{"action":"created","comment":{"url":"https://api.github.com/repos/log2timeline/plaso/pulls/comments/179661432","pull_request_review_id":109947539,"id":179661432,"diff_hunk":"@@ -0,0 +1,77 @@\n+# -*- coding: utf-8 -*-\n+\"\"\"The artifacts filter file CLI arguments helper.\"\"\"\n+\n+from __future__ import unicode_literals\n+\n+import os\n+\n+from plaso.cli import tools\n+from plaso.cli.helpers import interface\n+from plaso.cli.helpers import manager\n+from plaso.lib import errors\n+\n+\n+class ArtifactFiltersArgumentsHelper(interface.ArgumentsHelper):\n+  \"\"\"Artifacts filter file CLI arguments helper.\"\"\"\n+\n+  NAME = 'artifact_filters'\n+  DESCRIPTION = 'Artifact filters command line arguments.'\n+\n+  @classmethod\n+  def AddArguments(cls, argument_group):\n+    \"\"\"Adds command line arguments to an argument group.\n+\n+    This function takes an argument parser or an argument group object and adds\n+    to it all the command line arguments this helper supports.\n+\n+    Args:\n+      argument_group (argparse._ArgumentGroup|argparse.ArgumentParser):\n+          argparse group.\n+    \"\"\"\n+    argument_group.add_argument(\n+        '--artifact_filters', '--artifact-filters',\n+        dest='artifact_filters', type=str, default=None,\n+        action='store', help=(\n+            'Names of forensic artifact definitions, provided in the following'\n+            'formats. (1) Directly on the command line (comma separated), in a'\n+            'in a file with one artifact name per line, or one operating system'\n+            'specific keyword which will process all artifacts supporting that'\n+            'OS (windows, linux, darwin).  Forensic artifacts are stored '\n+            'in .yaml files that are directly pulled from the artifact '\n+            'definitions project. You can also specify a custom artifacts yaml'\n+            'file (see --custom_artifact_definitions).  Artifact definitions '\n+            'can be used to describe and quickly collect data of interest, such'\n+            ' as specific files or Windows Registry keys.'))\n+\n+  @classmethod\n+  def ParseOptions(cls, options, configuration_object):\n+    \"\"\"Parses and validates options.\n+\n+    Args:\n+      options (argparse.Namespace): parser options.\n+      configuration_object (CLITool): object to be configured by the argument\n+          helper.\n+\n+    Raises:\n+      BadConfigObject: when the configuration object is of the wrong type.\n+      BadConfigOption: if the required artifact definitions are not defined.\n+    \"\"\"\n+","path":"plaso/cli/helpers/artifact_filters.py","position":59,"original_position":59,"commit_id":"1f1d100f432f755e6686f0c80eb9109c0c1da371","original_commit_id":"1f1d100f432f755e6686f0c80eb9109c0c1da371","user":{"login":"joachimmetz","id":3888750,"avatar_url":"https://avatars2.githubusercontent.com/u/3888750?v=4","gravatar_id":"","url":"https://api.github.com/users/joachimmetz","html_url":"https://github.com/joachimmetz","followers_url":"https://api.github.com/users/joachimmetz/followers","following_url":"https://api.github.com/users/joachimmetz/following{/other_user}","gists_url":"https://api.github.com/users/joachimmetz/gists{/gist_id}","starred_url":"https://api.github.com/users/joachimmetz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joachimmetz/subscriptions","organizations_url":"https://api.github.com/users/joachimmetz/orgs","repos_url":"https://api.github.com/users/joachimmetz/repos","events_url":"https://api.github.com/users/joachimmetz/events{/privacy}","received_events_url":"https://api.github.com/users/joachimmetz/received_events","type":"User","site_admin":false},"body":"- white line","created_at":"2018-04-06T05:08:37Z","updated_at":"2018-04-06T05:56:08Z","html_url":"https://github.com/log2timeline/plaso/pull/1732#discussion_r179661432","pull_request_url":"https://api.github.com/repos/log2timeline/plaso/pulls/1732","author_association":"OWNER","_links":{"self":{"href":"https://api.github.com/repos/log2timeline/plaso/pulls/comments/179661432"},"html":{"href":"https://github.com/log2timeline/plaso/pull/1732#discussion_r179661432"},"pull_request":{"href":"https://api.github.com/repos/log2timeline/plaso/pulls/1732"}}},"pull_request":{"url":"https://api.github.com/repos/log2timeline/plaso/pulls/1732","id":171226455,"html_url":"https://github.com/log2timeline/plaso/pull/1732","diff_url":"https://github.com/log2timeline/plaso/pull/1732.diff","patch_url":"https://github.com/log2timeline/plaso/pull/1732.patch","issue_url":"https://api.github.com/repos/log2timeline/plaso/issues/1732","number":1732,"state":"open","locked":false,"title":"Issue #1313 added artifacts filter support for files and Windows regi…","user":{"login":"jnettesheim","id":3335365,"avatar_url":"https://avatars0.githubusercontent.com/u/3335365?v=4","gravatar_id":"","url":"https://api.github.com/users/jnettesheim","html_url":"https://github.com/jnettesheim","followers_url":"https://api.github.com/users/jnettesheim/followers","following_url":"https://api.github.com/users/jnettesheim/following{/other_user}","gists_url":"https://api.github.com/users/jnettesheim/gists{/gist_id}","starred_url":"https://api.github.com/users/jnettesheim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jnettesheim/subscriptions","organizations_url":"https://api.github.com/users/jnettesheim/orgs","repos_url":"https://api.github.com/users/jnettesheim/repos","events_url":"https://api.github.com/users/jnettesheim/events{/privacy}","received_events_url":"https://api.github.com/users/jnettesheim/received_events","type":"User","site_admin":false},"body":"## One line description of pull request\r\n\r\nAdding forensic artifact based filters for files and Windows registry keys- issue #1313.\r\n\r\n\r\n## Description:\r\nI've added a first pass at artifacts based filters.  This will only get files and registry keys for now.  I try to log warnings to catch instances where users are including other filters that aren't fully supported yet.\r\n\r\nI'm storing the filter find_specs in the knowledge base, if you would prefer it not be there I can parse the file when needed, it would just lead to me parsing the file multiple times in some cases.\r\n\r\nThis probably also needs an end to end test and would be happy to get that in place.\r\n\r\nSincere apologies for the large PR.\r\n\r\n\r\n**Related issue (if applicable):** adds to fixes for #1313\r\n\r\n## Notes:\r\nOne thing to please look at:\r\nLIne 267 in winreg.py: win_registry._registry_files.clear() ---- I had to call this to clear file not being closed errors, but I don't think we want that.\r\n\r\nAlso, appreciate any notes on glob expansion as I currently have it.\r\n\r\nAll contributions to Plaso undergo [code\r\nreview](https://github.com/log2timeline/plaso/wiki/Codereview). This makes sure\r\nthat the code has appropriate test coverage and conforms to the Plaso [style\r\nguide](https://github.com/log2timeline/plaso/wiki/Style-guide).\r\n\r\nOne of the maintainers will examine your code, and may request changes.\r\n\r\n## Checklist:\r\n  - [Y ] Local tests pass\r\n  - [?] Tests on TravisCI pass\r\n  - [Y] Codacy passes (or flags issues that you think are acceptable) -- Used CodeFactor\r\n  - [?] Coveralls indicates test coverage is sufficient\r\n\r\nIf [new dependencies](https://github.com/log2timeline/plaso/wiki/Adding-a-new-dependency) are required:\r\n - [ ] l2tdevtools has been updated\r\n","created_at":"2018-02-25T11:56:35Z","updated_at":"2018-04-06T05:56:09Z","closed_at":null,"merged_at":null,"merge_commit_sha":"8ec8ce15253369e8d6b338f7bb3e99a5d8d66fea","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/log2timeline/plaso/pulls/1732/commits","review_comments_url":"https://api.github.com/repos/log2timeline/plaso/pulls/1732/comments","review_comment_url":"https://api.github.com/repos/log2timeline/plaso/pulls/comments{/number}","comments_url":"https://api.github.com/repos/log2timeline/plaso/issues/1732/comments","statuses_url":"https://api.github.com/repos/log2timeline/plaso/statuses/1f1d100f432f755e6686f0c80eb9109c0c1da371","head":{"label":"jnettesheim:artifact-filters-feature","ref":"artifact-filters-feature","sha":"1f1d100f432f755e6686f0c80eb9109c0c1da371","user":{"login":"jnettesheim","id":3335365,"avatar_url":"https://avatars0.githubusercontent.com/u/3335365?v=4","gravatar_id":"","url":"https://api.github.com/users/jnettesheim","html_url":"https://github.com/jnettesheim","followers_url":"https://api.github.com/users/jnettesheim/followers","following_url":"https://api.github.com/users/jnettesheim/following{/other_user}","gists_url":"https://api.github.com/users/jnettesheim/gists{/gist_id}","starred_url":"https://api.github.com/users/jnettesheim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jnettesheim/subscriptions","organizations_url":"https://api.github.com/users/jnettesheim/orgs","repos_url":"https://api.github.com/users/jnettesheim/repos","events_url":"https://api.github.com/users/jnettesheim/events{/privacy}","received_events_url":"https://api.github.com/users/jnettesheim/received_events","type":"User","site_admin":false},"repo":{"id":66928019,"name":"plaso","full_name":"jnettesheim/plaso","owner":{"login":"jnettesheim","id":3335365,"avatar_url":"https://avatars0.githubusercontent.com/u/3335365?v=4","gravatar_id":"","url":"https://api.github.com/users/jnettesheim","html_url":"https://github.com/jnettesheim","followers_url":"https://api.github.com/users/jnettesheim/followers","following_url":"https://api.github.com/users/jnettesheim/following{/other_user}","gists_url":"https://api.github.com/users/jnettesheim/gists{/gist_id}","starred_url":"https://api.github.com/users/jnettesheim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jnettesheim/subscriptions","organizations_url":"https://api.github.com/users/jnettesheim/orgs","repos_url":"https://api.github.com/users/jnettesheim/repos","events_url":"https://api.github.com/users/jnettesheim/events{/privacy}","received_events_url":"https://api.github.com/users/jnettesheim/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/jnettesheim/plaso","description":"Super timeline all the things","fork":true,"url":"https://api.github.com/repos/jnettesheim/plaso","forks_url":"https://api.github.com/repos/jnettesheim/plaso/forks","keys_url":"https://api.github.com/repos/jnettesheim/plaso/keys{/key_id}","collaborators_url":"https://api.github.com/repos/jnettesheim/plaso/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/jnettesheim/plaso/teams","hooks_url":"https://api.github.com/repos/jnettesheim/plaso/hooks","issue_events_url":"https://api.github.com/repos/jnettesheim/plaso/issues/events{/number}","events_url":"https://api.github.com/repos/jnettesheim/plaso/events","assignees_url":"https://api.github.com/repos/jnettesheim/plaso/assignees{/user}","branches_url":"https://api.github.com/repos/jnettesheim/plaso/branches{/branch}","tags_url":"https://api.github.com/repos/jnettesheim/plaso/tags","blobs_url":"https://api.github.com/repos/jnettesheim/plaso/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/jnettesheim/plaso/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/jnettesheim/plaso/git/refs{/sha}","trees_url":"https://api.github.com/repos/jnettesheim/plaso/git/trees{/sha}","statuses_url":"https://api.github.com/repos/jnettesheim/plaso/statuses/{sha}","languages_url":"https://api.github.com/repos/jnettesheim/plaso/languages","stargazers_url":"https://api.github.com/repos/jnettesheim/plaso/stargazers","contributors_url":"https://api.github.com/repos/jnettesheim/plaso/contributors","subscribers_url":"https://api.github.com/repos/jnettesheim/plaso/subscribers","subscription_url":"https://api.github.com/repos/jnettesheim/plaso/subscription","commits_url":"https://api.github.com/repos/jnettesheim/plaso/commits{/sha}","git_commits_url":"https://api.github.com/repos/jnettesheim/plaso/git/commits{/sha}","comments_url":"https://api.github.com/repos/jnettesheim/plaso/comments{/number}","issue_comment_url":"https://api.github.com/repos/jnettesheim/plaso/issues/comments{/number}","contents_url":"https://api.github.com/repos/jnettesheim/plaso/contents/{+path}","compare_url":"https://api.github.com/repos/jnettesheim/plaso/compare/{base}...{head}","merges_url":"https://api.github.com/repos/jnettesheim/plaso/merges","archive_url":"https://api.github.com/repos/jnettesheim/plaso/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/jnettesheim/plaso/downloads","issues_url":"https://api.github.com/repos/jnettesheim/plaso/issues{/number}","pulls_url":"https://api.github.com/repos/jnettesheim/plaso/pulls{/number}","milestones_url":"https://api.github.com/repos/jnettesheim/plaso/milestones{/number}","notifications_url":"https://api.github.com/repos/jnettesheim/plaso/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/jnettesheim/plaso/labels{/name}","releases_url":"https://api.github.com/repos/jnettesheim/plaso/releases{/id}","deployments_url":"https://api.github.com/repos/jnettesheim/plaso/deployments","created_at":"2016-08-30T09:46:06Z","updated_at":"2018-03-30T16:51:02Z","pushed_at":"2018-03-30T17:44:50Z","git_url":"git://github.com/jnettesheim/plaso.git","ssh_url":"git@github.com:jnettesheim/plaso.git","clone_url":"https://github.com/jnettesheim/plaso.git","svn_url":"https://github.com/jnettesheim/plaso","homepage":"","size":185447,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"log2timeline:master","ref":"master","sha":"342112d59a99f6939ae2c485f7c86ced65eb6cc9","user":{"login":"log2timeline","id":8701971,"avatar_url":"https://avatars2.githubusercontent.com/u/8701971?v=4","gravatar_id":"","url":"https://api.github.com/users/log2timeline","html_url":"https://github.com/log2timeline","followers_url":"https://api.github.com/users/log2timeline/followers","following_url":"https://api.github.com/users/log2timeline/following{/other_user}","gists_url":"https://api.github.com/users/log2timeline/gists{/gist_id}","starred_url":"https://api.github.com/users/log2timeline/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/log2timeline/subscriptions","organizations_url":"https://api.github.com/users/log2timeline/orgs","repos_url":"https://api.github.com/users/log2timeline/repos","events_url":"https://api.github.com/users/log2timeline/events{/privacy}","received_events_url":"https://api.github.com/users/log2timeline/received_events","type":"Organization","site_admin":false},"repo":{"id":23812315,"name":"plaso","full_name":"log2timeline/plaso","owner":{"login":"log2timeline","id":8701971,"avatar_url":"https://avatars2.githubusercontent.com/u/8701971?v=4","gravatar_id":"","url":"https://api.github.com/users/log2timeline","html_url":"https://github.com/log2timeline","followers_url":"https://api.github.com/users/log2timeline/followers","following_url":"https://api.github.com/users/log2timeline/following{/other_user}","gists_url":"https://api.github.com/users/log2timeline/gists{/gist_id}","starred_url":"https://api.github.com/users/log2timeline/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/log2timeline/subscriptions","organizations_url":"https://api.github.com/users/log2timeline/orgs","repos_url":"https://api.github.com/users/log2timeline/repos","events_url":"https://api.github.com/users/log2timeline/events{/privacy}","received_events_url":"https://api.github.com/users/log2timeline/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/log2timeline/plaso","description":"Super timeline all the things","fork":false,"url":"https://api.github.com/repos/log2timeline/plaso","forks_url":"https://api.github.com/repos/log2timeline/plaso/forks","keys_url":"https://api.github.com/repos/log2timeline/plaso/keys{/key_id}","collaborators_url":"https://api.github.com/repos/log2timeline/plaso/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/log2timeline/plaso/teams","hooks_url":"https://api.github.com/repos/log2timeline/plaso/hooks","issue_events_url":"https://api.github.com/repos/log2timeline/plaso/issues/events{/number}","events_url":"https://api.github.com/repos/log2timeline/plaso/events","assignees_url":"https://api.github.com/repos/log2timeline/plaso/assignees{/user}","branches_url":"https://api.github.com/repos/log2timeline/plaso/branches{/branch}","tags_url":"https://api.github.com/repos/log2timeline/plaso/tags","blobs_url":"https://api.github.com/repos/log2timeline/plaso/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/log2timeline/plaso/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/log2timeline/plaso/git/refs{/sha}","trees_url":"https://api.github.com/repos/log2timeline/plaso/git/trees{/sha}","statuses_url":"https://api.github.com/repos/log2timeline/plaso/statuses/{sha}","languages_url":"https://api.github.com/repos/log2timeline/plaso/languages","stargazers_url":"https://api.github.com/repos/log2timeline/plaso/stargazers","contributors_url":"https://api.github.com/repos/log2timeline/plaso/contributors","subscribers_url":"https://api.github.com/repos/log2timeline/plaso/subscribers","subscription_url":"https://api.github.com/repos/log2timeline/plaso/subscription","commits_url":"https://api.github.com/repos/log2timeline/plaso/commits{/sha}","git_commits_url":"https://api.github.com/repos/log2timeline/plaso/git/commits{/sha}","comments_url":"https://api.github.com/repos/log2timeline/plaso/comments{/number}","issue_comment_url":"https://api.github.com/repos/log2timeline/plaso/issues/comments{/number}","contents_url":"https://api.github.com/repos/log2timeline/plaso/contents/{+path}","compare_url":"https://api.github.com/repos/log2timeline/plaso/compare/{base}...{head}","merges_url":"https://api.github.com/repos/log2timeline/plaso/merges","archive_url":"https://api.github.com/repos/log2timeline/plaso/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/log2timeline/plaso/downloads","issues_url":"https://api.github.com/repos/log2timeline/plaso/issues{/number}","pulls_url":"https://api.github.com/repos/log2timeline/plaso/pulls{/number}","milestones_url":"https://api.github.com/repos/log2timeline/plaso/milestones{/number}","notifications_url":"https://api.github.com/repos/log2timeline/plaso/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/log2timeline/plaso/labels{/name}","releases_url":"https://api.github.com/repos/log2timeline/plaso/releases{/id}","deployments_url":"https://api.github.com/repos/log2timeline/plaso/deployments","created_at":"2014-09-08T23:29:28Z","updated_at":"2018-04-06T04:45:12Z","pushed_at":"2018-04-06T04:58:49Z","git_url":"git://github.com/log2timeline/plaso.git","ssh_url":"git@github.com:log2timeline/plaso.git","clone_url":"https://github.com/log2timeline/plaso.git","svn_url":"https://github.com/log2timeline/plaso","homepage":"","size":185478,"stargazers_count":531,"watchers_count":531,"language":"Python","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":120,"mirror_url":null,"archived":false,"open_issues_count":242,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":120,"open_issues":242,"watchers":531,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/log2timeline/plaso/pulls/1732"},"html":{"href":"https://github.com/log2timeline/plaso/pull/1732"},"issue":{"href":"https://api.github.com/repos/log2timeline/plaso/issues/1732"},"comments":{"href":"https://api.github.com/repos/log2timeline/plaso/issues/1732/comments"},"review_comments":{"href":"https://api.github.com/repos/log2timeline/plaso/pulls/1732/comments"},"review_comment":{"href":"https://api.github.com/repos/log2timeline/plaso/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/log2timeline/plaso/pulls/1732/commits"},"statuses":{"href":"https://api.github.com/repos/log2timeline/plaso/statuses/1f1d100f432f755e6686f0c80eb9109c0c1da371"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"joachimmetz"}}