Changes to windows_services analysis plugin log2timeline#3001

plaso/analysis/windows_services.py

@@ -8,6 +8,7 @@
 from plaso.analysis import interface
 from plaso.analysis import manager
 from plaso.containers import reports
+from plaso.parsers.winreg_plugins import services
 from plaso.winnt import human_readable_service_enums
 
 
@@ -124,10 +125,12 @@ def FromEventData(cls, event_data):
     else:
       source = ('Unknown', 'Unknown')
 
+    service_dll = getattr(event_data, 'service_dll', None)
+
     return cls(
         event_data.name, event_data.service_type, event_data.image_path,
         event_data.start_type, event_data.object_name, source,
-        service_dll=event_data.service_dll)
+        service_dll=service_dll)
 
   def HumanReadableType(self):
     """Return a human readable string describing the type value.
@@ -191,8 +194,6 @@ class WindowsServicesAnalysisPlugin(interface.AnalysisPlugin):
   # Indicate that we can run this plugin during regular extraction.
   ENABLE_IN_EXTRACTION = True
 
-  _SUPPORTED_EVENT_DATA_TYPES = frozenset([
-      'windows:registry:service'])
 
   def __init__(self):
     """Initializes the Windows Services plugin."""
@@ -263,11 +264,15 @@ def ExamineEvent(self, mediator, event, event_data):
       event (EventObject): event to examine.
       event_data (EventData): event data.
     """
-    if event_data.data_type not in self._SUPPORTED_EVENT_DATA_TYPES:
+    # TODO: Handle event log entries here also (ie, event id 4697).
+    if not event_data.data_type == 'windows:registry:service':
       return
 
-    # TODO: Handle event log entries here also (ie, event id 4697).
-    service = WindowsService.FromEventData(event_data)
+    event_data_attributes = event_data.CopyToDict()
+    service_event_data = services.WindowsRegistryServiceEventData()
+    service_event_data.CopyFromDict(event_data_attributes)
+
+    service = WindowsService.FromEventData(service_event_data)
     self._service_collection.AddService(service)
 
   def SetOutputFormat(self, output_format):