Difference between revisions of "TruxtonEvent"

From truxwiki.com
Jump to navigation Jump to search
Line 1: Line 1:
This class lets you add to the Event table in Truxton.
+
This class lets you add to the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table in Truxton.
 
=Attributes and Methods=
 
=Attributes and Methods=
 
==<code>id</code>==
 
==<code>id</code>==
 
This is the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the event.
 
This is the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the event.
 
It becomes non-zero after <code>save()</code> has been called.
 
It becomes non-zero after <code>save()</code> has been called.
 +
This corresponds to the <code>[ID]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
  
 
==<code>description</code>==
 
==<code>description</code>==
 
The longer description of the event.
 
The longer description of the event.
 +
This corresponds to the <code>[Description]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
  
 
==<code>end</code>==
 
==<code>end</code>==
 
When the event ended in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks.
 
When the event ended in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks.
This corresponds to the <code>End</code> column of the <code>Event</code> table.
+
This corresponds to the <code>[End]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
  
 
==<code>fileid</code>==
 
==<code>fileid</code>==
 
The [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the file this event came from.
 
The [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the file this event came from.
This corresponds to the <code>FileID</code> column of the <code>Event</code> table.
+
This corresponds to the <code>[FileID]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
  
 
==<code>mediaid</code>==
 
==<code>mediaid</code>==
 
This is the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the media this event came from.
 
This is the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the media this event came from.
This identifier corresponds to the <code>MediaID</code> of the <code>Event</code> table.
+
This identifier corresponds to the <code>[MediaID]</code> of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
  
 
==<code>save()</code>==
 
==<code>save()</code>==
This will commit the information to the <code>Event</code> table.
+
This will commit the information to the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
  
 
==<code>tag(tag, reason, origin)</code>==
 
==<code>tag(tag, reason, origin)</code>==
 
This creates a tag associated with this event in Truxton.
 
This creates a tag associated with this event in Truxton.
 
The <code>tag</code> parameter is a short, one or two word, bit of text that will be displayed in the UI.
 
The <code>tag</code> parameter is a short, one or two word, bit of text that will be displayed in the UI.
The <code>reason</code> a sentence explaining why this event was tagged.
+
The <code>reason</code> is a sentence explaining why this event was tagged.
 
The <code>origin</code> is either <code>TAG_ORIGIN_AUTOMATIC</code> (1) or <code>TAG_ORIGIN_HUMAN</code> (2).
 
The <code>origin</code> is either <code>TAG_ORIGIN_AUTOMATIC</code> (1) or <code>TAG_ORIGIN_HUMAN</code> (2).
 
It will return  
 
It will return  
Line 33: Line 35:
 
==<code>start</code>==
 
==<code>start</code>==
 
When the event began in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks.
 
When the event began in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks.
This corresponds to the <code>Start</code> column of the <code>Event</code> table.
+
This corresponds to the <code>[Start]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
  
 
==<code>title</code>==
 
==<code>title</code>==
This corresponds to the <code>Title</code> column of the <code>Event</code> table.
+
This corresponds to the <code>[Title]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
  
 
==<code>type</code>==
 
==<code>type</code>==
This corresponds to the <code>EventTypeID</code> column of the <code>Event</code> table.
+
This corresponds to the <code>[EventTypeID]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
It should contain a value from the <code>ID</code> column of the <code>EventType</code> table.
+
It should contain a value from the <code>[ID]</code> column of the <code>[EventType]</code> table.
  
 
=Sample=
 
=Sample=
 
+
<source lang="Python" highlight="32-38">
<syntaxhighlight lang="Python" highlight="32-38">
 
 
import truxton
 
import truxton
 
import shutil
 
import shutil
Line 134: Line 135:
 
if __name__ == "__main__":
 
if __name__ == "__main__":
 
   main()
 
   main()
</syntaxhighlight>
+
</source>

Revision as of 07:32, 8 December 2020

This class lets you add to the [Event] table in Truxton.

Attributes and Methods

id

This is the GUID of the event. It becomes non-zero after save() has been called. This corresponds to the [ID] column of the [Event] table.

description

The longer description of the event. This corresponds to the [Description] column of the [Event] table.

end

When the event ended in FILETIME ticks. This corresponds to the [End] column of the [Event] table.

fileid

The GUID of the file this event came from. This corresponds to the [FileID] column of the [Event] table.

mediaid

This is the GUID of the media this event came from. This identifier corresponds to the [MediaID] of the [Event] table.

save()

This will commit the information to the [Event] table.

tag(tag, reason, origin)

This creates a tag associated with this event in Truxton. The tag parameter is a short, one or two word, bit of text that will be displayed in the UI. The reason is a sentence explaining why this event was tagged. The origin is either TAG_ORIGIN_AUTOMATIC (1) or TAG_ORIGIN_HUMAN (2). It will return True if the tag was associated with the file, False on failure.

start

When the event began in FILETIME ticks. This corresponds to the [Start] column of the [Event] table.

title

This corresponds to the [Title] column of the [Event] table.

type

This corresponds to the [EventTypeID] column of the [Event] table. It should contain a value from the [ID] column of the [EventType] table.

Sample

import truxton
import shutil

from datetime import datetime
from calendar import timegm
from pathlib import Path

EPOCH_AS_FILETIME = 116444736000000000
HUNDREDS_OF_NANOSECONDS = 10000000

EVENT_TYPE_FBI = 20001

def date_to_filetime(dt):
  return EPOCH_AS_FILETIME + (timegm(dt.timetuple()) * HUNDREDS_OF_NANOSECONDS)

def create_event_type(t, id, name):
  event_type = t.neweventtype()
  event_type.id = id
  event_type.name = name
  event_type.save()

def add_file(parent_truxton_file, filename):
  source_file = open(filename, "rb")
  child = parent_truxton_file.newchild()
  child.name = Path(filename).name
  shutil.copyfileobj(source_file, child)
  source_file.close()
  child.save()
  return child

def add_event(parent_file, start, end, title, description, type):
  event = parent_file.newevent()
  event.start = date_to_filetime(datetime.fromisoformat(start))
  event.end = date_to_filetime(datetime.fromisoformat(end))
  event.title = title
  event.description = description
  event.type = type
  event.save()
  return event

def add_media(t):
  media = t.newmedia()

  media.name = "Public Documents"
  media.description = "Publicly available documents"
  media.case = "DC-SNAFU-2016.2020"
  media.evidencebag = "EV-0937459386623-a"
  media.originator = "Jeffrey Jensen"
  media.latitude = 38.897661
  media.longitude = -77.036458
  media.type = truxton.MEDIA_TYPE_LOGICAL_FILES

  if media.save():
    print("Media saved")
  else:
    print("Media not saved")

  return media

def add_ec(parent_file ):
  child_file = add_file(parent_file, "JW-v-DOJ-reply-02743.pdf")

  url = child_file.newurl()
  url.url = "https://www.judicialwatch.org/documents/jw-v-doj-reply-02743/"
  url.localfilename = "JW-v-DOJ-reply-02743.pdf"
  url.type = truxton.URL_TYPE_FIREFOX
  url.method = truxton.URL_METHOD_TYPE_CLICKED_ON_A_LINK
  url.format = truxton.URL_FORMAT_ASCII
  url.when = date_to_filetime(datetime.fromisoformat("2020-05-20T00:00:00-05:00"))
  url.save()

  add_event( child_file, "2016-07-31T12:00:00-05:00", "2016-07-31T12:00:00-05:00", "Crossfire Hurricane Created", "At FBI HQ", EVENT_TYPE_FBI )
  add_event( child_file, "2016-07-27T12:00:00-05:00", "2016-07-27T12:00:00-05:00", "Legat called needing to meet US ambassador", "In London", EVENT_TYPE_FBI )
  add_event( child_file, "2016-07-29T12:00:00-05:00", "2016-07-29T12:00:00-05:00", "FBI Receives Downer Info from Legat", "Probably legat London", EVENT_TYPE_FBI )

def main():
  t = truxton.create()

  create_event_type(t, EVENT_TYPE_FBI, "FBI Actions" )

  media = add_media(t)

  root_file = media.addroot()
  root_file.save()

  add_ec(root_file)

if __name__ == "__main__":
  main()