modules.processing.platform.windows.WindowsMonitor

Package modules :: Package processing :: Package platform :: Module windows :: Class WindowsMonitor |
[hide private]
[frames] | no frames]

# Class WindowsMonitor

source code

                                     object --+
                                              |
    lib.cuckoo.common.abstracts.BehaviorHandler --+
                                                  |
                                                 WindowsMonitor

Parses monitor generated logs.

Instance Methods | [hide private]
__init__(self, *args, **kwargs) x.__init__(...) initializes x; see help(type(x)) for signature | source code
handles_path(self, path) Needs to return True for the log files this handler wants to process. | source code
parse(self, path) Called after handles_path succeeded, should generate behavior events. | source code
run(self) Return the handler specific structure, gets placed into behavior[self.key]. | source code
Inherited from `lib.cuckoo.common.abstracts.BehaviorHandler`: `handle_event` Inherited from `object`: `__delattr__`, `__format__`, `__getattribute__`, `__hash__`, `__new__`, `__reduce__`, `__reduce_ex__`, `__repr__`, `__setattr__`, `__sizeof__`, `__str__`, `__subclasshook__`

Class Variables | [hide private]
| key = `"processes"`
Inherited from `lib.cuckoo.common.abstracts.BehaviorHandler`: `event_types`

Properties | [hide private]
Inherited from `object`: `__class__`

Method Details | [hide private]

### __init__(self, *args, **kwargs) (Constructor) | source code
x.__init__(...) initializes x; see help(type(x)) for signature Overrides: object.__init__ (inherited documentation)

### handles_path(self, path) | source code
Needs to return True for the log files this handler wants to process. Overrides: lib.cuckoo.common.abstracts.BehaviorHandler.handles_path (inherited documentation)

### parse(self, path) | source code
Called after handles_path succeeded, should generate behavior events. Overrides: lib.cuckoo.common.abstracts.BehaviorHandler.parse (inherited documentation)

### run(self) | source code
Return the handler specific structure, gets placed into behavior[self.key]. Overrides: lib.cuckoo.common.abstracts.BehaviorHandler.run (inherited documentation)