Difference between revisions of "TruxtonFileIO newevent"
Jump to navigation
Jump to search
(Created page with "This create new event from a file in Truxton. It automatically associates the parent file and media identifiers used in the Event table. =Syntax= <syntaxhig...") |
(→Sample) |
||
| Line 12: | Line 12: | ||
=Sample= | =Sample= | ||
| − | <syntaxhighlight lang="Python" highlight=" | + | <syntaxhighlight lang="Python" highlight="15"> |
import truxton | import truxton | ||
| + | from datetime import datetime | ||
| + | from calendar import timegm | ||
| + | |||
| + | EPOCH_AS_FILETIME = 116444736000000000 | ||
| + | HUNDREDS_OF_NANOSECONDS = 10000000 | ||
| + | |||
| + | def date_to_filetime(dt): | ||
| + | return EPOCH_AS_FILETIME + (timegm(dt.timetuple()) * HUNDREDS_OF_NANOSECONDS) | ||
def main(): | def main(): | ||
| Line 21: | Line 29: | ||
event = file.newevent() | event = file.newevent() | ||
| − | event. | + | event.title = "Python Executed" |
| − | + | event.description = "Created from Python!" | |
| − | + | event.type = truxton.EVENT_TYPE_ADDED_BY_ANALYST | |
| − | if | + | event.start = date_to_filetime(datetime.utcnow()) |
| − | print( "New | + | |
| + | if event.save() is True: | ||
| + | print( "New event saved as id " + event.id) | ||
if __name__ == "__main__": | if __name__ == "__main__": | ||
main() | main() | ||
| + | |||
</syntaxhighlight> | </syntaxhighlight> | ||
Revision as of 14:26, 21 May 2020
This create new event from a file in Truxton. It automatically associates the parent file and media identifiers used in the Event table.
Syntax
object newevent();
Return value
An event object
Sample
import truxton
from datetime import datetime
from calendar import timegm
EPOCH_AS_FILETIME = 116444736000000000
HUNDREDS_OF_NANOSECONDS = 10000000
def date_to_filetime(dt):
return EPOCH_AS_FILETIME + (timegm(dt.timetuple()) * HUNDREDS_OF_NANOSECONDS)
def main():
t = truxton.create()
file = t.getfileid("5ec2a123-74d6-5da7-0653-4e6800000000")
event = file.newevent()
event.title = "Python Executed"
event.description = "Created from Python!"
event.type = truxton.EVENT_TYPE_ADDED_BY_ANALYST
event.start = date_to_filetime(datetime.utcnow())
if event.save() is True:
print( "New event saved as id " + event.id)
if __name__ == "__main__":
main()