def parse_ouput(self, data, context, response):
        '''
        Parse the output from Invoke-BloodHound
        '''

        parsedData = data.split("!-!")
        nameList = ['user_sessions', 'group_membership.csv', 'acls.csv', 'local_admins.csv', 'trusts.csv']
        for x in range(0, len(parsedData)):
            if "ComputerName" in parsedData[x] and "UserName" in parsedData[x] :
                log_name = '{}-{}-{}.csv'.format(nameList[0], response.client_address[0], datetime.now().strftime("%Y-%m-%d_%H%M%S"))
                write_log(parsedData[x].replace('" "', '"\n"').replace(' "', '"'), log_name)
                context.log.info("Saved csv output to {}".format(log_name))
            elif "GroupName" in parsedData[x] and "AccountName" in parsedData[x] :
                log_name = '{}-{}-{}.csv'.format(nameList[1], response.client_address[0], datetime.now().strftime("%Y-%m-%d_%H%M%S"))
                write_log(parsedData[x].replace('" "', '"\n"').replace(' "', '"'), log_name)
                context.log.info("Saved csv output to {}".format(log_name))
            elif "ComputerName" in parsedData[x] and "AccountName" in parsedData[x] :
                log_name = '{}-{}-{}.csv'.format(nameList[3], response.client_address[0], datetime.now().strftime("%Y-%m-%d_%H%M%S"))
                write_log(parsedData[x].replace('" "', '"\n"').replace(' "', '"'), log_name)
                context.log.info("Saved csv output to {}".format(log_name))
            elif "SourceDomain" in parsedData[x] and "TrustType" in parsedData[x] :
                log_name = '{}-{}-{}.csv'.format(nameList[4], response.client_address[0], datetime.now().strftime("%Y-%m-%d_%H%M%S"))
                write_log(parsedData[x].replace('" "', '"\n"').replace(' "', '"'), log_name)
                context.log.info("Saved csv output to {}".format(log_name))
            elif "ObjectName" in parsedData[x] and "ObjectType" in parsedData[x] :
                log_name = '{}-{}-{}.csv'.format(nameList[2], response.client_address[0], datetime.now().strftime("%Y-%m-%d_%H%M%S"))
                write_log(parsedData[x].replace('" "', '"\n"').replace(' "', '"'), log_name)
                context.log.info("Saved csv output to {}".format(log_name))
def parse_ouput ( self , data , context , response ) : parsedData = data . split ( "!-!" ) nameList = [ 'user_sessions' , 'group_membership.csv' , 'acls.csv' , 'local_admins.csv' , 'trusts.csv' ] for x in range ( 0 , len ( parsedData ) ) : if "ComputerName" in parsedData [ x ] and "UserName" in parsedData [ x ] : log_name = '{}-{}-{}.csv' . format ( nameList [ 0 ] , response . client_address [ 0 ] , datetime . now ( ) . strftime ( "%Y-%m-%d_%H%M%S" ) ) write_log ( parsedData [ x ] . replace ( '" "' , '"\n"' ) . replace ( ' "' , '"' ) , log_name ) context . log . info ( "Saved csv output to {}" . format ( log_name ) ) elif "GroupName" in parsedData [ x ] and "AccountName" in parsedData [ x ] : log_name = '{}-{}-{}.csv' . format ( nameList [ 1 ] , response . client_address [ 0 ] , datetime . now ( ) . strftime ( "%Y-%m-%d_%H%M%S" ) ) write_log ( parsedData [ x ] . replace ( '" "' , '"\n"' ) . replace ( ' "' , '"' ) , log_name ) context . log . info ( "Saved csv output to {}" . format ( log_name ) ) elif "ComputerName" in parsedData [ x ] and "AccountName" in parsedData [ x ] : log_name = '{}-{}-{}.csv' . format ( nameList [ 3 ] , response . client_address [ 0 ] , datetime . now ( ) . strftime ( "%Y-%m-%d_%H%M%S" ) ) write_log ( parsedData [ x ] . replace ( '" "' , '"\n"' ) . replace ( ' "' , '"' ) , log_name ) context . log . info ( "Saved csv output to {}" . format ( log_name ) ) elif "SourceDomain" in parsedData [ x ] and "TrustType" in parsedData [ x ] : log_name = '{}-{}-{}.csv' . format ( nameList [ 4 ] , response . client_address [ 0 ] , datetime . now ( ) . strftime ( "%Y-%m-%d_%H%M%S" ) ) write_log ( parsedData [ x ] . replace ( '" "' , '"\n"' ) . replace ( ' "' , '"' ) , log_name ) context . log . info ( "Saved csv output to {}" . format ( log_name ) ) elif "ObjectName" in parsedData [ x ] and "ObjectType" in parsedData [ x ] : log_name = '{}-{}-{}.csv' . format ( nameList [ 2 ] , response . client_address [ 0 ] , datetime . now ( ) . strftime ( "%Y-%m-%d_%H%M%S" ) ) write_log ( parsedData [ x ] . replace ( '" "' , '"\n"' ) . replace ( ' "' , '"' ) , log_name ) context . log . info ( "Saved csv output to {}" . format ( log_name ) )
Parse the output from Invoke-BloodHound