Skip to main content

Send .mans to ElasticSearch

Project description

mans_to_es

Version GitHub license

Parses the FireEye HX .mans triage collections and send them to ElasticSearch

Table of Contents

  1. About
  2. Getting started
  3. Contributing
  4. Disclaimer

About

mans_to_es is an open source tool for parsing FireEye HX .mans triage collections and send them to ElasticSearch.

Mans file is a zipped collection of xml that we parse using xmltodict. It uses pandas and multiprocessing to speed up the parsing with xml files.

Getting started

Installation

pip install mans_to_es

Usage

$ mans_to_es.py --help
usage: MANS to ES [-h] [--filename FILENAME] [--name NAME] [--index INDEX]
                  [--es_host ES_HOST] [--es_port ES_PORT]
                  [--cpu_count CPU_COUNT] [--bulk_size BULK_SIZE] [--version]

Push .mans information in Elasticsearch index

optional arguments:
  -h, --help            show this help message and exit
  --filename FILENAME   Path of the .mans file
  --name NAME           Timeline name
  --index INDEX         ES index name
  --es_host ES_HOST     ES host
  --es_port ES_PORT     ES port
  --cpu_count CPU_COUNT
                        cpu count
  --bulk_size BULK_SIZE
                        Bulk size for multiprocessing parsing and upload
  --version             show program's version number and exit

Contributing

If you want to contribute to mans_to_es, be sure to review the contributing guidelines. This project adheres to mans_to_es code of conduct. By participating, you are expected to uphold this code.

**We use GitHub issues for tracking requests and bugs.

Disclaimer

This is not an official FireEye product. Bugs are expected.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for mans-to-es, version 1.3
Filename, size & hash File type Python version Upload date
mans_to_es-1.3-py3-none-any.whl (12.0 kB) View hashes Wheel py3
mans_to_es-1.3.tar.gz (7.1 kB) View hashes Source None

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN SignalFx SignalFx Supporter DigiCert DigiCert EV certificate StatusPage StatusPage Status page