Workshop · 1
Artefact modelling
Raw evidence is text and bytes. A program can only reason about it once it is records with named fields: this module is about making them.
Written for Mutant v2.6.1. Every program and output on this page is that release’s own file.
Preview. This module is not published yet: it opens once every builtin it uses has cleared review at the pinned release.
beginner
From lines to fields
One regular expression with a group per field turns a log line into a record.
Evidence arrives as text
CurrentA log line, a bodyfile row, a registry value: each is text until you say what its parts mean. A model of an artefact is just that: the fields it has, and how to read them out.
Once evidence is records, the rest of an examination is ordinary programming: filter, count, sort, compare.
A line becomes a record
LockedFinish or skip the stage above to open this one.
Parse logs with Mutant
LockedFinish or skip the stage above to open this one.
Build it
LockedFinish or skip the stage above to open this one.
Check yourself
LockedFinish or skip the stage above to open this one.
intermediate
From records to counts
Once evidence is records, counting and ranking them is a few lines.
Top talkers
LockedFinish or skip the stage above to open this one.
Build it
LockedFinish or skip the stage above to open this one.
Check yourself
LockedFinish or skip the stage above to open this one.
advanced
A timeline is a model too
A bodyfile gives four times per file. mactime turns them into moments.
The day, in order
LockedFinish or skip the stage above to open this one.
Check yourself
LockedFinish or skip the stage above to open this one.
Run them yourself
LockedFinish or skip the stage above to open this one.