Difference between revisions of "TruxtonEvent"
(→Sample) |
|||
| Line 1: | Line 1: | ||
| − | This class lets you add to the Event table in Truxton. | + | This class lets you add to the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table in Truxton. |
=Attributes and Methods= | =Attributes and Methods= | ||
==<code>id</code>== | ==<code>id</code>== | ||
This is the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the event. | This is the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the event. | ||
It becomes non-zero after <code>save()</code> has been called. | It becomes non-zero after <code>save()</code> has been called. | ||
| + | This corresponds to the <code>[ID]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table. | ||
==<code>description</code>== | ==<code>description</code>== | ||
The longer description of the event. | The longer description of the event. | ||
| + | This corresponds to the <code>[Description]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table. | ||
==<code>end</code>== | ==<code>end</code>== | ||
When the event ended in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks. | When the event ended in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks. | ||
| − | This corresponds to the <code>End</code> column of the <code>Event</code> table. | + | This corresponds to the <code>[End]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table. |
==<code>fileid</code>== | ==<code>fileid</code>== | ||
The [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the file this event came from. | The [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the file this event came from. | ||
| − | This corresponds to the <code>FileID</code> column of the <code>Event</code> table. | + | This corresponds to the <code>[FileID]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table. |
==<code>mediaid</code>== | ==<code>mediaid</code>== | ||
This is the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the media this event came from. | This is the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the media this event came from. | ||
| − | This identifier corresponds to the <code>MediaID</code> of the <code>Event</code> table. | + | This identifier corresponds to the <code>[MediaID]</code> of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table. |
==<code>save()</code>== | ==<code>save()</code>== | ||
| − | This will commit the information to the <code>Event</code> table. | + | This will commit the information to the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table. |
==<code>tag(tag, reason, origin)</code>== | ==<code>tag(tag, reason, origin)</code>== | ||
This creates a tag associated with this event in Truxton. | This creates a tag associated with this event in Truxton. | ||
The <code>tag</code> parameter is a short, one or two word, bit of text that will be displayed in the UI. | The <code>tag</code> parameter is a short, one or two word, bit of text that will be displayed in the UI. | ||
| − | The <code>reason</code> a sentence explaining why this event was tagged. | + | The <code>reason</code> is a sentence explaining why this event was tagged. |
The <code>origin</code> is either <code>TAG_ORIGIN_AUTOMATIC</code> (1) or <code>TAG_ORIGIN_HUMAN</code> (2). | The <code>origin</code> is either <code>TAG_ORIGIN_AUTOMATIC</code> (1) or <code>TAG_ORIGIN_HUMAN</code> (2). | ||
It will return | It will return | ||
| Line 33: | Line 35: | ||
==<code>start</code>== | ==<code>start</code>== | ||
When the event began in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks. | When the event began in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks. | ||
| − | This corresponds to the <code>Start</code> column of the <code>Event</code> table. | + | This corresponds to the <code>[Start]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table. |
==<code>title</code>== | ==<code>title</code>== | ||
| − | This corresponds to the <code>Title</code> column of the <code>Event</code> table. | + | This corresponds to the <code>[Title]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table. |
==<code>type</code>== | ==<code>type</code>== | ||
| − | This corresponds to the <code>EventTypeID</code> column of the <code>Event</code> table. | + | This corresponds to the <code>[EventTypeID]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table. |
| − | It should contain a value from the <code>ID</code> column of the <code>EventType</code> table. | + | It should contain a value from the <code>[ID]</code> column of the <code>[EventType]</code> table. |
=Sample= | =Sample= | ||
| − | + | <source lang="Python" highlight="32-38"> | |
| − | < | ||
import truxton | import truxton | ||
import shutil | import shutil | ||
| Line 134: | Line 135: | ||
if __name__ == "__main__": | if __name__ == "__main__": | ||
main() | main() | ||
| − | </ | + | </source> |
Revision as of 07:32, 8 December 2020
This class lets you add to the [Event] table in Truxton.
Contents
Attributes and Methods
id
This is the GUID of the event.
It becomes non-zero after save() has been called.
This corresponds to the [ID] column of the [Event] table.
description
The longer description of the event.
This corresponds to the [Description] column of the [Event] table.
end
When the event ended in FILETIME ticks.
This corresponds to the [End] column of the [Event] table.
fileid
The GUID of the file this event came from.
This corresponds to the [FileID] column of the [Event] table.
mediaid
This is the GUID of the media this event came from.
This identifier corresponds to the [MediaID] of the [Event] table.
save()
This will commit the information to the [Event] table.
tag(tag, reason, origin)
This creates a tag associated with this event in Truxton.
The tag parameter is a short, one or two word, bit of text that will be displayed in the UI.
The reason is a sentence explaining why this event was tagged.
The origin is either TAG_ORIGIN_AUTOMATIC (1) or TAG_ORIGIN_HUMAN (2).
It will return
True if the tag was associated with the file, False on failure.
start
When the event began in FILETIME ticks.
This corresponds to the [Start] column of the [Event] table.
title
This corresponds to the [Title] column of the [Event] table.
type
This corresponds to the [EventTypeID] column of the [Event] table.
It should contain a value from the [ID] column of the [EventType] table.
Sample
import truxton
import shutil
from datetime import datetime
from calendar import timegm
from pathlib import Path
EPOCH_AS_FILETIME = 116444736000000000
HUNDREDS_OF_NANOSECONDS = 10000000
EVENT_TYPE_FBI = 20001
def date_to_filetime(dt):
return EPOCH_AS_FILETIME + (timegm(dt.timetuple()) * HUNDREDS_OF_NANOSECONDS)
def create_event_type(t, id, name):
event_type = t.neweventtype()
event_type.id = id
event_type.name = name
event_type.save()
def add_file(parent_truxton_file, filename):
source_file = open(filename, "rb")
child = parent_truxton_file.newchild()
child.name = Path(filename).name
shutil.copyfileobj(source_file, child)
source_file.close()
child.save()
return child
def add_event(parent_file, start, end, title, description, type):
event = parent_file.newevent()
event.start = date_to_filetime(datetime.fromisoformat(start))
event.end = date_to_filetime(datetime.fromisoformat(end))
event.title = title
event.description = description
event.type = type
event.save()
return event
def add_media(t):
media = t.newmedia()
media.name = "Public Documents"
media.description = "Publicly available documents"
media.case = "DC-SNAFU-2016.2020"
media.evidencebag = "EV-0937459386623-a"
media.originator = "Jeffrey Jensen"
media.latitude = 38.897661
media.longitude = -77.036458
media.type = truxton.MEDIA_TYPE_LOGICAL_FILES
if media.save():
print("Media saved")
else:
print("Media not saved")
return media
def add_ec(parent_file ):
child_file = add_file(parent_file, "JW-v-DOJ-reply-02743.pdf")
url = child_file.newurl()
url.url = "https://www.judicialwatch.org/documents/jw-v-doj-reply-02743/"
url.localfilename = "JW-v-DOJ-reply-02743.pdf"
url.type = truxton.URL_TYPE_FIREFOX
url.method = truxton.URL_METHOD_TYPE_CLICKED_ON_A_LINK
url.format = truxton.URL_FORMAT_ASCII
url.when = date_to_filetime(datetime.fromisoformat("2020-05-20T00:00:00-05:00"))
url.save()
add_event( child_file, "2016-07-31T12:00:00-05:00", "2016-07-31T12:00:00-05:00", "Crossfire Hurricane Created", "At FBI HQ", EVENT_TYPE_FBI )
add_event( child_file, "2016-07-27T12:00:00-05:00", "2016-07-27T12:00:00-05:00", "Legat called needing to meet US ambassador", "In London", EVENT_TYPE_FBI )
add_event( child_file, "2016-07-29T12:00:00-05:00", "2016-07-29T12:00:00-05:00", "FBI Receives Downer Info from Legat", "Probably legat London", EVENT_TYPE_FBI )
def main():
t = truxton.create()
create_event_type(t, EVENT_TYPE_FBI, "FBI Actions" )
media = add_media(t)
root_file = media.addroot()
root_file.save()
add_ec(root_file)
if __name__ == "__main__":
main()