sysmon.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "from streamz import Stream\n",
    "import pandas as pd\n",
    "import hvplot.streamz\n",
    "import panel"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "def mkdf(data):\n",
    "    row = {}\n",
    "    try:\n",
    "        parts = data.split()\n",
    "        row['time'] = [pd.to_datetime(parts[0] + ' ' + parts[1])]\n",
    "        row['address'] = [parts[2][1:-2]]\n",
    "        row['message'] = [\" \".join(parts[3:])]\n",
    "    except:\n",
    "        row = {'time': [pd.to_datetime('now') - pd.to_timedelta('4h')], 'address': [''], 'message': [data]}\n",
    "    return pd.DataFrame(row).set_index('time', drop=False)\n",
    "\n",
    "s = Stream().from_textfile(\"/private/var/log/m_agent.log\", from_end=True)\n",
    "data = s.map(mkdf).to_dataframe(\n",
    "    example=mkdf(\"2019-04-15 18:28:22 [0x7fff]: Placeholder\"))\n",
    "\n",
    "table = data.window(10).full().hvplot(kind='table')\n",
    "recent = data.window(value='5m')\n",
    "ts = recent.apply(lambda d: d.time.resample('10s').count())"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "table"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "ts"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "recent.address.value_counts().hvplot(kind='bar')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "s.start()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "s.stopped = True"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python [default]",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.6.8"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}