EventMonkey.py 文件源码

def Main():
    multiprocessing.freeze_support()
    Config.Config.ClearLogs()

    ###GET OPTIONS###
    arguements = GetArguements()
    options = arguements.parse_args()

    # Check if there is geodb if frozen
    if getattr(sys,'frozen',False):
        geodb_file = os.path.join(
            'geodb',
            'GeoLite2-City.mmdb'
        )

        if not os.path.isfile(geodb_file):
            if GetYesNo(("There is no geodb found, would you like to download it? "
                        "This is required for using basic Geo IP support within the "
                        "report queries. If you choose not to use this functionality "
                        "expect errors for templates that use custom functions calling "
                        "geoip functions.")):
                InitGeoDb(geodb_file)
        else:
            SqliteCustomFunctions.GEO_MANAGER.AttachGeoDbs('geodb')

    if options.subparser_name == "process":
        options.db_name = os.path.join(
            options.output_path,
            options.evidencename+'.db'
        )
        manager = WindowsEventManager.WindowsEventManager(
            options
        )
        manager.ProcessEvents()
        CreateReports(options)
    elif options.subparser_name == "report":
        CreateReports(options)
    else:
        raise(Exception("Unknown subparser: {}".format(options.subparser_name)))