How to write an output module¶
Create file and class¶
Plugin file in
plaso/output/
Create an empty subclass of plaso.output.interface.OutputModule
Register it with the output module manager by calling OutputManager.RegisterOutput
Test file in
tests/output/
Create an empty subclass of
tests.output.test_lib.OutputModuleTestCase
Write minimal tests¶
Write a test that loads your output module.
It will fail initially, but running the test while you’re developing your plugin gives you a quick way to see if your code is doing what you expect.
Develop plugin¶
Implement your subclass of plaso.output.interface.OutputModule
You’ll need to define/overwrite:
NAME
DESCRIPTION
WriteEventBody
You may also want to override:
Open()
Close()
GetMissingArguments()
WriteHeader()
WriteEventStart()
WriteEventEnd()
WriteEventMACBGroup()
WriteFooter()
Expand tests¶
Add additional tests that test your plugin
Register classes¶
Edit
plaso/output/__init__.py
to import your plugin in the correct alphabetical order.