Autopsy  4.0
Graphical digital forensics platform for The Sleuth Kit and other tools.
Public Member Functions | Static Public Member Functions | Private Member Functions | Private Attributes | Static Private Attributes | List of all members
org.sleuthkit.autopsy.modules.stix.STIXReportModule Class Reference

Inherits org.sleuthkit.autopsy.report.GeneralReportModule.

Public Member Functions

void generateReport (String baseReportDir, ReportProgressPanel progressPanel)
 
JPanel getConfigurationPanel ()
 
String getDescription ()
 
String getName ()
 
String getRelativeFilePath ()
 

Static Public Member Functions

static synchronized STIXReportModule getDefault ()
 

Private Member Functions

 STIXReportModule ()
 
ObservableResult evaluateObject (ObjectType obj, String spacing, String id)
 
ObservableResult evaluateObservableComposition (ObservableCompositionType comp, String spacing) throws TskCoreException
 
ObservableResult evaluateSingleObservable (Observable obs, String spacing) throws TskCoreException
 
STIXPackage loadSTIXFile (String stixFileName) throws TskCoreException
 
String makeMapKey (Observable obs)
 
void printFileHeader (String a_fileName)
 
void processFile (String stixFile, ReportProgressPanel progressPanel) throws TskCoreException
 
void processIndicators (STIXPackage stix) throws TskCoreException
 
void processObservables (STIXPackage stix)
 
void saveResultsAsArtifacts (Indicator ind, ObservableResult result) throws TskCoreException
 
void saveToObjectMap (Observable obs)
 
void writeResultsToFile (Indicator ind, String resultStr, boolean found)
 

Private Attributes

STIXReportModuleConfigPanel configPanel
 
Map< String, ObjectType > idToObjectMap = new HashMap<String, ObjectType>()
 
Map< String, ObservableResult > idToResult = new HashMap<String, ObservableResult>()
 
BufferedWriter output = null
 
List< EvalRegistryObj.RegistryFileInfo > registryFileData = null
 
boolean reportAllResults
 
String reportPath
 
final boolean skipShortCircuit = true
 

Static Private Attributes

static STIXReportModule instance = null
 
static final Logger logger = Logger.getLogger(STIXReportModule.class.getName())
 

Detailed Description

Definition at line 67 of file STIXReportModule.java.

Constructor & Destructor Documentation

org.sleuthkit.autopsy.modules.stix.STIXReportModule.STIXReportModule ( )
private

Member Function Documentation

ObservableResult org.sleuthkit.autopsy.modules.stix.STIXReportModule.evaluateObject ( ObjectType  obj,
String  spacing,
String  id 
)
private

Evaluate a STIX object.

Parameters
objThe object to evaluate against the datasource(s)
spacingFor formatting the output
Returns

Definition at line 612 of file STIXReportModule.java.

References org.sleuthkit.autopsy.modules.stix.STIXReportModule.registryFileData.

Referenced by org.sleuthkit.autopsy.modules.stix.STIXReportModule.evaluateSingleObservable().

ObservableResult org.sleuthkit.autopsy.modules.stix.STIXReportModule.evaluateObservableComposition ( ObservableCompositionType  comp,
String  spacing 
) throws TskCoreException
private

Evaluate an observable composition. Can be called recursively.

Parameters
compThe observable composition object to evaluate
spacingUsed to formatting the output
Returns
The status of the composition
Exceptions
TskCoreException

Definition at line 475 of file STIXReportModule.java.

References org.sleuthkit.autopsy.modules.stix.STIXReportModule.evaluateSingleObservable().

Referenced by org.sleuthkit.autopsy.modules.stix.STIXReportModule.processIndicators().

ObservableResult org.sleuthkit.autopsy.modules.stix.STIXReportModule.evaluateSingleObservable ( Observable  obs,
String  spacing 
) throws TskCoreException
private

Evaluate one observable and return the result. This is at the end of the observable composition tree and will not be called recursively.

Parameters
obsThe observable object to evaluate
spacingFor formatting the output
Returns
The status of the observable
Exceptions
TskCoreException

Definition at line 571 of file STIXReportModule.java.

References org.sleuthkit.autopsy.modules.stix.STIXReportModule.evaluateObject(), org.sleuthkit.autopsy.modules.stix.STIXReportModule.makeMapKey(), and org.sleuthkit.autopsy.modules.stix.STIXReportModule.saveToObjectMap().

Referenced by org.sleuthkit.autopsy.modules.stix.STIXReportModule.evaluateObservableComposition(), and org.sleuthkit.autopsy.modules.stix.STIXReportModule.processIndicators().

void org.sleuthkit.autopsy.modules.stix.STIXReportModule.generateReport ( String  baseReportDir,
ReportProgressPanel  progressPanel 
)
JPanel org.sleuthkit.autopsy.modules.stix.STIXReportModule.getConfigurationPanel ( )

Returns the configuration panel for the report, which is displayed in the report configuration step of the report wizard.

Returns
Configuration panel or null if the module does not need configuration.

Implements org.sleuthkit.autopsy.report.GeneralReportModule.

Definition at line 669 of file STIXReportModule.java.

References org.sleuthkit.autopsy.modules.stix.STIXReportModule.configPanel.

static synchronized STIXReportModule org.sleuthkit.autopsy.modules.stix.STIXReportModule.getDefault ( )
static
String org.sleuthkit.autopsy.modules.stix.STIXReportModule.getDescription ( )

Definition at line 663 of file STIXReportModule.java.

String org.sleuthkit.autopsy.modules.stix.STIXReportModule.getName ( )

Definition at line 652 of file STIXReportModule.java.

String org.sleuthkit.autopsy.modules.stix.STIXReportModule.getRelativeFilePath ( )
STIXPackage org.sleuthkit.autopsy.modules.stix.STIXReportModule.loadSTIXFile ( String  stixFileName) throws TskCoreException
private

Load a STIX-formatted XML file into a STIXPackage object.

Parameters
stixFileNameName of the STIX file to unmarshal
Returns
Unmarshalled file contents
Exceptions
TskCoreException

Definition at line 257 of file STIXReportModule.java.

Referenced by org.sleuthkit.autopsy.modules.stix.STIXReportModule.processFile().

String org.sleuthkit.autopsy.modules.stix.STIXReportModule.makeMapKey ( Observable  obs)
private

Use the ID or ID ref to create a key into the observable map.

Parameters
obs
Returns

Definition at line 440 of file STIXReportModule.java.

Referenced by org.sleuthkit.autopsy.modules.stix.STIXReportModule.evaluateSingleObservable(), and org.sleuthkit.autopsy.modules.stix.STIXReportModule.saveToObjectMap().

void org.sleuthkit.autopsy.modules.stix.STIXReportModule.printFileHeader ( String  a_fileName)
private

Write the a header for the current file to the output file.

Parameters
a_fileName

Definition at line 415 of file STIXReportModule.java.

Referenced by org.sleuthkit.autopsy.modules.stix.STIXReportModule.processFile().

void org.sleuthkit.autopsy.modules.stix.STIXReportModule.processFile ( String  stixFile,
ReportProgressPanel  progressPanel 
) throws TskCoreException
private
void org.sleuthkit.autopsy.modules.stix.STIXReportModule.processIndicators ( STIXPackage  stix) throws TskCoreException
private
void org.sleuthkit.autopsy.modules.stix.STIXReportModule.processObservables ( STIXPackage  stix)
private

Do the initial processing of the list of observables. For each observable, save it in a map using the ID as key.

Parameters
stixSTIXPackage

Definition at line 278 of file STIXReportModule.java.

References org.sleuthkit.autopsy.modules.stix.STIXReportModule.saveToObjectMap().

Referenced by org.sleuthkit.autopsy.modules.stix.STIXReportModule.processFile().

void org.sleuthkit.autopsy.modules.stix.STIXReportModule.saveResultsAsArtifacts ( Indicator  ind,
ObservableResult  result 
) throws TskCoreException
private

Create the artifacts saved in the observable result.

Parameters
ind
result
Exceptions
TskCoreException

Definition at line 334 of file STIXReportModule.java.

References org.sleuthkit.autopsy.coreutils.MessageNotifyUtil.MessageType.INFO, and org.sleuthkit.autopsy.coreutils.MessageNotifyUtil.Notify.show().

Referenced by org.sleuthkit.autopsy.modules.stix.STIXReportModule.processIndicators().

void org.sleuthkit.autopsy.modules.stix.STIXReportModule.saveToObjectMap ( Observable  obs)
private
void org.sleuthkit.autopsy.modules.stix.STIXReportModule.writeResultsToFile ( Indicator  ind,
String  resultStr,
boolean  found 
)
private

Write the full results string to the output file.

Parameters
ind- Used to get the title, ID, and description of the indicator
resultStr- Full results for this indicator
found- true if the indicator was found in datasource(s)

Definition at line 379 of file STIXReportModule.java.

Referenced by org.sleuthkit.autopsy.modules.stix.STIXReportModule.processIndicators().

Member Data Documentation

STIXReportModuleConfigPanel org.sleuthkit.autopsy.modules.stix.STIXReportModule.configPanel
private
Map<String, ObjectType> org.sleuthkit.autopsy.modules.stix.STIXReportModule.idToObjectMap = new HashMap<String, ObjectType>()
private

Definition at line 75 of file STIXReportModule.java.

Map<String, ObservableResult> org.sleuthkit.autopsy.modules.stix.STIXReportModule.idToResult = new HashMap<String, ObservableResult>()
private

Definition at line 76 of file STIXReportModule.java.

STIXReportModule org.sleuthkit.autopsy.modules.stix.STIXReportModule.instance = null
staticprivate
final Logger org.sleuthkit.autopsy.modules.stix.STIXReportModule.logger = Logger.getLogger(STIXReportModule.class.getName())
staticprivate

Definition at line 69 of file STIXReportModule.java.

BufferedWriter org.sleuthkit.autopsy.modules.stix.STIXReportModule.output = null
private

Definition at line 82 of file STIXReportModule.java.

List<EvalRegistryObj.RegistryFileInfo> org.sleuthkit.autopsy.modules.stix.STIXReportModule.registryFileData = null
private
boolean org.sleuthkit.autopsy.modules.stix.STIXReportModule.reportAllResults
private
String org.sleuthkit.autopsy.modules.stix.STIXReportModule.reportPath
private
final boolean org.sleuthkit.autopsy.modules.stix.STIXReportModule.skipShortCircuit = true
private

Definition at line 80 of file STIXReportModule.java.


The documentation for this class was generated from the following file:

Copyright © 2012-2015 Basis Technology. Generated on: Wed Apr 6 2016
This work is licensed under a Creative Commons Attribution-Share Alike 3.0 United States License.