startbootstrap icon indicating copy to clipboard operation
startbootstrap copied to clipboard

Support for external parsers and plugins

Open dc3-plaso opened this issue 8 years ago • 2 comments

I would like to add the ability to dynamically register parsers and plugins developed externally from plaso.

This can be accomplished by taking advantage of the entry_points feature of setuptools (http://docs.pylonsproject.org/projects/pylons-webframework/en/latest/advanced_pylons/entry_points_and_plugins.html)

dc3-plaso avatar Jun 15 '17 20:06 dc3-plaso

explicitly adding @Onager for discussion

I think this is a good idea to explore, we have been restructuring plaso over time and were thinking about making the core less top heavy. Moving to a more plugable approach could help there as well.

Regarding using entry_points feature of setuptools, good suggestion let us have a look at it first.

joachimmetz avatar Jun 29 '17 15:06 joachimmetz

Sounds good. I'm looking forward to it. In the meantime, I've been able to patch this feature into my own copy of plaso by simply adding the equivalent of the following in the __init__.py file for the "parsers" module and each plugin module:

import logging
from pkg_resources import iter_entry_points

from plaso.parsers import sqlite

for entry_point in iter_entry_points(u'plaso.sqlite_plugins'):
  try:
    sqlite.SQLiteParser.RegisterPlugin(entry_point.load())
  except (ImportError, KeyError) as exception:
    logging.warning(
      u'Unable to register sqlite plugin: {0:s} '
      u'with error: {1:s}'.format(entry_point.name, exception))

dc3-plaso avatar Jul 05 '17 18:07 dc3-plaso