CovertMark.data.retrieve module

class CovertMark.data.retrieve.Retriever[source]

Bases: object

count(trace_filter={})[source]

Count the number of packets in the currently selected MongoDB collection,

Parameters

trace_filter (dict) – a MongoDB query filter, which can be empty – in which case all packets will be counted.

Returns

the number of packets matching the filter in the currently selected collection.

current()[source]

Get the current collection selected.

Returns

the current collection of packets selected. None if none selected.

distinct(column)[source]

Count the number of distinct fields in the currently selected MongoDB collection’s specified column.

Parameters

field (str) – name of the column for counting distinct addresses.

Returns

the number of packets matching the filter in the currently selected collection.

get_input_filters()[source]

Retrieve and validate input filter information from the collection.

Returns

if all input filters present are valid, returns the filters, otherwise returns False.

list(in_string=False, match_filters=None)[source]

Return a list of all collections of packets currently stored in MongoDB.

Parameters
  • in_string (str) – pre-format the output in string if True.

  • match_filters (list) – a list of CovertMark.data.constants filter types to match with those of stored collections, returning only matched collections. If None, return all collections.

Returns

list of traces with {name, creation_time, description}.

retrieve(trace_filter={}, limit=0)[source]

Retrieve packets from the currently selected MongoDB collection into memory, decoding base64-encoded payload and TLS data where possible.

Parameters
  • trace_filter (dict) – a MongoDB query filter, can be empty – in which case all packets returned.

  • limit (int) – a positive integer containing the maximum number of packets to retrieve (normally in time-ascending order), or 0 for unlimited.

Returns

List of packets as specified. Returns an empty list of packets if no collection is selected or filter invalid.

select(collection_name)[source]

Set the retriever to the collection as specified, returns False if specified collection does not exist or invalid.

Parameters

collection_name (str) – the name of collection to be retrieved.

Returns

True if successfully selected, False otherwise.