Based on the way output_result is written for the metadata file || the way it's passed via main, if the provided args.metdata string is just the filename and doesn't include its full path on the CLI then writing to it will fail.
example:
Running with these options:
$ python block-parser.py -m parsed_powershell_metadata.csv -o parsed_powershell -a powershell.evtx
with these tests:
if m:
if not os.path.isdir(os.path.dirname(m)):
print(m)
print(os.path.abspath(m))
print(os.path.dirname(m))
print(os.path.abspath(os.path.dirname(m)))
Based on the way
output_result
is written for the metadata file || the way it's passed viamain
, if the providedargs.metdata
string is just the filename and doesn't include its full path on the CLI then writing to it will fail.example:
Running with these options:
$ python block-parser.py -m parsed_powershell_metadata.csv -o parsed_powershell -a powershell.evtx
with these tests:
produces; the third line being the issue:
Simple enough to add in
main()
or keep where it is, but either way addingos.path.abspath()
before will eliminate the error.