Commit 19485a3
authored
Feature/INTEG_978 handle keyboard interrupts (#60)
* update ArgConfig to allow changing metavar setting
* move verify_timestamp_order to date_helper module
* - add AlertCursorStore class
- refactor shared methods onto the base class
- set default db name to "checkpoints.db" so we don't create separate dbs for each cursor store
* - moved enums to shared module
- added Alert enums
* pull out shared extraction functions
* move logger_factory to shared module
* update securitydata extraction and main
* add alerts extraction and main
* add main alerts command
* update setup.py
* update some tests
* update conftest
* bump dependency versions
* fix bugs in advanced_arg handling
* extract shared search arguments into shared module
* complete the warning change
* fixed existing tests
* fixed global error state flagging
* rename shared func
* more test fixes
* Remove CEF option for alerts output
* hard-code cursor_store db to `file_event_checkpoints.db`
* update profile deletion to handle alert cursors
* fix log method docstrings
* fix import
* logging adjustments
* add new logging to alert extraction
* update shared extraction logging
* improve error handling
* fix file event tests with new logging changes
* add alert tests and reorganize a bit
* update arg options
* fix --exclude-actor-contains nargs
* more test fixes/updates
* fix alertstate choices in help
* remove "Accepts multiple args." from help messages
* enumerate rule types in help
* rename shared folder to search_shared
* rename shared folder to search_shared
* YYYY-MM-DD -> yyyy-MM-dd, along with clarity on partial time, and remove duplication of arg format message.
* move shared table init logic to base class
* adjust DateArgumentException error message to use max_days_back var instead of hardcoded #
* range compatibility
* get alert details instead of summaries in extraction
* update py42 minimum req
* update changelog
* implement clean interrupt handling
* remove test code
* docstring and changelog
* remove a test thing
* change decorator behavior to exit after function completes on first ctrl-c1 parent f92947f commit 19485a3
4 files changed
+63
-0
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
47 | 47 | | |
48 | 48 | | |
49 | 49 | | |
| 50 | + | |
| 51 | + | |
| 52 | + | |
50 | 53 | | |
51 | 54 | | |
52 | 55 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
7 | 7 | | |
8 | 8 | | |
9 | 9 | | |
| 10 | + | |
10 | 11 | | |
11 | 12 | | |
12 | 13 | | |
| |||
50 | 51 | | |
51 | 52 | | |
52 | 53 | | |
| 54 | + | |
| 55 | + | |
| 56 | + | |
53 | 57 | | |
54 | 58 | | |
55 | 59 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | 1 | | |
| 2 | + | |
2 | 3 | | |
3 | 4 | | |
4 | 5 | | |
| |||
15 | 16 | | |
16 | 17 | | |
17 | 18 | | |
| 19 | + | |
| 20 | + | |
| 21 | + | |
| 22 | + | |
| 23 | + | |
| 24 | + | |
| 25 | + | |
| 26 | + | |
18 | 27 | | |
19 | 28 | | |
20 | 29 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | 1 | | |
2 | 2 | | |
| 3 | + | |
3 | 4 | | |
| 5 | + | |
4 | 6 | | |
5 | 7 | | |
6 | 8 | | |
| |||
88 | 90 | | |
89 | 91 | | |
90 | 92 | | |
| 93 | + | |
| 94 | + | |
| 95 | + | |
| 96 | + | |
| 97 | + | |
| 98 | + | |
| 99 | + | |
| 100 | + | |
| 101 | + | |
| 102 | + | |
| 103 | + | |
| 104 | + | |
| 105 | + | |
| 106 | + | |
| 107 | + | |
| 108 | + | |
| 109 | + | |
| 110 | + | |
| 111 | + | |
| 112 | + | |
| 113 | + | |
| 114 | + | |
| 115 | + | |
| 116 | + | |
| 117 | + | |
| 118 | + | |
| 119 | + | |
| 120 | + | |
| 121 | + | |
| 122 | + | |
| 123 | + | |
| 124 | + | |
| 125 | + | |
| 126 | + | |
| 127 | + | |
| 128 | + | |
| 129 | + | |
| 130 | + | |
| 131 | + | |
| 132 | + | |
| 133 | + | |
| 134 | + | |
| 135 | + | |
| 136 | + | |
| 137 | + | |
0 commit comments