final boolean skipShortCircuit = true
 

Static Private Attributes

static STIXReportModule instance = null
 
static final Logger logger = Logger.getLogger(STIXReportModule.class.getName())
 

Detailed Description

Definition at line 67 of file STIXReportModule.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.modules.stix.STIXReportModule.STIXReportModule ( )
private

Member Function Documentation

ObservableResult org.sleuthkit.autopsy.modules.stix.STIXReportModule.evaluateObject ( ObjectType  obj,
String  spacing,
String  id 
)
private

Evaluate a STIX object.

Parameters
objThe object to evaluate against the datasource(s)
spacingFor formatting the output
id
Returns

Definition at line 606 of file STIXReportModule.java.

References org.sleuthkit.autopsy.modules.stix.STIXReportModule.registryFileData.

Referenced by org.sleuthkit.autopsy.modules.stix.STIXReportModule.evaluateSingleObservable().

ObservableResult org.sleuthkit.autopsy.modules.stix.STIXReportModule.evaluateObservableComposition ( ObservableCompositionType  comp,
String  spacing 
) throws TskCoreException
private

Evaluate an observable composition. Can be called recursively.

Parameters
compThe observable composition object to evaluate
spacingUsed to formatting the output
Returns
The status of the composition
Exceptions
TskCoreException

Definition at line 468 of file STIXReportModule.java.

References org.sleuthkit.autopsy.modules.stix.STIXReportModule.evaluateSingleObservable().

Referenced by org.sleuthkit.autopsy.modules.stix.STIXReportModule.processIndicators().

ObservableResult org.sleuthkit.autopsy.modules.stix.STIXReportModule.evaluateSingleObservable ( Observable  obs,
String  spacing 
) throws TskCoreException
private

Evaluate one observable and return the result. This is at the end of the observable composition tree and will not be called recursively.

Parameters
obsThe observable object to evaluate
spacingFor formatting the output
Returns
The status of the observable
Exceptions
TskCoreException

Definition at line 564 of file STIXReportModule.java.

References org.sleuthkit.autopsy.modules.stix.STIXReportModule.evaluateObject(), org.sleuthkit.autopsy.modules.stix.STIXReportModule.makeMapKey(), and org.sleuthkit.autopsy.modules.stix.STIXReportModule.saveToObjectMap().

Referenced by org.sleuthkit.autopsy.modules.stix.STIXReportModule.evaluateObservableComposition(), and org.sleuthkit.autopsy.modules.stix.STIXReportModule.processIndicators().

void org.sleuthkit.autopsy.modules.stix.STIXReportModule.generateReport ( String  baseReportDir,
ReportProgressPanel  progressPanel 
)
Parameters
baseReportDirpath to save the report
progressPanelpanel to update the report's progress

Implements org.sleuthkit.autopsy.report.GeneralReportModule.

Definition at line 100 of file STIXReportModule.java.

References org.sleuthkit.autopsy.casemodule.Case.addReport(), org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus.CANCELED, org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus.COMPLETE, org.sleuthkit.autopsy.report.ReportProgressPanel.complete(), org.sleuthkit.autopsy.coreutils.MessageNotifyUtil.MessageType.ERROR, org.sleuthkit.autopsy.report.ReportProgressPanel.ReportStatus.ERROR, org.sleuthkit.autopsy.coreutils.MessageNotifyUtil.Message.error(), org.sleuthkit.autopsy.casemodule.Case.getCurrentCaseThrows(), org.sleuthkit.autopsy.modules.stix.STIXReportModule.getRelativeFilePath(), org.sleuthkit.autopsy.modules.stix.STIXReportModuleConfigPanel.getShowAllResults(), org.sleuthkit.autopsy.report.ReportProgressPanel.getStatus(), org.sleuthkit.autopsy.modules.stix.STIXReportModuleConfigPanel.getStixFile(), org.sleuthkit.autopsy.modules.stix.STIXReportModule.processFile(), org.sleuthkit.autopsy.coreutils.ModuleSettings.setConfigSetting(), org.sleuthkit.autopsy.report.ReportProgressPanel.setIndeterminate(), org.sleuthkit.autopsy.report.ReportProgressPanel.setMaximumProgress(), org.sleuthkit.autopsy.coreutils.MessageNotifyUtil.Notify.show(), org.sleuthkit.autopsy.report.ReportProgressPanel.start(), and org.sleuthkit.autopsy.report.ReportProgressPanel.updateStatusLabel().

JPanel org.sleuthkit.autopsy.modules.stix.STIXReportModule.getConfigurationPanel ( )
static synchronized STIXReportModule org.sleuthkit.autopsy.modules.stix.STIXReportModule.getDefault ( )
static
String org.sleuthkit.autopsy.modules.stix.STIXReportModule.getDescription ( )

Definition at line 657 of file STIXReportModule.java.

String org.sleuthkit.autopsy.modules.stix.STIXReportModule.getName ( )

Definition at line 646 of file STIXReportModule.java.

String org.sleuthkit.autopsy.modules.stix.STIXReportModule.getRelativeFilePath ( )
STIXPackage org.sleuthkit.autopsy.modules.stix.STIXReportModule.loadSTIXFile ( String  stixFileName) throws JAXBException
private

Load a STIX-formatted XML file into a STIXPackage object.

Parameters
stixFileNameName of the STIX file to unmarshal
Returns
Unmarshalled file contents
Exceptions
JAXBException

Definition at line 252 of file STIXReportModule.java.

Referenced by org.sleuthkit.autopsy.modules.stix.STIXReportModule.processFile().

String org.sleuthkit.autopsy.modules.stix.STIXReportModule.makeMapKey ( Observable  obs)
private

Use the ID or ID ref to create a key into the observable map.

Parameters
obs
Returns

Definition at line 433 of file STIXReportModule.java.

Referenced by org.sleuthkit.autopsy.modules.stix.STIXReportModule.evaluateSingleObservable(), and org.sleuthkit.autopsy.modules.stix.STIXReportModule.saveToObjectMap().

void org.sleuthkit.autopsy.modules.stix.STIXReportModule.printFileHeader ( String  a_fileName,
BufferedWriter  output 
)
private

Write the a header for the current file to the output file.

Parameters
a_fileName
output

Definition at line 408 of file STIXReportModule.java.

Referenced by org.sleuthkit.autopsy.modules.stix.STIXReportModule.processFile().

void org.sleuthkit.autopsy.modules.stix.STIXReportModule.processFile ( String  stixFile,
ReportProgressPanel  progressPanel,
BufferedWriter  output 
) throws JAXBException, TskCoreException
private
void org.sleuthkit.autopsy.modules.stix.STIXReportModule.processIndicators ( STIXPackage  stix,
BufferedWriter  output 
) throws TskCoreException
private
void org.sleuthkit.autopsy.modules.stix.STIXReportModule.processObservables ( STIXPackage  stix)
private

Do the initial processing of the list of observables. For each observable, save it in a map using the ID as key.

Parameters
stixSTIXPackage

Definition at line 268 of file STIXReportModule.java.

References org.sleuthkit.autopsy.modules.stix.STIXReportModule.saveToObjectMap().

Referenced by org.sleuthkit.autopsy.modules.stix.STIXReportModule.processFile().

void org.sleuthkit.autopsy.modules.stix.STIXReportModule.saveResultsAsArtifacts ( Indicator  ind,
ObservableResult  result 
) throws TskCoreException
private

Create the artifacts saved in the observable result.

Parameters
ind
result
Exceptions
TskCoreException

Definition at line 325 of file STIXReportModule.java.

References org.sleuthkit.autopsy.coreutils.MessageNotifyUtil.MessageType.INFO, and org.sleuthkit.autopsy.coreutils.MessageNotifyUtil.Notify.show().

Referenced by org.sleuthkit.autopsy.modules.stix.STIXReportModule.processIndicators().

void org.sleuthkit.autopsy.modules.stix.STIXReportModule.saveToObjectMap ( Observable  obs)
private
void org.sleuthkit.autopsy.modules.stix.STIXReportModule.writeResultsToFile ( Indicator  ind,
String  resultStr,
boolean  found,
BufferedWriter  output 
)
private

Write the full results string to the output file.

Parameters
ind- Used to get the title, ID, and description of the indicator
resultStr- Full results for this indicator
found- true if the indicator was found in datasource(s)
output

Definition at line 371 of file STIXReportModule.java.

Referenced by org.sleuthkit.autopsy.modules.stix.STIXReportModule.processIndicators().

Member Data Documentation

STIXReportModuleConfigPanel org.sleuthkit.autopsy.modules.stix.STIXReportModule.configPanel
private
Map<String, ObjectType> org.sleuthkit.autopsy.modules.stix.STIXReportModule.idToObjectMap = new HashMap<String, ObjectType>()
private

Definition at line 75 of file STIXReportModule.java.

Map<String, ObservableResult> org.sleuthkit.autopsy.modules.stix.STIXReportModule.idToResult = new HashMap<String, ObservableResult>()
private

Definition at line 76 of file STIXReportModule.java.

STIXReportModule org.sleuthkit.autopsy.modules.stix.STIXReportModule.instance = null
staticprivate
final Logger org.sleuthkit.autopsy.modules.stix.STIXReportModule.logger = Logger.getLogger(STIXReportModule.class.getName())
staticprivate

Definition at line 69 of file STIXReportModule.java.

List<EvalRegistryObj.RegistryFileInfo> org.sleuthkit.autopsy.modules.stix.STIXReportModule.registryFileData = null
private
boolean org.sleuthkit.autopsy.modules.stix.STIXReportModule.reportAllResults
private
String org.sleuthkit.autopsy.modules.stix.STIXReportModule.reportPath
private

Definition at line 72 of file STIXReportModule.java.

final boolean org.sleuthkit.autopsy.modules.stix.STIXReportModule.skipShortCircuit = true
private

Definition at line 80 of file STIXReportModule.java.


The documentation for this class was generated from the following file:

Copyright © 2012-2018 Basis Technology. Generated on: Tue Dec 18 2018
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.