dshield-parser 0.1.4__tar.gz → 0.1.6__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/PKG-INFO +1 -1
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser/utils/json.py +30 -6
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser.egg-info/PKG-INFO +1 -1
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/setup.py +1 -1
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/README.md +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser/__init__.py +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser/__main__.py +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser/cowrie_processor/__init__.py +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser/cowrie_processor/__main__.py +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser/cowrie_processor/reports.py +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser/firewall_processor/__init__.py +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser/firewall_processor/__main__.py +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser/firewall_processor/reports.py +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser/test/__init__.py +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser/test/test_json.py +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser/utils/__init__.py +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser/utils/__main__.py +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser/utils/enrichment.py +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser/utils/file_io.py +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser/utils/graphs.py +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser/utils/ml.py +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser/utils/sql.py +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser/utils/ssh.py +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser/web_processor/__init__.py +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser/web_processor/__main__.py +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser/web_processor/reports.py +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser.egg-info/SOURCES.txt +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser.egg-info/dependency_links.txt +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/dshield_parser.egg-info/top_level.txt +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/pyproject.toml +0 -0
- {dshield_parser-0.1.4 → dshield_parser-0.1.6}/setup.cfg +0 -0
|
@@ -16,6 +16,30 @@ import pandas as pd
|
|
|
16
16
|
default_datespan={'start_date': '1970-01-01', 'end_date': '3000-01-01'}
|
|
17
17
|
default_timespan={"start_time": 0, "end_time": 32516881838}
|
|
18
18
|
|
|
19
|
+
def _groupby_size(df):
|
|
20
|
+
"""
|
|
21
|
+
Compatibility wrapper for groupby().size() that works with pandas 2.x and 3.x.
|
|
22
|
+
In pandas 3.0, 'size' became a reserved GroupBy method name and can no longer
|
|
23
|
+
be used as a column selector after groupby(). This helper renames the column
|
|
24
|
+
temporarily to avoid the conflict.
|
|
25
|
+
Handles edge cases where df is empty or does not yet have a 'size' column.
|
|
26
|
+
"""
|
|
27
|
+
if df.empty:
|
|
28
|
+
return df
|
|
29
|
+
if 'size' not in df.columns:
|
|
30
|
+
# No size column yet — just do a count groupby and name it 'size'
|
|
31
|
+
group_cols = df.columns.tolist()
|
|
32
|
+
result = df.groupby(group_cols, as_index=False, dropna=False).size()
|
|
33
|
+
return result
|
|
34
|
+
group_cols = df.columns.difference(['size']).tolist()
|
|
35
|
+
if not group_cols:
|
|
36
|
+
# Only column is 'size', nothing meaningful to group by
|
|
37
|
+
return df
|
|
38
|
+
result = df.rename(columns={'size': '_count'})
|
|
39
|
+
result = result.groupby(result.columns.difference(['_count']).tolist(), as_index=False, dropna=False)['_count'].sum()
|
|
40
|
+
result = result.rename(columns={'_count': 'size'})
|
|
41
|
+
return result
|
|
42
|
+
|
|
19
43
|
def print_json_pretty(incoming_data):
|
|
20
44
|
for json_data in incoming_data:
|
|
21
45
|
if os.path.exists(json_data):
|
|
@@ -153,13 +177,13 @@ def get_json_values(key, incoming_data, timespan=default_timespan, exclusions=No
|
|
|
153
177
|
logging.info(f"50 days of data processed or more than 500k records found. Collapsing dataframe by date (grouping by).")
|
|
154
178
|
file_df = pd.DataFrame(values)
|
|
155
179
|
file_df = file_df.groupby(file_df.columns.tolist(),as_index=False, dropna=False).size()
|
|
156
|
-
df = pd.concat([df, file_df])
|
|
180
|
+
df = _groupby_size(pd.concat([df, file_df]))
|
|
157
181
|
values = []
|
|
158
182
|
elif end_date in file.name or (file.name == incoming_data[-1].name):
|
|
159
183
|
logging.info(f"Last day being processed: {date}")
|
|
160
184
|
file_df = pd.DataFrame(values)
|
|
161
185
|
file_df = file_df.groupby(file_df.columns.tolist(),as_index=False, dropna=False).size()
|
|
162
|
-
df = pd.concat([df, file_df])
|
|
186
|
+
df = _groupby_size(pd.concat([df, file_df]))
|
|
163
187
|
values = []
|
|
164
188
|
day_count += 1
|
|
165
189
|
|
|
@@ -200,7 +224,7 @@ def get_json_values(key, incoming_data, timespan=default_timespan, exclusions=No
|
|
|
200
224
|
logging.info(f"Undated data file finished processing: {file}")
|
|
201
225
|
file_df = pd.DataFrame(values)
|
|
202
226
|
file_df = file_df.groupby(file_df.columns.tolist(),as_index=False, dropna=False).size()
|
|
203
|
-
df = pd.concat([df, file_df])
|
|
227
|
+
df = _groupby_size(pd.concat([df, file_df]))
|
|
204
228
|
values = []
|
|
205
229
|
|
|
206
230
|
else:
|
|
@@ -220,7 +244,7 @@ def get_json_values(key, incoming_data, timespan=default_timespan, exclusions=No
|
|
|
220
244
|
logging.info(f"Firewall log finished processing: {file}")
|
|
221
245
|
file_df = pd.DataFrame(values)
|
|
222
246
|
file_df = file_df.groupby(file_df.columns.tolist(),as_index=False, dropna=False).size()
|
|
223
|
-
df = pd.concat([df, file_df])
|
|
247
|
+
df = _groupby_size(pd.concat([df, file_df]))
|
|
224
248
|
values = []
|
|
225
249
|
|
|
226
250
|
# print out variable memory usage
|
|
@@ -228,7 +252,7 @@ def get_json_values(key, incoming_data, timespan=default_timespan, exclusions=No
|
|
|
228
252
|
locals().items())), key= lambda x: -x[1])[:10]:
|
|
229
253
|
print("{:>30}: {:>8}".format(name, sizeof_fmt(size)))
|
|
230
254
|
|
|
231
|
-
df =
|
|
255
|
+
df = _groupby_size(df)
|
|
232
256
|
return df
|
|
233
257
|
|
|
234
258
|
def summarize_values(list):
|
|
@@ -482,7 +506,7 @@ def convert_to_datetime(dictionary):
|
|
|
482
506
|
return new_dates
|
|
483
507
|
|
|
484
508
|
def convert_to_epoch(date):
|
|
485
|
-
return datetime.strptime(date, "%Y-%m-%d")
|
|
509
|
+
return datetime.strptime(date, "%Y-%m-%d").timestamp()
|
|
486
510
|
|
|
487
511
|
def convert_to_date(timestamp):
|
|
488
512
|
return datetime.fromtimestamp(timestamp).strftime('%Y-%m-%d')
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|