mirror of
https://github.com/mvt-project/mvt.git
synced 2024-06-18 02:24:04 +00:00
Improves Shortcut output
This commit is contained in:
parent
24be9e9570
commit
798805c583
|
@ -34,13 +34,21 @@ class Shortcuts(IOSExtraction):
|
||||||
found_urls = ""
|
found_urls = ""
|
||||||
if record["action_urls"]:
|
if record["action_urls"]:
|
||||||
found_urls = "- URLs in actions: {}".format(", ".join(record["action_urls"]))
|
found_urls = "- URLs in actions: {}".format(", ".join(record["action_urls"]))
|
||||||
|
desc = ""
|
||||||
|
if record["description"]:
|
||||||
|
desc = record["description"].decode('utf-8', errors='ignore')
|
||||||
|
|
||||||
return {
|
return [{
|
||||||
"timestamp": record["isodate"],
|
"timestamp": record["isodate"],
|
||||||
"module": self.__class__.__name__,
|
"module": self.__class__.__name__,
|
||||||
"event": "shortcut",
|
"event": "shortcut_created",
|
||||||
"data": f"iOS Shortcut '{record['shortcut_name']}': {record['description']} {found_urls}"
|
"data": f"iOS Shortcut '{record['shortcut_name'].decode('utf-8')}': {desc} {found_urls}"
|
||||||
}
|
}, {
|
||||||
|
"timestamp": record["modified_date"],
|
||||||
|
"module": self.__class__.__name__,
|
||||||
|
"event": "shortcut_modified",
|
||||||
|
"data": f"iOS Shortcut '{record['shortcut_name'].decode('utf-8')}': {desc} {found_urls}"
|
||||||
|
}]
|
||||||
|
|
||||||
def check_indicators(self):
|
def check_indicators(self):
|
||||||
if not self.indicators:
|
if not self.indicators:
|
||||||
|
@ -99,7 +107,6 @@ class Shortcuts(IOSExtraction):
|
||||||
action["urls"] = [url.rstrip("',") for url in extracted_urls]
|
action["urls"] = [url.rstrip("',") for url in extracted_urls]
|
||||||
actions.append(action)
|
actions.append(action)
|
||||||
|
|
||||||
# pprint.pprint(actions)
|
|
||||||
shortcut["isodate"] = convert_timestamp_to_iso(convert_mactime_to_unix(shortcut.pop("created_date")))
|
shortcut["isodate"] = convert_timestamp_to_iso(convert_mactime_to_unix(shortcut.pop("created_date")))
|
||||||
shortcut["modified_date"] = convert_timestamp_to_iso(convert_mactime_to_unix(shortcut["modified_date"]))
|
shortcut["modified_date"] = convert_timestamp_to_iso(convert_mactime_to_unix(shortcut["modified_date"]))
|
||||||
shortcut["parsed_actions"] = len(actions)
|
shortcut["parsed_actions"] = len(actions)
|
||||||
|
|
Loading…
Reference in New Issue
Block a user