Update Google Cloud Log parser plugin #4923
Conversation
roshanmaskey
changed the title
roshanmaskey
requested review from
joachimmetz and
sydp
and removed request for
sydp
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #4923 +/- ##
==========================================
+ Coverage 85.05% 85.08% +0.02%
==========================================
Files 431 431
Lines 38648 38765 +117
==========================================
+ Hits 32873 32982 +109
- Misses 5775 5783 +8 ☔ View full report in Codecov by Sentry. |
| """Extracts compute.instances.insert information. | ||
|
|
||
| Args: | ||
| request (dict): JSON dictionary of the `protoPayload.request` field. |
There was a problem hiding this comment.
why the sudden argument name change?
There was a problem hiding this comment.
This method only processes information in the request field i.e. protoPayload.request. To add clarity, I renamed the method to _ParseComputeRequest.
| """ | ||
| status = self._GetJSONValue(proto_payload, 'status') | ||
| if not status: | ||
| event_data.status_code = '' |
There was a problem hiding this comment.
Why an empty string and not None?
There was a problem hiding this comment.
Attributes with value None are ignored by Timesketch. An empty string is assigned to ensure it appears in Timesketch, and Timesketch analyzers (in future) can utilize the field for successful operation filtering.
| # `protoPayload.status.code` field. | ||
| # | ||
| # Empty `code` and `message` fields indicate the operation was successful. | ||
| status_code = str(self._GetJSONValue(status, 'code', '')) |
There was a problem hiding this comment.
Why the explicit call to str() ?
There was a problem hiding this comment.
It is done to avoid type issues in OpenSearch. The value protoPayload.status.code is of type integer or empty.
| request (dict): JSON dictionary of the `protoPayload.request` field. | ||
| event_data (GCPLogEventData): event data. | ||
| """ | ||
| # Source images are useful for investigation. |
There was a problem hiding this comment.
nit: comment add no value to explain the code.
There was a problem hiding this comment.
Updated to explain the variable.
|
@sydp were things remaining that should be changed from your perspective? |
Nothing further from me, thanks. |
Google Cloud audit logs parser update
Description:
Updating Google Cloud audit log parser plugin (
gcp_log.py) to extract attributes useful for investigation.Some of the attributes extracted by the plugin are listed below:
Notes:
All contributions to Plaso undergo code review.
This makes sure that the code has appropriate test coverage and conforms to the
Plaso style guide.
One of the maintainers will examine your code, and may request changes. Check off the items below in
order, and then a maintainer will review your code.
Checklist: