JSON Parsing Custom Artifact

JsonParsingArtifact.py

from axiom import *

import datetime
import sys
import codecs
import time
import io
import json

class JsonReader(Artifact):
  def __init__(self):
    self.AddHunter(ReadJson())

  def GetName(self):
    return "JSON Artifact Demo"

  def CreateFragments(self):
    self.AddFragment("ID", Category.None, FragmentType.Integer)
    self.AddFragment("App Name", Category.None, FragmentType.String)
    self.AddFragment("Bitcoin Address", Category.None, FragmentType.String)
    self.AddFragment("Important Hash", Category.None, FragmentType.String)
    self.AddFragment("IPv6 Address", Category.None, FragmentType.String)

class ReadJson(Hunter):
  def Register(self, registrar):
    registrar.RegisterFileRegex("MOCK_DATA_[0-9]*\.json$")

  def Hunt(self, context):
    temp_file_path = context.Searchable.SaveAsTempFile()

    index = 0

    with open(temp_file_path) as json_file:
        data = json.load(json_file)

    for row in data:
        foundHit = Hit()
        foundHit.SetLocation("Index: " + str(index))
        foundHit.AddValue("ID", int(row["id"]))
        foundHit.AddValue("App Name", row["app_name"])
        foundHit.AddValue("Bitcoin Address",row["bitcoin_address"])
        foundHit.AddValue("Important Hash",row["important_hash"])
        foundHit.AddValue("IPv6 Address",row["ipv6_address"])
        index = index + 1

        self.PublishHit(foundHit)

RegisterArtifact(JsonReader())