System Entrypoint¶
- File location
Bundled implementation:
source/client/python/remote.py
source/client/python/scan.py
Cluster implementation:
cluster/app/source/python/__main__.py
In bundled implementation, the Bro Logs Processing module (remote
) starts a
background process for the BroAPT-App framework; whilst the Detection Process module
(process
) contains main processing logic as well as the
original system entrypoint.
In cluster implementation, this file wraps the whole system and make the
python
folder callable as a module where the __main__.py
will be
considered as the entrypoint.
Constants¶
-
__main__.
FILE_REGEX
: re.Pattern¶ - Availability
cluster implementation
re.compile(r''' # protocol prefix (?P<protocol>DTLS|FTP_DATA|HTTP|IRC_DATA|SMTP|\S+) - # file UID (?P<fuid>F\w+) \. # PCAP source (?P<pcap>.+?) \. # media-type (?P<media_type>application|audio|example|font|image|message|model|multipart|text|video|\S+) \. # subtype (?P<subtype>\S+) \. # file extension (?P<extension>\S+) ''', re.IGNORECASE | re.VERBOSE)
Regular expression to match and fetch information from extracted files.
See also
Dataclasses¶
-
class
scan.
Entry
¶ - Availability
bundled implementation
A dataclass for extracted file entry.
Note
This dataclass supports ordering with power of
functools.total_ordering()
.
-
class
__main__.
Entry
¶ - Availability
cluster implementation
See also
Bundled Implementation¶
scan
Module¶
remote
Module¶
Framework Mainloop¶
-
remote.
remote_dump
()¶ - Availability
bundled implementation
Runtime mainloop for BroAPT-App framework.
The function will start as an indefinite loop to fetch path to extracted files from
const.QUEUE_DUMP
, and performscan()
on them.When
JOIN_DUMP
is set toTrue
, the function will break from the loop.
Signal Handling¶
-
remote.
join_dump
(*args, **kwargs)¶ - Availability
bundled implementation
Toggle
JOIN_DUMP
toTrue
.Note
This function is registered as handler for
SIGUSR1`
.
-
remote.
JOIN_DUMP
= multiprocessing.Value('B', False)¶ - Availability
bundled implementation
Flag to stop the
remote_dump()
background process.
Cluster Implementation¶
-
__main__.
listdir
(path: str)¶ - Availability
cluster implementation
Fetch and parse all extracted files in the given path.
-
__main__.
check_history
()¶ - Availability
cluster implementation
Check processed extracted files.
Note
Processed extracted files will be recorded at
const.DUMP
.- Returns
List of processed extracted files.
- Return type
List[str]