(filepath='', attributes=[])
| 179 | |
| 180 | |
| 181 | def read_sysmon_log(filepath='', attributes=[]): |
| 182 | # ------- |
| 183 | # Function definition: 'read_sysmon_log': |
| 184 | # (1) read 'sysmon_log'.json |
| 185 | # (2) select required attributes of sysmon_log.json |
| 186 | # (3) remove duplicated records |
| 187 | # (4) padding missing records as 0 |
| 188 | # ------- |
| 189 | # Required parameters: |
| 190 | # (1) 'filepath' (string): file path of a targeted sysmon_log.json |
| 191 | # (2) 'attributes' (list): a list of selected attributes from sysmon_log,json, such as 'ProcessId','ProcessGuid' |
| 192 | # ------- |
| 193 | # Return: a DataFrame of sysmon_log.json |
| 194 | # -------- |
| 195 | Sysmon_Log = pd.read_json(filepath, orient='columuns') |
| 196 | print('Completed: load', filepath) |
| 197 | Sysmon_Log = pd.DataFrame(Sysmon_Log, columns=attributes) |
| 198 | print('Selected attributes:', list(Sysmon_Log)) |
| 199 | Sysmon_Log = Sysmon_Log.applymap(lambda s: s.lower() if type(s) == str else s) |
| 200 | Sysmon_Log = Sysmon_Log.drop_duplicates() |
| 201 | print('Completed: drop duplicated records from sysmon log') |
| 202 | Sysmon_Log = Sysmon_Log.fillna(0) |
| 203 | print('Completed: padding missing records as 0') |
| 204 | return Sysmon_Log |
| 205 | |
| 206 | |
| 207 | def select_unique_records(sysmon_log='', attribute=''): |
no outgoing calls
no test coverage detected