log2timeline / plaso

Super timeline all the things
https://plaso.readthedocs.io
Apache License 2.0
1.72k stars 348 forks source link

Support for external parsers and plugins #1249

Open dc3-plaso opened 7 years ago

dc3-plaso commented 7 years ago

I would like to add the ability to dynamically register parsers and plugins developed externally from plaso.

This can be accomplished by taking advantage of the entry_points feature of setuptools (http://docs.pylonsproject.org/projects/pylons-webframework/en/latest/advanced_pylons/entry_points_and_plugins.html)

joachimmetz commented 7 years ago

explicitly adding @Onager for discussion

I think this is a good idea to explore, we have been restructuring plaso over time and were thinking about making the core less top heavy. Moving to a more plugable approach could help there as well.

Regarding using entry_points feature of setuptools, good suggestion let us have a look at it first.

dc3-plaso commented 7 years ago

Sounds good. I'm looking forward to it. In the meantime, I've been able to patch this feature into my own copy of plaso by simply adding the equivalent of the following in the __init__.py file for the "parsers" module and each plugin module:

import logging
from pkg_resources import iter_entry_points

from plaso.parsers import sqlite

for entry_point in iter_entry_points(u'plaso.sqlite_plugins'):
  try:
    sqlite.SQLiteParser.RegisterPlugin(entry_point.load())
  except (ImportError, KeyError) as exception:
    logging.warning(
      u'Unable to register sqlite plugin: {0:s} '
      u'with error: {1:s}'.format(entry_point.name, exception))