TruxtonRelation

This class lets you add to the Relation table in Truxton. This is how to establish some sort of relation between items in Truxton to create a graph.

Attributes and Methods

a

This is the GUID of the object this artifact came from. This combined with objecttype allows Truxton to track derivative entities such as a search term coming from a URL found in a browser cache.

b

This is the GUID of the object this artifact came from. This combined with objecttype allows Truxton to track derivative entities such as a search term coming from a URL found in a browser cache.

source

This is the GUID of the object this artifact came from. This combined with objecttype allows Truxton to track derivative entities such as a search term coming from a URL found in a browser cache.

objectid

In this example, fileid would point to the browser cache File record and objectid would point to the record in the WebsiteVisit table.

objecttype

The type of the object. This corresponds to the ObjectTypeID column of the Entity table.

save()

This will commit the information to the Relation table. It will return True if the record was saved to the database, False if there was an error.

Sample

import truxton
import shutil

from datetime import datetime
from calendar import timegm
from pathlib import Path

EPOCH_AS_FILETIME = 116444736000000000
HUNDREDS_OF_NANOSECONDS = 10000000

def date_to_filetime(dt):
  return EPOCH_AS_FILETIME + (timegm(dt.timetuple()) * HUNDREDS_OF_NANOSECONDS)

def create_event_type(t, id, name):
  event_type = t.neweventtype()
  event_type.id = id
  event_type.name = name
  event_type.save()

def add_file(parent_truxton_file, filename):
  source_file = open(filename, "rb")
  child = parent_truxton_file.newchild()
  child.name = Path(filename).name
  shutil.copyfileobj(source_file, child)
  source_file.close()
  child.save()

  return child

def add_media(t):
  media = t.newmedia()
  media.name = "Public Documents"
  media.description = "Publicly available documents"
  media.case = "DC-SNAFU-2016.2020"
  media.evidencebag = "EV-0937459386623-a"
  media.originator = "Jeffrey Jensen"
  media.latitude = 38.897661
  media.longitude = -77.036458
  media.type = truxton.MEDIA_TYPE_LOGICAL_FILES
  media.save()

  return media

def add_ec(parent_file ):
  child_file = add_file(parent_file, "JW-v-DOJ-reply-02743.pdf")

  artifact = child_file.newartifact()
  artifact.type = truxton.ENTITY_TYPE_AUTHOR
  artifact.value = "Bob Smith"
  artifact.datatype = truxton.DATA_TYPE_ASCII
  artifact.length = 9
  artifact.save()

def main():
  t = truxton.create()

  media = add_media(t)

  root_file = media.addroot()
  root_file.save()

  add_ec(root_file)

if __name__ == "__main__":
  main()