dissect.etl.headers.event
#
Module Contents#
Classes#
An representation of the Event data in a event header. |
|
Enum where members are also (and must be) ints |
|
Loads an extended data item from payload. |
|
A baseclass for the different ETL headers. |
Functions#
Attributes#
- class dissect.etl.headers.event.EventDescriptor(header)#
An representation of the Event data in a event header.
- __slots__ = ['id', 'version', 'channel', 'level', 'opcode', 'task', 'keywords']#
- class dissect.etl.headers.event.ExtType#
Bases:
enum.IntEnum
Enum where members are also (and must be) ints
- RELATED_ACTIVITY_ID = 1#
- SID = 2#
- TS_ID = 3#
- INSTANCE_INFO = 4#
- STACK_TRACE32 = 5#
- STACK_TRACE64 = 6#
- PEBS_INDEX = 7#
- PMC_COUNTERS = 8#
- PSM_KEY = 9#
- EVENT_KEY = 10#
- EVENT_SCHEMA_TL = 11#
- PROV_TRAITS = 12#
- PROCESS_START_KEY = 13#
- TYPE_MAX = 14#
- UNKNOWN = 0#
- dissect.etl.headers.event.extended_data_item_reader#
- class dissect.etl.headers.event.EventHeaderExtendedDataItem(payload)#
Loads an extended data item from payload.
- __slots__ = ['size', 'reserved1', 'ext_type', 'linkage', 'reserved2', 'data_size', 'data', 'raw_data']#
- validate_header() None #
- __getattr__(name: str) Any #
- __repr__()#
Return repr(self).
- class dissect.etl.headers.event.EventHeader(marker: Marker, data: memoryview, etl)#
Bases:
dissect.etl.headers.headers.Header
A baseclass for the different ETL headers.
- property descriptor#
Event descriptor of the header.
- property header_extensions: List[EventHeaderExtendedDataItem]#
A list with all the extended data items for this Event.
- property minimal_size#
Minimum header size.
- property provider_id#
Provider that generated this event.
- property activity_id#
The ID associated with the activity in the event.
At least, that is my assumption.
- property opcode#
The opcode used in this event.
- property thread_id#
The thread id that created this event.
- property process_id#
The process id that created this event.
- additional_header_fields() Dict[str, Any] #
Additional fields that hold interesting information.
each header subclass defines what additional information it wants to return to a record.