shanekent / pyeventlogviewer Goto Github PK
View Code? Open in Web Editor NEWLicense: MIT License
License: MIT License
To implement:
BooleanVar
there that controls column state. It may not be possible to do this directly in the timeline __init__
.Verify that the state is preserved if the project is saved, closed, and opened again when...
Verify that the state is preserved if the timeline is re-rendered by...
Other:
Allow the user to configure colors by event id. Create a default color configuration and save user edits on a per-project basis.
Some log files appear to have characters that don't play nice with xmltodict. Find a way to clean logs of these characters and remove them.
We should set up a unit testing framework. Pytest might be a good one.
Create a draft by 10/6. Final document due by 10/11.
The user doesn't need to see a hash of the source file. That data is meaningless to them. Instead, display the alias of the source file.
I'm not sure how much of this is necessary, but the current code in util.data copies the latest version of the config in the package into the application directory if it doesn't already exist there.
#47 requires the user to delete that copy if they want to grab the latest version of the config.
It may be useful to add a UI for project-independent settings where the user can 'reset to default,' which would overwrite the application copy with the version in the package. Other configuration can be done here as well, such as editing the default colors for any project.
This may be overkill. I'll leave it up to whoever grabs this ticket to decide what direction to take it in.
Create a UI for kicking off the log import process
We need to review the list of logs added/changed in Windows 10 and determine if any changes should be made to the logs we are collecting.
Create the UI for querying the log database.
Filters will be output as (column, operator, value).
Column selectors will be provided as a list of columns to pull.
Reference the DVPR for more details.
Implement the following and record the results in the DVPR. If the test cannot yet be implemented, please document why and file a follow-up issue and link it. If the results of the test indicate that changes must be made, please file a follow-up issue and link it. This is due by 2/14.
Parsing library throws an error
Important record information is not collected during import process
Timeline is exportable to an Excel-compatible format
Log times are displayed in a user-specified timezone
Might want to look into using a right click menu on the timeline.
Add a UI for specifying the name of the project to create. Check to see if that project already exists. Maybe allow the user to specify a different directory to save the project in.
project.get_project_config
to get the project config in an easy to use format.project.filter_logs
to filter a list of logs based on the filter specified.project.is_duplicate
which will return true or false based off of whether the project already contains that log or not. As of the time of writing, this function does not yet have a prototype, but it should go inside of winlogtimeline.util.project.Project
.Generate the program architecture via a block diagram or data flow diagram.
We need to discuss which features are required for a minimum viable product, and which features are a stretch goal (to be implemented after we have a fully working prototype). After we have this list created, we should discuss with the client in order to ensure that we have a complete list and that our priorities align.
Currently, the record parsing is all hard coded. Redesigning it to be more data-driven would allow for the user to easily make changes to the records being scraped from the logs.
Come up with a json-based data structure that describes how to parse a record. This issue can be considered once the redesign has been reviewed and approved by all members of the team.
Create a way for the user to export the logs in an easy-to-read format. CSV is probably the easiest (ensures Excel compatibility).
The status bar increases vertically by a few pixels when the status bar pops up. This issue is considered done once that no longer occurs.
As it stands, the timeline view loads extremely slowly with the number of events that we are gathering. Find a way to fix this.
Pull the deleted event logs into the database.
logs.parse_record
to convert a libevtx record into that representation.logs.sort_logs
to sort a list of logs by a particular value (date, event id, etc).Make a loading bar to give the user feedback on how far in the import process the program is. Two main parts: parsing events from the event log and rendering the event section.
The client asked that we review the events added in Windows 10 to determine if the list of events we are collecting needs to be modified.
Create a pop-up wizard for creating a new project.
This is useful for when we import multiple different EVTX files (i.e. one Security and one System file) from the same computer.
Perform a layout of the basic UI design for our first Sprint.
This appears to be a bug in the version of tk/tcl supplied with macOS.
Resolution
Related issues
Please.
We are currently only getting a portion of the data from the event logs, find out how to get the rest of the data.
Reference the DVPR for more details.
Implement the following and record the results in the DVPR. If the test cannot yet be implemented, please document why and file a follow-up issue and link it. If the results of the test indicate that changes must be made, please file a follow-up issue and link it. This is due by 2/14.
Query fails to return the correct data
Alias used was previously used
Unwanted records are filtered out
collect.collect_records
to collect events from an event log file. Do not include filtering.collect.collect_deleted_records
to carve deleted events from an event log file.collect.get_machine_name
to parse the machine name from an event log file.collect.get_log_file_hash
to get verification info from an event log file.Map existing functionality to the menu and add shortcuts.
Currently, I can think of a few functions that should be added.
I would like this issue to be a location for us to track all menu functionality that should be added.
Have users test the program and gather feedback
Download, install, and run the provided Python library for viewing events.
Labels have a darker background than the rest of the window, which looks kind of odd. No clue why this is. Investigate and fix.
project.load
, project.save
, and project.close
.project.write_log_data
to add a log to the project. This function should call project.is_duplicate
to ensure that duplicate logs are not being added to the file.project.get_all_logs
to return a list of logs contained in the project.See discussion on #63
Sphinx?
An alternative is to manually set up a GitHub wiki and update that. I feel that might be unreliable, and propose that we only use that for functional documentation rather than code documentation.
Reference the DVPR for more details.
Implement the following and record the results in the DVPR. If the test cannot yet be implemented, please document why and file a follow-up issue and link it. If the results of the test indicate that changes must be made, please file a follow-up issue and link it. This is due by 2/14.
Query fails and provides user feedback
Duplicate records are filtered out
Implement a rough GUI prototype containing major UI elements. The elements do not need to be functional for this prototype.
Parts to be implemented include:
Changing the destination directory for the export tool doesn't affect where the .csv file is actually exported. It always gets exported to the project directory.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.