Helpers

psengine.analyst_notes.helpers

save_attachment

save_attachment(
    note_id: str,
    data: Union[bytes, str],
    ext: str,
    output_directory: Union[str, Path],
) -> None

Save a YARA, Sigma, Snort, or PDF attachment to a file.

The file will use the provided extension and the note_id to create the filename.

PARAMETER	DESCRIPTION
note_id	The ID of the AnalystNote. TYPE: str
data	The data returned from fetch_attachment. TYPE: Union[bytes, str]
ext	The extension of the attachment, returned by fetch_attachment. TYPE: str
output_directory	The directory to save the file into. TYPE: Union[str, Path]

Source code in psengine/analyst_notes/helpers.py

@debug_call
@validate_call
def save_attachment(
    note_id: Annotated[str, Doc('The ID of the AnalystNote.')],
    data: Annotated[Union[bytes, str], Doc('The data returned from `fetch_attachment`.')],
    ext: Annotated[str, Doc('The extension of the attachment, returned by `fetch_attachment`.')],
    output_directory: Annotated[Union[str, Path], Doc('The directory to save the file into.')],
) -> None:
    """Save a YARA, Sigma, Snort, or PDF attachment to a file.

    The file will use the provided extension and the `note_id` to create the filename.
    """
    output_directory = (
        output_directory if isinstance(output_directory, str) else output_directory.as_posix()
    )
    _save_attachment(note_id, data, ext, output_directory)

save_note

save_note(
    note: AnalystNote, output_directory: Union[str, Path]
) -> None

Save an AnalystNote object to a file named with the note ID.

PARAMETER	DESCRIPTION
note	The note to save. TYPE: AnalystNote
output_directory	The directory to save the file into. TYPE: Union[str, Path]

Source code in psengine/analyst_notes/helpers.py

@debug_call
@validate_call
def save_note(
    note: Annotated[AnalystNote, Doc('The note to save.')],
    output_directory: Annotated[Union[str, Path], Doc('The directory to save the file into.')],
) -> None:
    """Save an `AnalystNote` object to a file named with the note ID."""
    output_directory = (
        output_directory if isinstance(output_directory, str) else output_directory.as_posix()
    )
    _save_attachment(
        note_id=note.id_,
        data=json.dumps(note.json(), indent=4),
        ext='json',
        output_directory=output_directory,
    )