def _create_observables(self, msg):
o = Observables(self.__parse_email_message(msg))
t = ToolInformation()
t.name = os.path.basename(__file__)
t.description = StructuredText("Email to CybOX conversion script")
t.vendor = "The MITRE Corporation"
t.version = __version__
t_list = ToolInformationList()
t_list.append(t)
m = MeasureSource()
m.tools = t_list
o.observable_package_source = m
return o
def execute(self, device_info, data_dir_path, simple_output=False, html_output=False):
"""
:param device_info: DeviceInfo
:param data_dir_path: string
"""
extracted_data_dir_path = os.path.join(data_dir_path, EXTRACTED_DATA_DIR_NAME)
try:
os.makedirs(extracted_data_dir_path)
except OSError as exception:
if exception.errno != errno.EEXIST:
raise
self.extractor.execute(extracted_data_dir_path, self.param_values)
set_id_method(IDGenerator.METHOD_INT if simple_output else IDGenerator.METHOD_UUID)
inspected_objects, source_objects = self.inspector.execute(device_info, extracted_data_dir_path)
inspected_observables = Observables(inspected_objects)
source_observables = Observables(source_objects)
tool_info = ToolInformation()
tool_info.name = 'Android Inspector'
tool_info.version = '1.0'
measure_source = MeasureSource()
measure_source.tool_type = ToolType.TERM_DIGITAL_FORENSICS
measure_source.tools = ToolInformationList([tool_info])
measure_source.time = Time(produced_time=datetime.now().isoformat())
inspected_observables.observable_package_source = measure_source
source_observables.observable_package_source = measure_source
write_observables_xml_file(inspected_observables,
os.path.join(data_dir_path, INSPECTED_DATA_FILE_NAME),
simple_output)
write_observables_xml_file(source_observables,
os.path.join(data_dir_path, SOURCE_DATA_FILE_NAME),
simple_output)
if html_output:
generate_html_files(data_dir_path)
