[
  {
  'ppid': 100,
  'pid': 250,
  'action': 'started',
  'time': '2019-02-24 18:21:25'
  },
  {
  'ppid': 250,
  'pid': 350,
  'action': 'started',
  'time': '2019-02-24 18:22:31'
  }
]

[
  {
  'pid': 350,
  'action': 'connected_to',
  'domain': 'evil.com',
  'time': '2019-02-24 18:24:27'
  },
  {
  'pid': 350,
  'action': 'created_file',
  'path': 'downloads/evil.exe',
  'time': '2019-02-24 18:28:31'
  }
]

Process {
    node_key: string ,
    asset_id: string ,
    process_id: int ,
    process_guid: string ,
    created_timestamp: int ,
    terminated_timestamp: int ,
    last_seen_timestamp: int ,
    process_name: string ,
    process_command_line: string ,
    process_integrity_level: string ,
    operating_system: string ,
    process_path: File ,
    children: [Process] ,
    created_files: [File] ,
    deleted_files: [File] ,
    read_files: [File] ,
    wrote_files: [File] ,
}

File {
    node_key: string ,
    asset_id: string ,
    created_timestamp: int ,
    deleted_timestamp: int ,
    last_seen_timestamp: int ,
    file_name: string ,
    file_path: string ,
    file_extension: string ,
    file_mime_type: string ,
    file_size: int ,
    file_version: string ,
    file_description: string ,
    file_product: string ,
    file_company: string ,
    file_directory: string ,
    file_inode: int ,
    file_hard_links: int ,
    md5_hash: string ,
    sha1_hash: string ,
    sha256_hash: string ,
}

{
  'pid': 100,
  'type': 'process_start',
  'timestamp': 1551753726,
  'image': '/usr/bin/program',
}

{
  'pid': 100,
  'type': 'file_read',
  'path': '/home/.cache/file',
  'timestamp': 1551754726
}

{
  'pid': 100,
  'type': 'process_terminate',
  'timestamp': 1551755726,
  'image': '/usr/bin/program',
}

{
  'pid': 250,
  'created_at': 30
}

{
  'pid': 250,
  'created_at': 50
}

{
  'pid': 250,
  'seen_at': 30
}

{
  'type': 'Process Create',
  'image': 'C:\Program Files\Microsoft Office\winword.exe',
  'pid': 1200,
  'ppid': 1080
}

{
  'type': 'Process Create',
  'image': 'C:\Windows\WindowsPowershell\v1.0\powershell.exe',
  'pid': 2590,
  'ppid': 1200,
}

from pydgraph import DgraphClient, DgraphClientStub

from grapl_analyzer.entity_views import SubgraphView

def _analyzer(client: DgraphClient, graph: SubgraphView, sender: Any):
    
    # Detect processes that delete their parent processes' binary file

    for process in graph.process_iter():
        parent = process.get_parent()
        if not parent: continue

        deleted_files = process.get_deleted_files()
        if not deleted_files: continue

        bin_file = parent.get_bin_file()
        
        for deleted_file in deleted_files:
            if deleted_file.path == bin_file.path:
                sender.send(process)

from pydgraph import DgraphClient, DgraphClientStub

from grapl_analyzer.counters import ParentChildCounter

from grapl_analyzer.entity_views import SubgraphView

def _analyzer(client: DgraphClient, graph: SubgraphView, sender: Any):
    counter = ParentChildCounter(client)

    # Detect unique parent-child process combinations, where we have seen
    # the child process at least once before

    for process in graph.process_iter():
        children = process.get_children() or []

        for child in children:
            combo_count = counter.get_count_for(
                process.image_name,
                child.image_name,
                excluding=process.node_key
            )

            child_image_count = counter.get_count_for(child.image_name, 
                                                excluding=process.node_key)

            if combo_count >= Seen.Once and child_image_count == Seen.Many:
                sender.send(process)
            

{
    'pid': 250,
    'ppid': 150,
    'created_at': 1551565127,
    'hash': 'acbd18db4cc2f85cedef654fccc4a4d8',
    'image_name': '/home/user/downloads/evil.sh'
}

{
  ~~: ~~
  ~~: ~~
}

{
  ~~: ~~
  ~~: ~~
}

{
  ~~: ~~
  ~~: ~~
}

{
  ~~: ~~
  ~~: ~~
}

{
  ~~: ~~
  ~~: ~~
}

{
  ~~: ~~
  ~~: ~~
}

{
  ~~: ~~
  ~~: ~~
}

{
  ~~: ~~
  ~~: ~~
}

{
  ~~: ~~
  ~~: ~~
}

{
  ~~: ~~
  ~~: ~~
}

{
  ~~: ~~
  ~~: ~~
}

{
  ~~: ~~
  ~~: ~~
}

    let parent = ProcessDescriptionBuilder::default()
        .host_id(process_start.computer)
        .state(ProcessState::Existing)
        .process_id(process_start.ppid)
        .last_seen_timestamp(timestamp)
        .build()?;

    let child = ProcessDescriptionBuilder::default()
        .host_id(process_start.computer)
        .process_name(get_image_name(&process_start.image)?)
        .state(ProcessState::Created)
        .process_id(process_start.pid)
        .created_timestamp(timestamp)
        .build()?;

{
    'action': 'Process Create',
    'computer': 'winuser-laptop',
    'ppid': 100,
    'pid: 150,
    'image': 'C:\\Users\\Demo\\Downloads\\foo.exe',
    'timestamp': 1551578297
}

    let child_exe = FileDescriptionBuilder::default()
        .hostt_id(process_start.computer)
        .state(FileState::Existing)
        .last_seen_timestamp(timestamp)
        .file_path(process_start.image)
        .build()?;

{
    'action': 'Process Create',
    'computer': 'winuser-laptop',
    'ppid': 100,
    'pid: 150,
    'image': 'C:\\Users\\Demo\\Downloads\\foo.exe',
    'timestamp': 1551578297
}

    let mut graph = GraphDescription::new(
        timestamp
    );

    graph.add_edge("bin_file",
                   child.clone_key(),
                   child_exe.clone_key()
    );
    graph.add_node(child_exe);
    graph.add_edge("children",
                   parent.clone_key(),
                   child.clone_key());
    graph.add_node(parent);
    graph.add_node(child);

$ git clone git@github.com:insanitybit/grapl.git
$ cd ./grapl/grapl-cdk/
$ npm install -g
$ <your editor> ./.env

BUCKET_PREFIX="<unique identifier>"

$ ./deploy_all.sh

cd /path/to/grapl/
python ./gen-raw-logs.py <bucket prefix>