Demo.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Load libraries necessary for demo\n",
    "from elasticsearch import Elasticsearch\n",
    "from elasticsearch import helpers\n",
    "from elasticsearch_dsl import Search\n",
    "import es # This is part of this GitHub Repo\n",
    "import retention # This is part of this GitHub Repo\n",
    "import rollover # This is part of this GitHub Repo\n",
    "import pandas as pd\n",
    "import toml\n",
    "import os\n",
    "import json"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Connect to Elasticsearch\n",
    "es_connection = Elasticsearch('http://localhost:9200')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{'acknowledged': True}"
      ]
     },
     "execution_count": 3,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Cleanup previous demo data - optional\n",
    "# Will throw errors if index does not exist - not a big deal\n",
    "es_connection.indices.delete(index=\"demo-nessus*\")\n",
    "es_connection.indices.delete(index=\"demo-suricata*\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "True"
      ]
     },
     "execution_count": 4,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# This creates a rollover instance with an index aliases to demo-nessus\n",
    "es_connection.indices.create(index=\"demo-nessus-000001\", body='{\"aliases\": { \"demo-nessus\": { \"is_write_index\": true }}}')\n",
    "# Load Nessus sample data - Uses bulk insertion\n",
    "nessus_data = es.load_json_file('demo/logs/nessus.json')\n",
    "es.bulk_insert_data_to_es(es_connection, nessus_data, \"demo-nessus\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "True"
      ]
     },
     "execution_count": 5,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# This creates a rollover instance with an index aliases to demo-suricata\n",
    "# This can take a minute or two to run\n",
    "es_connection.indices.create(index=\"demo-suricata-000001\", body='{\"aliases\": { \"demo-suricata\": { \"is_write_index\": true }}}')\n",
    "# Load Suricata sample data - Uses bulk insertion\n",
    "suricata_data = es.load_json_file('demo/logs/suricata.json')\n",
    "es.bulk_insert_data_to_es(es_connection, suricata_data, \"demo-suricata\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Set our demo search context - will search suricata and nessus data\n",
    "search_context = Search(using=es_connection, index='demo-*', doc_type='doc')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>timestamp</th>\n",
       "      <th>flow_id</th>\n",
       "      <th>event_type</th>\n",
       "      <th>src_ip</th>\n",
       "      <th>src_port</th>\n",
       "      <th>dest_ip</th>\n",
       "      <th>dest_port</th>\n",
       "      <th>proto</th>\n",
       "      <th>app_proto</th>\n",
       "      <th>flow</th>\n",
       "      <th>tcp</th>\n",
       "      <th>in_iface</th>\n",
       "      <th>tx_id</th>\n",
       "      <th>alert</th>\n",
       "      <th>payload</th>\n",
       "      <th>payload_printable</th>\n",
       "      <th>stream</th>\n",
       "      <th>app_proto_ts</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>2017-05-27T21:59:44.005328+0000</td>\n",
       "      <td>103379704739020</td>\n",
       "      <td>flow</td>\n",
       "      <td>172.16.0.2</td>\n",
       "      <td>61555</td>\n",
       "      <td>10.6.66.80</td>\n",
       "      <td>80</td>\n",
       "      <td>TCP</td>\n",
       "      <td>http</td>\n",
       "      <td>{'pkts_toserver': 8, 'pkts_toclient': 15, 'byt...</td>\n",
       "      <td>{'tcp_flags': 'de', 'tcp_flags_ts': 'de', 'tcp...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>2017-05-27T21:59:44.005395+0000</td>\n",
       "      <td>1374363606816801</td>\n",
       "      <td>flow</td>\n",
       "      <td>172.16.0.2</td>\n",
       "      <td>61549</td>\n",
       "      <td>10.6.66.80</td>\n",
       "      <td>80</td>\n",
       "      <td>TCP</td>\n",
       "      <td>http</td>\n",
       "      <td>{'pkts_toserver': 5, 'pkts_toclient': 4, 'byte...</td>\n",
       "      <td>{'tcp_flags': 'de', 'tcp_flags_ts': 'de', 'tcp...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>2017-05-27T21:59:44.005434+0000</td>\n",
       "      <td>1099734807976441</td>\n",
       "      <td>flow</td>\n",
       "      <td>172.16.0.2</td>\n",
       "      <td>61550</td>\n",
       "      <td>10.6.66.80</td>\n",
       "      <td>80</td>\n",
       "      <td>TCP</td>\n",
       "      <td>http</td>\n",
       "      <td>{'pkts_toserver': 5, 'pkts_toclient': 4, 'byte...</td>\n",
       "      <td>{'tcp_flags': 'de', 'tcp_flags_ts': 'de', 'tcp...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>2017-05-27T21:59:44.005468+0000</td>\n",
       "      <td>1100357578216922</td>\n",
       "      <td>flow</td>\n",
       "      <td>172.16.0.2</td>\n",
       "      <td>61544</td>\n",
       "      <td>10.6.66.80</td>\n",
       "      <td>80</td>\n",
       "      <td>TCP</td>\n",
       "      <td>http</td>\n",
       "      <td>{'pkts_toserver': 9, 'pkts_toclient': 17, 'byt...</td>\n",
       "      <td>{'tcp_flags': 'de', 'tcp_flags_ts': 'de', 'tcp...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>2017-05-27T21:59:44.005519+0000</td>\n",
       "      <td>1669221701625458</td>\n",
       "      <td>flow</td>\n",
       "      <td>172.16.0.2</td>\n",
       "      <td>61551</td>\n",
       "      <td>10.6.66.80</td>\n",
       "      <td>80</td>\n",
       "      <td>TCP</td>\n",
       "      <td>http</td>\n",
       "      <td>{'pkts_toserver': 5, 'pkts_toclient': 4, 'byte...</td>\n",
       "      <td>{'tcp_flags': 'de', 'tcp_flags_ts': 'de', 'tcp...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>624</th>\n",
       "      <td>2017-05-27T22:36:51.002670+0000</td>\n",
       "      <td>1680972874891285</td>\n",
       "      <td>flow</td>\n",
       "      <td>172.16.0.2</td>\n",
       "      <td>54420</td>\n",
       "      <td>192.168.0.53</td>\n",
       "      <td>80</td>\n",
       "      <td>TCP</td>\n",
       "      <td>NaN</td>\n",
       "      <td>{'pkts_toserver': 5, 'pkts_toclient': 0, 'byte...</td>\n",
       "      <td>{'tcp_flags': '02', 'tcp_flags_ts': '02', 'tcp...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>625</th>\n",
       "      <td>2017-05-27T22:37:06.002053+0000</td>\n",
       "      <td>887159843536861</td>\n",
       "      <td>flow</td>\n",
       "      <td>172.16.0.2</td>\n",
       "      <td>17528</td>\n",
       "      <td>192.168.0.54</td>\n",
       "      <td>80</td>\n",
       "      <td>TCP</td>\n",
       "      <td>NaN</td>\n",
       "      <td>{'pkts_toserver': 1, 'pkts_toclient': 0, 'byte...</td>\n",
       "      <td>{'tcp_flags': '02', 'tcp_flags_ts': '02', 'tcp...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>626</th>\n",
       "      <td>2017-05-27T22:40:44.015055+0000</td>\n",
       "      <td>233884594681590</td>\n",
       "      <td>flow</td>\n",
       "      <td>172.16.0.2</td>\n",
       "      <td>14883</td>\n",
       "      <td>192.168.2.52</td>\n",
       "      <td>80</td>\n",
       "      <td>TCP</td>\n",
       "      <td>NaN</td>\n",
       "      <td>{'pkts_toserver': 1, 'pkts_toclient': 0, 'byte...</td>\n",
       "      <td>{'tcp_flags': '02', 'tcp_flags_ts': '02', 'tcp...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>627</th>\n",
       "      <td>2017-05-27T22:40:46.000659+0000</td>\n",
       "      <td>871027960742373</td>\n",
       "      <td>flow</td>\n",
       "      <td>172.16.0.2</td>\n",
       "      <td>42290</td>\n",
       "      <td>192.168.0.53</td>\n",
       "      <td>80</td>\n",
       "      <td>TCP</td>\n",
       "      <td>NaN</td>\n",
       "      <td>{'pkts_toserver': 1, 'pkts_toclient': 0, 'byte...</td>\n",
       "      <td>{'tcp_flags': '02', 'tcp_flags_ts': '02', 'tcp...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>628</th>\n",
       "      <td>2017-05-27T22:41:14.001331+0000</td>\n",
       "      <td>163009045157483</td>\n",
       "      <td>flow</td>\n",
       "      <td>172.16.0.2</td>\n",
       "      <td>42180</td>\n",
       "      <td>192.168.0.54</td>\n",
       "      <td>80</td>\n",
       "      <td>TCP</td>\n",
       "      <td>NaN</td>\n",
       "      <td>{'pkts_toserver': 1, 'pkts_toclient': 4, 'byte...</td>\n",
       "      <td>{'tcp_flags': '02', 'tcp_flags_ts': '02', 'tcp...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>629 rows × 18 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "                           timestamp           flow_id event_type      src_ip  \\\n",
       "0    2017-05-27T21:59:44.005328+0000   103379704739020       flow  172.16.0.2   \n",
       "1    2017-05-27T21:59:44.005395+0000  1374363606816801       flow  172.16.0.2   \n",
       "2    2017-05-27T21:59:44.005434+0000  1099734807976441       flow  172.16.0.2   \n",
       "3    2017-05-27T21:59:44.005468+0000  1100357578216922       flow  172.16.0.2   \n",
       "4    2017-05-27T21:59:44.005519+0000  1669221701625458       flow  172.16.0.2   \n",
       "..                               ...               ...        ...         ...   \n",
       "624  2017-05-27T22:36:51.002670+0000  1680972874891285       flow  172.16.0.2   \n",
       "625  2017-05-27T22:37:06.002053+0000   887159843536861       flow  172.16.0.2   \n",
       "626  2017-05-27T22:40:44.015055+0000   233884594681590       flow  172.16.0.2   \n",
       "627  2017-05-27T22:40:46.000659+0000   871027960742373       flow  172.16.0.2   \n",
       "628  2017-05-27T22:41:14.001331+0000   163009045157483       flow  172.16.0.2   \n",
       "\n",
       "     src_port       dest_ip  dest_port proto app_proto  \\\n",
       "0       61555    10.6.66.80         80   TCP      http   \n",
       "1       61549    10.6.66.80         80   TCP      http   \n",
       "2       61550    10.6.66.80         80   TCP      http   \n",
       "3       61544    10.6.66.80         80   TCP      http   \n",
       "4       61551    10.6.66.80         80   TCP      http   \n",
       "..        ...           ...        ...   ...       ...   \n",
       "624     54420  192.168.0.53         80   TCP       NaN   \n",
       "625     17528  192.168.0.54         80   TCP       NaN   \n",
       "626     14883  192.168.2.52         80   TCP       NaN   \n",
       "627     42290  192.168.0.53         80   TCP       NaN   \n",
       "628     42180  192.168.0.54         80   TCP       NaN   \n",
       "\n",
       "                                                  flow  \\\n",
       "0    {'pkts_toserver': 8, 'pkts_toclient': 15, 'byt...   \n",
       "1    {'pkts_toserver': 5, 'pkts_toclient': 4, 'byte...   \n",
       "2    {'pkts_toserver': 5, 'pkts_toclient': 4, 'byte...   \n",
       "3    {'pkts_toserver': 9, 'pkts_toclient': 17, 'byt...   \n",
       "4    {'pkts_toserver': 5, 'pkts_toclient': 4, 'byte...   \n",
       "..                                                 ...   \n",
       "624  {'pkts_toserver': 5, 'pkts_toclient': 0, 'byte...   \n",
       "625  {'pkts_toserver': 1, 'pkts_toclient': 0, 'byte...   \n",
       "626  {'pkts_toserver': 1, 'pkts_toclient': 0, 'byte...   \n",
       "627  {'pkts_toserver': 1, 'pkts_toclient': 0, 'byte...   \n",
       "628  {'pkts_toserver': 1, 'pkts_toclient': 4, 'byte...   \n",
       "\n",
       "                                                   tcp in_iface  tx_id alert  \\\n",
       "0    {'tcp_flags': 'de', 'tcp_flags_ts': 'de', 'tcp...      NaN    NaN   NaN   \n",
       "1    {'tcp_flags': 'de', 'tcp_flags_ts': 'de', 'tcp...      NaN    NaN   NaN   \n",
       "2    {'tcp_flags': 'de', 'tcp_flags_ts': 'de', 'tcp...      NaN    NaN   NaN   \n",
       "3    {'tcp_flags': 'de', 'tcp_flags_ts': 'de', 'tcp...      NaN    NaN   NaN   \n",
       "4    {'tcp_flags': 'de', 'tcp_flags_ts': 'de', 'tcp...      NaN    NaN   NaN   \n",
       "..                                                 ...      ...    ...   ...   \n",
       "624  {'tcp_flags': '02', 'tcp_flags_ts': '02', 'tcp...      NaN    NaN   NaN   \n",
       "625  {'tcp_flags': '02', 'tcp_flags_ts': '02', 'tcp...      NaN    NaN   NaN   \n",
       "626  {'tcp_flags': '02', 'tcp_flags_ts': '02', 'tcp...      NaN    NaN   NaN   \n",
       "627  {'tcp_flags': '02', 'tcp_flags_ts': '02', 'tcp...      NaN    NaN   NaN   \n",
       "628  {'tcp_flags': '02', 'tcp_flags_ts': '02', 'tcp...      NaN    NaN   NaN   \n",
       "\n",
       "    payload payload_printable  stream app_proto_ts  \n",
       "0       NaN               NaN     NaN          NaN  \n",
       "1       NaN               NaN     NaN          NaN  \n",
       "2       NaN               NaN     NaN          NaN  \n",
       "3       NaN               NaN     NaN          NaN  \n",
       "4       NaN               NaN     NaN          NaN  \n",
       "..      ...               ...     ...          ...  \n",
       "624     NaN               NaN     NaN          NaN  \n",
       "625     NaN               NaN     NaN          NaN  \n",
       "626     NaN               NaN     NaN          NaN  \n",
       "627     NaN               NaN     NaN          NaN  \n",
       "628     NaN               NaN     NaN          NaN  \n",
       "\n",
       "[629 rows x 18 columns]"
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Test query data from Suricata\n",
    "s = search_context.query('query_string', query='src_ip:172.16.0.2 AND dest_port:80')\n",
    "response = s.execute()\n",
    "if response.success():\n",
    "    df = pd.DataFrame((d.to_dict() for d in s.scan()))\n",
    "df"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [],
   "source": [
    "# There will be no output from loading this function\n",
    "def query_es(index, query):\n",
    "    search_context = Search(using=es_connection, index=index, doc_type=query)\n",
    "    s = search_context.query('query_string', query=query)\n",
    "    response = s.execute()\n",
    "    if response.success():\n",
    "        df = pd.DataFrame((d.to_dict() for d in s.scan()))\n",
    "        return df"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Time</th>\n",
       "      <th>Entry Location</th>\n",
       "      <th>Entry</th>\n",
       "      <th>Enabled</th>\n",
       "      <th>Category</th>\n",
       "      <th>Profile</th>\n",
       "      <th>description</th>\n",
       "      <th>Signer</th>\n",
       "      <th>Company</th>\n",
       "      <th>Image Path</th>\n",
       "      <th>Version</th>\n",
       "      <th>Launch String</th>\n",
       "      <th>MD5</th>\n",
       "      <th>SHA-1</th>\n",
       "      <th>PESHA-1</th>\n",
       "      <th>PESHA-256</th>\n",
       "      <th>SHA-256</th>\n",
       "      <th>IMP</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>20170501-040423</td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>DcomLaunch</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>The DCOMLAUNCH service launches COM and DCOM s...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\rpcss.dll</td>\n",
       "      <td></td>\n",
       "      <td>%SystemRoot%\\system32\\rpcss.dll</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>DeviceInstall</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Enables a computer to recognize and adapt to h...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\umpnpmgr.dll</td>\n",
       "      <td></td>\n",
       "      <td>%SystemRoot%\\system32\\umpnpmgr.dll</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>dot3svc</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>The Wired AutoConfig (DOT3SVC) service is resp...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\dot3svc.dll</td>\n",
       "      <td></td>\n",
       "      <td>%SystemRoot%\\System32\\dot3svc.dll</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>DsRoleSvc</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>This service hosts the DS Role Server used for...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\dsrolesrv.dll</td>\n",
       "      <td></td>\n",
       "      <td>%SystemRoot%\\system32\\dsrolesrv.dll</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>FontCache</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Optimizes performance of applications by cachi...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\fntcache.dll</td>\n",
       "      <td></td>\n",
       "      <td>%SystemRoot%\\system32\\FntCache.dll</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>KtmRm</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Coordinates transactions between the Distribut...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\msdtckrm.dll</td>\n",
       "      <td></td>\n",
       "      <td>%systemroot%\\system32\\msdtckrm.dll</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>MMCSS</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Enables relative prioritization of work based ...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\mmcss.dll</td>\n",
       "      <td></td>\n",
       "      <td>%SystemRoot%\\system32\\mmcss.dll</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>netprofm</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Identifies the networks to which the computer ...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\netprofmsvc.dll</td>\n",
       "      <td></td>\n",
       "      <td>%SystemRoot%\\System32\\netprofmsvc.dll</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>20170110-193221</td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>nxlog</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>This service is responsible for running the nx...</td>\n",
       "      <td>(Verified) NXLog Ltd</td>\n",
       "      <td>NXLog Ltd</td>\n",
       "      <td>c:\\program files (x86)\\nxlog\\nxlog.exe</td>\n",
       "      <td>3.0.1845.0</td>\n",
       "      <td>C:\\Program Files (x86)\\nxlog\\nxlog.exe\"\" -c \"\"...</td>\n",
       "      <td>DFE4561FB63AA2F16A3E60EE1A08E864</td>\n",
       "      <td>A6428BBE6D1A31313D2108A3A535BBDF26D07618</td>\n",
       "      <td>120B449561199ADC5E2AC24F24C547FE388460B3</td>\n",
       "      <td>AF4397E043F98A712B574944008F2B4B4DDF827EB34B5C...</td>\n",
       "      <td>2772D7403E807FA329DD7200EE31D10582AEFF336A3E0E...</td>\n",
       "      <td>9CE11C92462D6D0B568AA07F902EC3A2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>10</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>RpcSs</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>The RPCSS service is the Service Control Manag...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\rpcss.dll</td>\n",
       "      <td></td>\n",
       "      <td>%SystemRoot%\\system32\\rpcss.dll</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>SamSs</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>The startup of this service signals other serv...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\lsass.exe</td>\n",
       "      <td></td>\n",
       "      <td>%SystemRoot%\\system32\\lsass.exe</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>12</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>Schedule</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Enables a user to configure and schedule autom...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\schedsvc.dll</td>\n",
       "      <td></td>\n",
       "      <td>%systemroot%\\system32\\schedsvc.dll</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>13</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>SCPolicySvc</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Allows the system to be configured to lock the...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\certprop.dll</td>\n",
       "      <td></td>\n",
       "      <td>%SystemRoot%\\System32\\certprop.dll</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>14</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>swprv</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Manages software-based volume shadow copies ta...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\swprv.dll</td>\n",
       "      <td></td>\n",
       "      <td>%Systemroot%\\System32\\swprv.dll</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>15</th>\n",
       "      <td>20130726-122158</td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>TPAutoConnSvc</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>ThinPrint component for printing with ThinPrin...</td>\n",
       "      <td>(Verified) Cortado AG</td>\n",
       "      <td>Cortado AG</td>\n",
       "      <td>c:\\program files\\vmware\\vmware tools\\tpautocon...</td>\n",
       "      <td>8.8.476.2</td>\n",
       "      <td>C:\\Program Files\\VMware\\VMware Tools\\TPAutoCon...</td>\n",
       "      <td>4B84A2BE755D944CE7FCFA76C48D6A42</td>\n",
       "      <td>C32EB52D3982F0CE60D6E8D80F9B8FF99CC2110D</td>\n",
       "      <td>95670D42FF28756E7E4BB3AC37D223F4CEBC1570</td>\n",
       "      <td>A31184BA45980136C3ED14E8EF10F0631BDB4EC188D970...</td>\n",
       "      <td>994647A1AD048F6555C67872DED22C37C6FD56DFA2B2A7...</td>\n",
       "      <td>7DA8CF61C630B937C173AEE23BE1E34A</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>16</th>\n",
       "      <td>20120221-111353</td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>TPVCGateway</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>ThinPrint component that receives print data f...</td>\n",
       "      <td>(Verified) Cortado AG</td>\n",
       "      <td>Cortado AG</td>\n",
       "      <td>c:\\program files\\vmware\\vmware tools\\tpvcgatew...</td>\n",
       "      <td>8.6.239.2</td>\n",
       "      <td>C:\\Program Files\\VMware\\VMware Tools\\TPVCGatew...</td>\n",
       "      <td>072F5C08107AF972993796F3F7E13F61</td>\n",
       "      <td>FD149FED172558DD1F363BC645F31F9461BE5D5C</td>\n",
       "      <td>91DF23E9C72921138DAF6A713DE03AC7B97185FA</td>\n",
       "      <td>C95C8AEC825B4D6BB852A843521FEE50D4CB3F778C26A7...</td>\n",
       "      <td>83D8CAA52991FB6348D4143B553BC251B9EF4309AC3B4B...</td>\n",
       "      <td>9576D506DC541E6B8F05D04A51AFC638</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>17</th>\n",
       "      <td>20140321-234411</td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>VMTools</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Provides support for synchronizing objects bet...</td>\n",
       "      <td>(Verified) VMware</td>\n",
       "      <td>VMware, Inc.</td>\n",
       "      <td>c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe</td>\n",
       "      <td>9.6.2.31837</td>\n",
       "      <td>C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd....</td>\n",
       "      <td>9813643EC82470DF35B5079D99F4972C</td>\n",
       "      <td>71EB5636CE44C41C814BD735268B1D82D3911E17</td>\n",
       "      <td>A010A529B48CA42BC39FB18C64EE5DFB8CFA446C</td>\n",
       "      <td>5DF203DFAC0136F0367C2DB3AA595B89EF7965997165BE...</td>\n",
       "      <td>FAB7A77CCD3497BCCC34477C5C696E3A25B48E2CE1D58D...</td>\n",
       "      <td>568EF2B89AA1E99B7D982B24E6636F7A</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>18</th>\n",
       "      <td>20170527-171239</td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>19</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>ALG</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Provides support for 3rd party protocol plug-i...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\alg.exe</td>\n",
       "      <td></td>\n",
       "      <td>%SystemRoot%\\System32\\alg.exe</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>20</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>AppIDSvc</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Determines and verifies the identity of an app...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\appidsvc.dll</td>\n",
       "      <td></td>\n",
       "      <td>%SystemRoot%\\System32\\appidsvc.dll</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>21</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>CertPropSvc</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Copies user certificates and root certificates...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\certprop.dll</td>\n",
       "      <td></td>\n",
       "      <td>%SystemRoot%\\System32\\certprop.dll</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>22</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>FDResPub</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Publishes this computer and resources attached...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\fdrespub.dll</td>\n",
       "      <td></td>\n",
       "      <td>%SystemRoot%\\system32\\fdrespub.dll</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>23</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>FrameServer</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Enables multiple clients to access video frame...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\frameserver.dll</td>\n",
       "      <td></td>\n",
       "      <td>%SystemRoot%\\system32\\FrameServer.dll</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>24</th>\n",
       "      <td>20170110-193221</td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>nxlog</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>This service is responsible for running the nx...</td>\n",
       "      <td>(Verified) NXLog Ltd</td>\n",
       "      <td>NXLog Ltd</td>\n",
       "      <td>c:\\program files (x86)\\nxlog\\nxlog.exe</td>\n",
       "      <td>3.0.1845.0</td>\n",
       "      <td>C:\\Program Files (x86)\\nxlog\\nxlog.exe\"\" -c \"\"...</td>\n",
       "      <td>DFE4561FB63AA2F16A3E60EE1A08E864</td>\n",
       "      <td>A6428BBE6D1A31313D2108A3A535BBDF26D07618</td>\n",
       "      <td>120B449561199ADC5E2AC24F24C547FE388460B3</td>\n",
       "      <td>AF4397E043F98A712B574944008F2B4B4DDF827EB34B5C...</td>\n",
       "      <td>2772D7403E807FA329DD7200EE31D10582AEFF336A3E0E...</td>\n",
       "      <td>9CE11C92462D6D0B568AA07F902EC3A2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>swprv</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Manages software-based volume shadow copies ta...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\swprv.dll</td>\n",
       "      <td></td>\n",
       "      <td>%Systemroot%\\System32\\swprv.dll</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>26</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>SysMain</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Maintains and improves system performance over...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\sysmain.dll</td>\n",
       "      <td></td>\n",
       "      <td>%systemroot%\\system32\\sysmain.dll</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>27</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>TermService</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Allows users to connect interactively to a rem...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\termsrv.dll</td>\n",
       "      <td></td>\n",
       "      <td>%SystemRoot%\\System32\\termsrv.dll</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>28</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>tiledatamodelsvc</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Tile Server for tile updates.</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\tileobjserver.dll</td>\n",
       "      <td></td>\n",
       "      <td>%SystemRoot%\\system32\\tileobjserver.dll</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>29</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>TimeBrokerSvc</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Coordinates execution of background work for W...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\timebrokerserver.dll</td>\n",
       "      <td></td>\n",
       "      <td>%SystemRoot%\\System32\\TimeBrokerServer.dll</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>30</th>\n",
       "      <td>20160719-130842</td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>TPAutoConnSvc</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>ThinPrint component for creating printers or c...</td>\n",
       "      <td>(Verified) Cortado AG</td>\n",
       "      <td>ThinPrint GmbH</td>\n",
       "      <td>c:\\program files\\vmware\\vmware tools\\tpautocon...</td>\n",
       "      <td>10.2.569.2</td>\n",
       "      <td>C:\\Program Files\\VMware\\VMware Tools\\TPAutoCon...</td>\n",
       "      <td>65D6589C2E1D328C50B0B0D183089A67</td>\n",
       "      <td>FFC3AA7909D4E72C360D65A1F45260DFFE5C99B7</td>\n",
       "      <td>9BAF4AF7B9DE3B823C442A33621579E036CBD547</td>\n",
       "      <td>DA7EB4D21BC64F9A568DBC143EF06621405FE05574F912...</td>\n",
       "      <td>A9B095ED024118D9D990DAF7B84159D899E856F1E34438...</td>\n",
       "      <td>7208D0FDDB6F9A603DFF51F34DE2BE82</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>31</th>\n",
       "      <td>20141029-135202</td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>TPVCGateway</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>ThinPrint component that receives print data f...</td>\n",
       "      <td>(Verified) Cortado AG</td>\n",
       "      <td>Cortado AG</td>\n",
       "      <td>c:\\program files\\vmware\\vmware tools\\tpvcgatew...</td>\n",
       "      <td>10.2.266.2</td>\n",
       "      <td>C:\\Program Files\\VMware\\VMware Tools\\TPVCGatew...</td>\n",
       "      <td>853EE33D97B8BE1C20EA6321EDD9F7E1</td>\n",
       "      <td>790F7247876A5FA44FD439E3EEBE70B5CC237222</td>\n",
       "      <td>8DAD6491B71C880C9F08911D75FC264E954A06FE</td>\n",
       "      <td>671E6E175EF1DE9A8888D41CDAF301D8C1555A57348C59...</td>\n",
       "      <td>36783A5027FD3140B97EAE048AEDB1D23E7F950A52D730...</td>\n",
       "      <td>F311DE924313899E3D398C604DAB12C4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>32</th>\n",
       "      <td>20170211-070601</td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>VGAuthService</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Alias Manager and Ticket Service</td>\n",
       "      <td>(Not verified) VMware, Inc.</td>\n",
       "      <td>VMware, Inc.</td>\n",
       "      <td>c:\\program files\\vmware\\vmware tools\\vmware vg...</td>\n",
       "      <td>10.1.5.34042</td>\n",
       "      <td>C:\\Program Files\\VMware\\VMware Tools\\VMware VG...</td>\n",
       "      <td>928DA36B4250F8EBDE7D9F790F519D49</td>\n",
       "      <td>67AFF3EFE16FFC52B175731EC1051EDC78429A2F</td>\n",
       "      <td>90EB05DE2A167D3FB534EDBA9C20409009EEC3FF</td>\n",
       "      <td>CA6600AD256F7FFC5A8597853FC15E54BFBC2540BFAFF6...</td>\n",
       "      <td>9D67EFA96796E24CBEACE6190B29B8DD03271326B83D87...</td>\n",
       "      <td>AAC673A4F025FE7FF8A5C1D0ED0958F4</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>33</th>\n",
       "      <td></td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>vmicvmsession</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Provides a mechanism to manage virtual machine...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\windows\\syswow64\\icsvc.dll</td>\n",
       "      <td></td>\n",
       "      <td>%SystemRoot%\\System32\\icsvc.dll</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>34</th>\n",
       "      <td>20170317-142011</td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>VMTools</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Provides support for synchronizing objects bet...</td>\n",
       "      <td>(Verified) VMware</td>\n",
       "      <td>VMware, Inc.</td>\n",
       "      <td>c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe</td>\n",
       "      <td>10.1.6.4793</td>\n",
       "      <td>C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd....</td>\n",
       "      <td>1E577F6D1F3C530C11DC0A7BD1FE765D</td>\n",
       "      <td>89AB8CA84B00E2EA9A5D35686857A2E1B450E4D6</td>\n",
       "      <td>A12195FE851EA7C5A87809069C3D1E3E3464F948</td>\n",
       "      <td>8A3851432729379E96F2B9F74B68768AE1B65E942336F2...</td>\n",
       "      <td>ED9FB40C3CB5BA0A9AC3ADE80B503F5D7128016C75852E...</td>\n",
       "      <td>687331B84F3669D020708C40F729FA33</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>35</th>\n",
       "      <td>20170317-142243</td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>VMware Physical Disk Helper Service</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>Enables support for running virtual machines f...</td>\n",
       "      <td>(Verified) VMware</td>\n",
       "      <td>VMware, Inc.</td>\n",
       "      <td>c:\\program files\\vmware\\vmware tools\\vmacthlp.exe</td>\n",
       "      <td>10.1.6.4793</td>\n",
       "      <td>C:\\Program Files\\VMware\\VMware Tools\\vmacthlp....</td>\n",
       "      <td>80B3EB3196DCEAB6ADC85172087A5FAD</td>\n",
       "      <td>1BA53A89540D9C1BA5212E2D2ABF908257703CA2</td>\n",
       "      <td>1958C675FDF72A748E59A75492C9AAFB2708EB1B</td>\n",
       "      <td>0DC87B78C255543687B5565CFFE49AF8E6FCAF4E1D061A...</td>\n",
       "      <td>2B658D0A86220608C9F8FAC30494A0368778FD7DA5E652...</td>\n",
       "      <td>CE60C02CD8577CEB415A85B3A05ECE4B</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>36</th>\n",
       "      <td>20170317-142609</td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>VMwareCAFCommAmqpListener</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>VMware Common Agent AMQP Communication Service</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\program files\\vmware\\vmware tools\\vmware ca...</td>\n",
       "      <td></td>\n",
       "      <td>C:\\Program Files\\VMware\\VMware Tools\\VMware CA...</td>\n",
       "      <td>6B504504A23B21778E66BA344B5FB5EC</td>\n",
       "      <td>B71DB14301CBC92F37FE2786256795E0C60C5620</td>\n",
       "      <td>B26552526828D0516E4500CD577270A1CFB4B097</td>\n",
       "      <td>FCA502CD6BD4F7B5BD9E35564CD687439AF6C1B4D0AAD2...</td>\n",
       "      <td>E6E93BFC7BD098FA9D38E51DD1AE4106A73ED56251F725...</td>\n",
       "      <td>A87C6852F7654939F2A1C31DCD23E017</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>37</th>\n",
       "      <td>20170317-142528</td>\n",
       "      <td>HKLM\\System\\CurrentControlSet\\Services</td>\n",
       "      <td>VMwareCAFManagementAgentHost</td>\n",
       "      <td>enabled</td>\n",
       "      <td>Services</td>\n",
       "      <td>System-wide</td>\n",
       "      <td>VMware Common Agent Management Agent Service</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>c:\\program files\\vmware\\vmware tools\\vmware ca...</td>\n",
       "      <td></td>\n",
       "      <td>C:\\Program Files\\VMware\\VMware Tools\\VMware CA...</td>\n",
       "      <td>5C8CE20FABFE89012612637BF97E23EF</td>\n",
       "      <td>02FFA9316EBB23BCFE203540A8580F7B41D47A1A</td>\n",
       "      <td>7A67A67BC12BA8AF1CCBBF1E36C2EDF03AE796B2</td>\n",
       "      <td>28727856FE0295E4BA02D890CBABD0FF2CBDE72C62674E...</td>\n",
       "      <td>435603112D830DB82A3622F7A3387AE91BA828435A7A8D...</td>\n",
       "      <td>0A690708F6618B762191D92A6E9AB382</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "               Time                          Entry Location  \\\n",
       "0   20170501-040423  HKLM\\System\\CurrentControlSet\\Services   \n",
       "1                    HKLM\\System\\CurrentControlSet\\Services   \n",
       "2                    HKLM\\System\\CurrentControlSet\\Services   \n",
       "3                    HKLM\\System\\CurrentControlSet\\Services   \n",
       "4                    HKLM\\System\\CurrentControlSet\\Services   \n",
       "5                    HKLM\\System\\CurrentControlSet\\Services   \n",
       "6                    HKLM\\System\\CurrentControlSet\\Services   \n",
       "7                    HKLM\\System\\CurrentControlSet\\Services   \n",
       "8                    HKLM\\System\\CurrentControlSet\\Services   \n",
       "9   20170110-193221  HKLM\\System\\CurrentControlSet\\Services   \n",
       "10                   HKLM\\System\\CurrentControlSet\\Services   \n",
       "11                   HKLM\\System\\CurrentControlSet\\Services   \n",
       "12                   HKLM\\System\\CurrentControlSet\\Services   \n",
       "13                   HKLM\\System\\CurrentControlSet\\Services   \n",
       "14                   HKLM\\System\\CurrentControlSet\\Services   \n",
       "15  20130726-122158  HKLM\\System\\CurrentControlSet\\Services   \n",
       "16  20120221-111353  HKLM\\System\\CurrentControlSet\\Services   \n",
       "17  20140321-234411  HKLM\\System\\CurrentControlSet\\Services   \n",
       "18  20170527-171239  HKLM\\System\\CurrentControlSet\\Services   \n",
       "19                   HKLM\\System\\CurrentControlSet\\Services   \n",
       "20                   HKLM\\System\\CurrentControlSet\\Services   \n",
       "21                   HKLM\\System\\CurrentControlSet\\Services   \n",
       "22                   HKLM\\System\\CurrentControlSet\\Services   \n",
       "23                   HKLM\\System\\CurrentControlSet\\Services   \n",
       "24  20170110-193221  HKLM\\System\\CurrentControlSet\\Services   \n",
       "25                   HKLM\\System\\CurrentControlSet\\Services   \n",
       "26                   HKLM\\System\\CurrentControlSet\\Services   \n",
       "27                   HKLM\\System\\CurrentControlSet\\Services   \n",
       "28                   HKLM\\System\\CurrentControlSet\\Services   \n",
       "29                   HKLM\\System\\CurrentControlSet\\Services   \n",
       "30  20160719-130842  HKLM\\System\\CurrentControlSet\\Services   \n",
       "31  20141029-135202  HKLM\\System\\CurrentControlSet\\Services   \n",
       "32  20170211-070601  HKLM\\System\\CurrentControlSet\\Services   \n",
       "33                   HKLM\\System\\CurrentControlSet\\Services   \n",
       "34  20170317-142011  HKLM\\System\\CurrentControlSet\\Services   \n",
       "35  20170317-142243  HKLM\\System\\CurrentControlSet\\Services   \n",
       "36  20170317-142609  HKLM\\System\\CurrentControlSet\\Services   \n",
       "37  20170317-142528  HKLM\\System\\CurrentControlSet\\Services   \n",
       "\n",
       "                                  Entry  Enabled  Category      Profile  \\\n",
       "0                                                 Services  System-wide   \n",
       "1                            DcomLaunch  enabled  Services  System-wide   \n",
       "2                         DeviceInstall  enabled  Services  System-wide   \n",
       "3                               dot3svc  enabled  Services  System-wide   \n",
       "4                             DsRoleSvc  enabled  Services  System-wide   \n",
       "5                             FontCache  enabled  Services  System-wide   \n",
       "6                                 KtmRm  enabled  Services  System-wide   \n",
       "7                                 MMCSS  enabled  Services  System-wide   \n",
       "8                              netprofm  enabled  Services  System-wide   \n",
       "9                                 nxlog  enabled  Services  System-wide   \n",
       "10                                RpcSs  enabled  Services  System-wide   \n",
       "11                                SamSs  enabled  Services  System-wide   \n",
       "12                             Schedule  enabled  Services  System-wide   \n",
       "13                          SCPolicySvc  enabled  Services  System-wide   \n",
       "14                                swprv  enabled  Services  System-wide   \n",
       "15                        TPAutoConnSvc  enabled  Services  System-wide   \n",
       "16                          TPVCGateway  enabled  Services  System-wide   \n",
       "17                              VMTools  enabled  Services  System-wide   \n",
       "18                                                Services  System-wide   \n",
       "19                                  ALG  enabled  Services  System-wide   \n",
       "20                             AppIDSvc  enabled  Services  System-wide   \n",
       "21                          CertPropSvc  enabled  Services  System-wide   \n",
       "22                             FDResPub  enabled  Services  System-wide   \n",
       "23                          FrameServer  enabled  Services  System-wide   \n",
       "24                                nxlog  enabled  Services  System-wide   \n",
       "25                                swprv  enabled  Services  System-wide   \n",
       "26                              SysMain  enabled  Services  System-wide   \n",
       "27                          TermService  enabled  Services  System-wide   \n",
       "28                     tiledatamodelsvc  enabled  Services  System-wide   \n",
       "29                        TimeBrokerSvc  enabled  Services  System-wide   \n",
       "30                        TPAutoConnSvc  enabled  Services  System-wide   \n",
       "31                          TPVCGateway  enabled  Services  System-wide   \n",
       "32                        VGAuthService  enabled  Services  System-wide   \n",
       "33                        vmicvmsession  enabled  Services  System-wide   \n",
       "34                              VMTools  enabled  Services  System-wide   \n",
       "35  VMware Physical Disk Helper Service  enabled  Services  System-wide   \n",
       "36            VMwareCAFCommAmqpListener  enabled  Services  System-wide   \n",
       "37         VMwareCAFManagementAgentHost  enabled  Services  System-wide   \n",
       "\n",
       "                                          description  \\\n",
       "0                                                       \n",
       "1   The DCOMLAUNCH service launches COM and DCOM s...   \n",
       "2   Enables a computer to recognize and adapt to h...   \n",
       "3   The Wired AutoConfig (DOT3SVC) service is resp...   \n",
       "4   This service hosts the DS Role Server used for...   \n",
       "5   Optimizes performance of applications by cachi...   \n",
       "6   Coordinates transactions between the Distribut...   \n",
       "7   Enables relative prioritization of work based ...   \n",
       "8   Identifies the networks to which the computer ...   \n",
       "9   This service is responsible for running the nx...   \n",
       "10  The RPCSS service is the Service Control Manag...   \n",
       "11  The startup of this service signals other serv...   \n",
       "12  Enables a user to configure and schedule autom...   \n",
       "13  Allows the system to be configured to lock the...   \n",
       "14  Manages software-based volume shadow copies ta...   \n",
       "15  ThinPrint component for printing with ThinPrin...   \n",
       "16  ThinPrint component that receives print data f...   \n",
       "17  Provides support for synchronizing objects bet...   \n",
       "18                                                      \n",
       "19  Provides support for 3rd party protocol plug-i...   \n",
       "20  Determines and verifies the identity of an app...   \n",
       "21  Copies user certificates and root certificates...   \n",
       "22  Publishes this computer and resources attached...   \n",
       "23  Enables multiple clients to access video frame...   \n",
       "24  This service is responsible for running the nx...   \n",
       "25  Manages software-based volume shadow copies ta...   \n",
       "26  Maintains and improves system performance over...   \n",
       "27  Allows users to connect interactively to a rem...   \n",
       "28                      Tile Server for tile updates.   \n",
       "29  Coordinates execution of background work for W...   \n",
       "30  ThinPrint component for creating printers or c...   \n",
       "31  ThinPrint component that receives print data f...   \n",
       "32                   Alias Manager and Ticket Service   \n",
       "33  Provides a mechanism to manage virtual machine...   \n",
       "34  Provides support for synchronizing objects bet...   \n",
       "35  Enables support for running virtual machines f...   \n",
       "36     VMware Common Agent AMQP Communication Service   \n",
       "37       VMware Common Agent Management Agent Service   \n",
       "\n",
       "                         Signer         Company  \\\n",
       "0                                                 \n",
       "1                                                 \n",
       "2                                                 \n",
       "3                                                 \n",
       "4                                                 \n",
       "5                                                 \n",
       "6                                                 \n",
       "7                                                 \n",
       "8                                                 \n",
       "9          (Verified) NXLog Ltd       NXLog Ltd   \n",
       "10                                                \n",
       "11                                                \n",
       "12                                                \n",
       "13                                                \n",
       "14                                                \n",
       "15        (Verified) Cortado AG      Cortado AG   \n",
       "16        (Verified) Cortado AG      Cortado AG   \n",
       "17            (Verified) VMware    VMware, Inc.   \n",
       "18                                                \n",
       "19                                                \n",
       "20                                                \n",
       "21                                                \n",
       "22                                                \n",
       "23                                                \n",
       "24         (Verified) NXLog Ltd       NXLog Ltd   \n",
       "25                                                \n",
       "26                                                \n",
       "27                                                \n",
       "28                                                \n",
       "29                                                \n",
       "30        (Verified) Cortado AG  ThinPrint GmbH   \n",
       "31        (Verified) Cortado AG      Cortado AG   \n",
       "32  (Not verified) VMware, Inc.    VMware, Inc.   \n",
       "33                                                \n",
       "34            (Verified) VMware    VMware, Inc.   \n",
       "35            (Verified) VMware    VMware, Inc.   \n",
       "36                                                \n",
       "37                                                \n",
       "\n",
       "                                           Image Path       Version  \\\n",
       "0                                                                     \n",
       "1                       c:\\windows\\syswow64\\rpcss.dll                 \n",
       "2                    c:\\windows\\syswow64\\umpnpmgr.dll                 \n",
       "3                     c:\\windows\\syswow64\\dot3svc.dll                 \n",
       "4                   c:\\windows\\syswow64\\dsrolesrv.dll                 \n",
       "5                    c:\\windows\\syswow64\\fntcache.dll                 \n",
       "6                    c:\\windows\\syswow64\\msdtckrm.dll                 \n",
       "7                       c:\\windows\\syswow64\\mmcss.dll                 \n",
       "8                 c:\\windows\\syswow64\\netprofmsvc.dll                 \n",
       "9              c:\\program files (x86)\\nxlog\\nxlog.exe    3.0.1845.0   \n",
       "10                      c:\\windows\\syswow64\\rpcss.dll                 \n",
       "11                      c:\\windows\\syswow64\\lsass.exe                 \n",
       "12                   c:\\windows\\syswow64\\schedsvc.dll                 \n",
       "13                   c:\\windows\\syswow64\\certprop.dll                 \n",
       "14                      c:\\windows\\syswow64\\swprv.dll                 \n",
       "15  c:\\program files\\vmware\\vmware tools\\tpautocon...     8.8.476.2   \n",
       "16  c:\\program files\\vmware\\vmware tools\\tpvcgatew...     8.6.239.2   \n",
       "17  c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe   9.6.2.31837   \n",
       "18                                                                    \n",
       "19                        c:\\windows\\syswow64\\alg.exe                 \n",
       "20                   c:\\windows\\syswow64\\appidsvc.dll                 \n",
       "21                   c:\\windows\\syswow64\\certprop.dll                 \n",
       "22                   c:\\windows\\syswow64\\fdrespub.dll                 \n",
       "23                c:\\windows\\syswow64\\frameserver.dll                 \n",
       "24             c:\\program files (x86)\\nxlog\\nxlog.exe    3.0.1845.0   \n",
       "25                      c:\\windows\\syswow64\\swprv.dll                 \n",
       "26                    c:\\windows\\syswow64\\sysmain.dll                 \n",
       "27                    c:\\windows\\syswow64\\termsrv.dll                 \n",
       "28              c:\\windows\\syswow64\\tileobjserver.dll                 \n",
       "29           c:\\windows\\syswow64\\timebrokerserver.dll                 \n",
       "30  c:\\program files\\vmware\\vmware tools\\tpautocon...    10.2.569.2   \n",
       "31  c:\\program files\\vmware\\vmware tools\\tpvcgatew...    10.2.266.2   \n",
       "32  c:\\program files\\vmware\\vmware tools\\vmware vg...  10.1.5.34042   \n",
       "33                      c:\\windows\\syswow64\\icsvc.dll                 \n",
       "34  c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe   10.1.6.4793   \n",
       "35  c:\\program files\\vmware\\vmware tools\\vmacthlp.exe   10.1.6.4793   \n",
       "36  c:\\program files\\vmware\\vmware tools\\vmware ca...                 \n",
       "37  c:\\program files\\vmware\\vmware tools\\vmware ca...                 \n",
       "\n",
       "                                        Launch String  \\\n",
       "0                                                       \n",
       "1                     %SystemRoot%\\system32\\rpcss.dll   \n",
       "2                  %SystemRoot%\\system32\\umpnpmgr.dll   \n",
       "3                   %SystemRoot%\\System32\\dot3svc.dll   \n",
       "4                 %SystemRoot%\\system32\\dsrolesrv.dll   \n",
       "5                  %SystemRoot%\\system32\\FntCache.dll   \n",
       "6                  %systemroot%\\system32\\msdtckrm.dll   \n",
       "7                     %SystemRoot%\\system32\\mmcss.dll   \n",
       "8               %SystemRoot%\\System32\\netprofmsvc.dll   \n",
       "9   C:\\Program Files (x86)\\nxlog\\nxlog.exe\"\" -c \"\"...   \n",
       "10                    %SystemRoot%\\system32\\rpcss.dll   \n",
       "11                    %SystemRoot%\\system32\\lsass.exe   \n",
       "12                 %systemroot%\\system32\\schedsvc.dll   \n",
       "13                 %SystemRoot%\\System32\\certprop.dll   \n",
       "14                    %Systemroot%\\System32\\swprv.dll   \n",
       "15  C:\\Program Files\\VMware\\VMware Tools\\TPAutoCon...   \n",
       "16  C:\\Program Files\\VMware\\VMware Tools\\TPVCGatew...   \n",
       "17  C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd....   \n",
       "18                                                      \n",
       "19                      %SystemRoot%\\System32\\alg.exe   \n",
       "20                 %SystemRoot%\\System32\\appidsvc.dll   \n",
       "21                 %SystemRoot%\\System32\\certprop.dll   \n",
       "22                 %SystemRoot%\\system32\\fdrespub.dll   \n",
       "23              %SystemRoot%\\system32\\FrameServer.dll   \n",
       "24  C:\\Program Files (x86)\\nxlog\\nxlog.exe\"\" -c \"\"...   \n",
       "25                    %Systemroot%\\System32\\swprv.dll   \n",
       "26                  %systemroot%\\system32\\sysmain.dll   \n",
       "27                  %SystemRoot%\\System32\\termsrv.dll   \n",
       "28            %SystemRoot%\\system32\\tileobjserver.dll   \n",
       "29         %SystemRoot%\\System32\\TimeBrokerServer.dll   \n",
       "30  C:\\Program Files\\VMware\\VMware Tools\\TPAutoCon...   \n",
       "31  C:\\Program Files\\VMware\\VMware Tools\\TPVCGatew...   \n",
       "32  C:\\Program Files\\VMware\\VMware Tools\\VMware VG...   \n",
       "33                    %SystemRoot%\\System32\\icsvc.dll   \n",
       "34  C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd....   \n",
       "35  C:\\Program Files\\VMware\\VMware Tools\\vmacthlp....   \n",
       "36  C:\\Program Files\\VMware\\VMware Tools\\VMware CA...   \n",
       "37  C:\\Program Files\\VMware\\VMware Tools\\VMware CA...   \n",
       "\n",
       "                                 MD5  \\\n",
       "0                                      \n",
       "1                                      \n",
       "2                                      \n",
       "3                                      \n",
       "4                                      \n",
       "5                                      \n",
       "6                                      \n",
       "7                                      \n",
       "8                                      \n",
       "9   DFE4561FB63AA2F16A3E60EE1A08E864   \n",
       "10                                     \n",
       "11                                     \n",
       "12                                     \n",
       "13                                     \n",
       "14                                     \n",
       "15  4B84A2BE755D944CE7FCFA76C48D6A42   \n",
       "16  072F5C08107AF972993796F3F7E13F61   \n",
       "17  9813643EC82470DF35B5079D99F4972C   \n",
       "18                                     \n",
       "19                                     \n",
       "20                                     \n",
       "21                                     \n",
       "22                                     \n",
       "23                                     \n",
       "24  DFE4561FB63AA2F16A3E60EE1A08E864   \n",
       "25                                     \n",
       "26                                     \n",
       "27                                     \n",
       "28                                     \n",
       "29                                     \n",
       "30  65D6589C2E1D328C50B0B0D183089A67   \n",
       "31  853EE33D97B8BE1C20EA6321EDD9F7E1   \n",
       "32  928DA36B4250F8EBDE7D9F790F519D49   \n",
       "33                                     \n",
       "34  1E577F6D1F3C530C11DC0A7BD1FE765D   \n",
       "35  80B3EB3196DCEAB6ADC85172087A5FAD   \n",
       "36  6B504504A23B21778E66BA344B5FB5EC   \n",
       "37  5C8CE20FABFE89012612637BF97E23EF   \n",
       "\n",
       "                                       SHA-1  \\\n",
       "0                                              \n",
       "1                                              \n",
       "2                                              \n",
       "3                                              \n",
       "4                                              \n",
       "5                                              \n",
       "6                                              \n",
       "7                                              \n",
       "8                                              \n",
       "9   A6428BBE6D1A31313D2108A3A535BBDF26D07618   \n",
       "10                                             \n",
       "11                                             \n",
       "12                                             \n",
       "13                                             \n",
       "14                                             \n",
       "15  C32EB52D3982F0CE60D6E8D80F9B8FF99CC2110D   \n",
       "16  FD149FED172558DD1F363BC645F31F9461BE5D5C   \n",
       "17  71EB5636CE44C41C814BD735268B1D82D3911E17   \n",
       "18                                             \n",
       "19                                             \n",
       "20                                             \n",
       "21                                             \n",
       "22                                             \n",
       "23                                             \n",
       "24  A6428BBE6D1A31313D2108A3A535BBDF26D07618   \n",
       "25                                             \n",
       "26                                             \n",
       "27                                             \n",
       "28                                             \n",
       "29                                             \n",
       "30  FFC3AA7909D4E72C360D65A1F45260DFFE5C99B7   \n",
       "31  790F7247876A5FA44FD439E3EEBE70B5CC237222   \n",
       "32  67AFF3EFE16FFC52B175731EC1051EDC78429A2F   \n",
       "33                                             \n",
       "34  89AB8CA84B00E2EA9A5D35686857A2E1B450E4D6   \n",
       "35  1BA53A89540D9C1BA5212E2D2ABF908257703CA2   \n",
       "36  B71DB14301CBC92F37FE2786256795E0C60C5620   \n",
       "37  02FFA9316EBB23BCFE203540A8580F7B41D47A1A   \n",
       "\n",
       "                                     PESHA-1  \\\n",
       "0                                              \n",
       "1                                              \n",
       "2                                              \n",
       "3                                              \n",
       "4                                              \n",
       "5                                              \n",
       "6                                              \n",
       "7                                              \n",
       "8                                              \n",
       "9   120B449561199ADC5E2AC24F24C547FE388460B3   \n",
       "10                                             \n",
       "11                                             \n",
       "12                                             \n",
       "13                                             \n",
       "14                                             \n",
       "15  95670D42FF28756E7E4BB3AC37D223F4CEBC1570   \n",
       "16  91DF23E9C72921138DAF6A713DE03AC7B97185FA   \n",
       "17  A010A529B48CA42BC39FB18C64EE5DFB8CFA446C   \n",
       "18                                             \n",
       "19                                             \n",
       "20                                             \n",
       "21                                             \n",
       "22                                             \n",
       "23                                             \n",
       "24  120B449561199ADC5E2AC24F24C547FE388460B3   \n",
       "25                                             \n",
       "26                                             \n",
       "27                                             \n",
       "28                                             \n",
       "29                                             \n",
       "30  9BAF4AF7B9DE3B823C442A33621579E036CBD547   \n",
       "31  8DAD6491B71C880C9F08911D75FC264E954A06FE   \n",
       "32  90EB05DE2A167D3FB534EDBA9C20409009EEC3FF   \n",
       "33                                             \n",
       "34  A12195FE851EA7C5A87809069C3D1E3E3464F948   \n",
       "35  1958C675FDF72A748E59A75492C9AAFB2708EB1B   \n",
       "36  B26552526828D0516E4500CD577270A1CFB4B097   \n",
       "37  7A67A67BC12BA8AF1CCBBF1E36C2EDF03AE796B2   \n",
       "\n",
       "                                            PESHA-256  \\\n",
       "0                                                       \n",
       "1                                                       \n",
       "2                                                       \n",
       "3                                                       \n",
       "4                                                       \n",
       "5                                                       \n",
       "6                                                       \n",
       "7                                                       \n",
       "8                                                       \n",
       "9   AF4397E043F98A712B574944008F2B4B4DDF827EB34B5C...   \n",
       "10                                                      \n",
       "11                                                      \n",
       "12                                                      \n",
       "13                                                      \n",
       "14                                                      \n",
       "15  A31184BA45980136C3ED14E8EF10F0631BDB4EC188D970...   \n",
       "16  C95C8AEC825B4D6BB852A843521FEE50D4CB3F778C26A7...   \n",
       "17  5DF203DFAC0136F0367C2DB3AA595B89EF7965997165BE...   \n",
       "18                                                      \n",
       "19                                                      \n",
       "20                                                      \n",
       "21                                                      \n",
       "22                                                      \n",
       "23                                                      \n",
       "24  AF4397E043F98A712B574944008F2B4B4DDF827EB34B5C...   \n",
       "25                                                      \n",
       "26                                                      \n",
       "27                                                      \n",
       "28                                                      \n",
       "29                                                      \n",
       "30  DA7EB4D21BC64F9A568DBC143EF06621405FE05574F912...   \n",
       "31  671E6E175EF1DE9A8888D41CDAF301D8C1555A57348C59...   \n",
       "32  CA6600AD256F7FFC5A8597853FC15E54BFBC2540BFAFF6...   \n",
       "33                                                      \n",
       "34  8A3851432729379E96F2B9F74B68768AE1B65E942336F2...   \n",
       "35  0DC87B78C255543687B5565CFFE49AF8E6FCAF4E1D061A...   \n",
       "36  FCA502CD6BD4F7B5BD9E35564CD687439AF6C1B4D0AAD2...   \n",
       "37  28727856FE0295E4BA02D890CBABD0FF2CBDE72C62674E...   \n",
       "\n",
       "                                              SHA-256  \\\n",
       "0                                                       \n",
       "1                                                       \n",
       "2                                                       \n",
       "3                                                       \n",
       "4                                                       \n",
       "5                                                       \n",
       "6                                                       \n",
       "7                                                       \n",
       "8                                                       \n",
       "9   2772D7403E807FA329DD7200EE31D10582AEFF336A3E0E...   \n",
       "10                                                      \n",
       "11                                                      \n",
       "12                                                      \n",
       "13                                                      \n",
       "14                                                      \n",
       "15  994647A1AD048F6555C67872DED22C37C6FD56DFA2B2A7...   \n",
       "16  83D8CAA52991FB6348D4143B553BC251B9EF4309AC3B4B...   \n",
       "17  FAB7A77CCD3497BCCC34477C5C696E3A25B48E2CE1D58D...   \n",
       "18                                                      \n",
       "19                                                      \n",
       "20                                                      \n",
       "21                                                      \n",
       "22                                                      \n",
       "23                                                      \n",
       "24  2772D7403E807FA329DD7200EE31D10582AEFF336A3E0E...   \n",
       "25                                                      \n",
       "26                                                      \n",
       "27                                                      \n",
       "28                                                      \n",
       "29                                                      \n",
       "30  A9B095ED024118D9D990DAF7B84159D899E856F1E34438...   \n",
       "31  36783A5027FD3140B97EAE048AEDB1D23E7F950A52D730...   \n",
       "32  9D67EFA96796E24CBEACE6190B29B8DD03271326B83D87...   \n",
       "33                                                      \n",
       "34  ED9FB40C3CB5BA0A9AC3ADE80B503F5D7128016C75852E...   \n",
       "35  2B658D0A86220608C9F8FAC30494A0368778FD7DA5E652...   \n",
       "36  E6E93BFC7BD098FA9D38E51DD1AE4106A73ED56251F725...   \n",
       "37  435603112D830DB82A3622F7A3387AE91BA828435A7A8D...   \n",
       "\n",
       "                                 IMP  \n",
       "0                               None  \n",
       "1                                     \n",
       "2                                     \n",
       "3                                     \n",
       "4                                     \n",
       "5                                     \n",
       "6                                     \n",
       "7                                     \n",
       "8                                     \n",
       "9   9CE11C92462D6D0B568AA07F902EC3A2  \n",
       "10                                    \n",
       "11                                    \n",
       "12                                    \n",
       "13                                    \n",
       "14                                    \n",
       "15  7DA8CF61C630B937C173AEE23BE1E34A  \n",
       "16  9576D506DC541E6B8F05D04A51AFC638  \n",
       "17  568EF2B89AA1E99B7D982B24E6636F7A  \n",
       "18                              None  \n",
       "19                                    \n",
       "20                                    \n",
       "21                                    \n",
       "22                                    \n",
       "23                                    \n",
       "24  9CE11C92462D6D0B568AA07F902EC3A2  \n",
       "25                                    \n",
       "26                                    \n",
       "27                                    \n",
       "28                                    \n",
       "29                                    \n",
       "30  7208D0FDDB6F9A603DFF51F34DE2BE82  \n",
       "31  F311DE924313899E3D398C604DAB12C4  \n",
       "32  AAC673A4F025FE7FF8A5C1D0ED0958F4  \n",
       "33                                    \n",
       "34  687331B84F3669D020708C40F729FA33  \n",
       "35  CE60C02CD8577CEB415A85B3A05ECE4B  \n",
       "36  A87C6852F7654939F2A1C31DCD23E017  \n",
       "37  0A690708F6618B762191D92A6E9AB382  "
      ]
     },
     "execution_count": 9,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Test the new function\n",
    "query_es(\"demo-nessus\",\"Category:Services\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [],
   "source": [
    "# In case you don't want a DataFrame, this function returns a standard list\n",
    "# Again, no output for loading the function\n",
    "def query_es_return_list(index, query):\n",
    "    search_context = Search(using=es_connection, index=index, doc_type=query)\n",
    "    s = search_context.query('query_string', query=query)\n",
    "    response = s.execute()\n",
    "    if response.success():\n",
    "        return response['hits']['hits']"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[{'_index': 'demo-nessus-000001', '_type': '_doc', '_id': 'rm2C33YBoul7KFycm_-u', '_score': 2.0925374, '_source': {'Time': '20170501-040423', 'Entry Location': 'HKLM\\\\System\\\\CurrentControlSet\\\\Services', 'Entry': '', 'Enabled': '', 'Category': 'Services', 'Profile': 'System-wide', 'description': '', 'Signer': '', 'Company': '', 'Image Path': '', 'Version': '', 'Launch String': '', 'MD5': '', 'SHA-1': '', 'PESHA-1': '', 'PESHA-256': '', 'SHA-256': '', 'IMP': None}}, {'_index': 'demo-nessus-000001', '_type': '_doc', '_id': 'r22C33YBoul7KFycm_-u', '_score': 2.0925374, '_source': {'Time': '', 'Entry Location': 'HKLM\\\\System\\\\CurrentControlSet\\\\Services', 'Entry': 'DcomLaunch', 'Enabled': 'enabled', 'Category': 'Services', 'Profile': 'System-wide', 'description': 'The DCOMLAUNCH service launches COM and DCOM servers in response to object activation requests. If this service is stopped or disabled, programs using COM or DCOM will not function properly. It is strongly recommended that you have the DCOMLAUNCH service running.', 'Signer': '', 'Company': '', 'Image Path': 'c:\\\\windows\\\\syswow64\\\\rpcss.dll', 'Version': '', 'Launch String': '%SystemRoot%\\\\system32\\\\rpcss.dll', 'MD5': '', 'SHA-1': '', 'PESHA-1': '', 'PESHA-256': '', 'SHA-256': '', 'IMP': ''}}, {'_index': 'demo-nessus-000001', '_type': '_doc', '_id': 'sG2C33YBoul7KFycm_-u', '_score': 2.0925374, '_source': {'Time': '', 'Entry Location': 'HKLM\\\\System\\\\CurrentControlSet\\\\Services', 'Entry': 'DeviceInstall', 'Enabled': 'enabled', 'Category': 'Services', 'Profile': 'System-wide', 'description': 'Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability.', 'Signer': '', 'Company': '', 'Image Path': 'c:\\\\windows\\\\syswow64\\\\umpnpmgr.dll', 'Version': '', 'Launch String': '%SystemRoot%\\\\system32\\\\umpnpmgr.dll', 'MD5': '', 'SHA-1': '', 'PESHA-1': '', 'PESHA-256': '', 'SHA-256': '', 'IMP': ''}}, {'_index': 'demo-nessus-000001', '_type': '_doc', '_id': 'sW2C33YBoul7KFycm_-u', '_score': 2.0925374, '_source': {'Time': '', 'Entry Location': 'HKLM\\\\System\\\\CurrentControlSet\\\\Services', 'Entry': 'dot3svc', 'Enabled': 'enabled', 'Category': 'Services', 'Profile': 'System-wide', 'description': 'The Wired AutoConfig (DOT3SVC) service is responsible for performing IEEE 802.1X authentication on Ethernet interfaces. If your current wired network deployment enforces 802.1X authentication, the DOT3SVC service should be configured to run for establishing Layer 2 connectivity and/or providing access to network resources. Wired networks that do not enforce 802.1X authentication are unaffected by the DOT3SVC service.', 'Signer': '', 'Company': '', 'Image Path': 'c:\\\\windows\\\\syswow64\\\\dot3svc.dll', 'Version': '', 'Launch String': '%SystemRoot%\\\\System32\\\\dot3svc.dll', 'MD5': '', 'SHA-1': '', 'PESHA-1': '', 'PESHA-256': '', 'SHA-256': '', 'IMP': ''}}, {'_index': 'demo-nessus-000001', '_type': '_doc', '_id': 'sm2C33YBoul7KFycm_-u', '_score': 2.0925374, '_source': {'Time': '', 'Entry Location': 'HKLM\\\\System\\\\CurrentControlSet\\\\Services', 'Entry': 'DsRoleSvc', 'Enabled': 'enabled', 'Category': 'Services', 'Profile': 'System-wide', 'description': 'This service hosts the DS Role Server used for DC promotion, demotion, and cloning. If this service is disabled, these operations will fail.', 'Signer': '', 'Company': '', 'Image Path': 'c:\\\\windows\\\\syswow64\\\\dsrolesrv.dll', 'Version': '', 'Launch String': '%SystemRoot%\\\\system32\\\\dsrolesrv.dll', 'MD5': '', 'SHA-1': '', 'PESHA-1': '', 'PESHA-256': '', 'SHA-256': '', 'IMP': ''}}, {'_index': 'demo-nessus-000001', '_type': '_doc', '_id': 's22C33YBoul7KFycm_-u', '_score': 2.0925374, '_source': {'Time': '', 'Entry Location': 'HKLM\\\\System\\\\CurrentControlSet\\\\Services', 'Entry': 'FontCache', 'Enabled': 'enabled', 'Category': 'Services', 'Profile': 'System-wide', 'description': 'Optimizes performance of applications by caching commonly used font data. Applications will start this service if it is not already running. It can be disabled, though doing so will degrade application performance.', 'Signer': '', 'Company': '', 'Image Path': 'c:\\\\windows\\\\syswow64\\\\fntcache.dll', 'Version': '', 'Launch String': '%SystemRoot%\\\\system32\\\\FntCache.dll', 'MD5': '', 'SHA-1': '', 'PESHA-1': '', 'PESHA-256': '', 'SHA-256': '', 'IMP': ''}}, {'_index': 'demo-nessus-000001', '_type': '_doc', '_id': 'tG2C33YBoul7KFycm_-u', '_score': 2.0925374, '_source': {'Time': '', 'Entry Location': 'HKLM\\\\System\\\\CurrentControlSet\\\\Services', 'Entry': 'KtmRm', 'Enabled': 'enabled', 'Category': 'Services', 'Profile': 'System-wide', 'description': 'Coordinates transactions between the Distributed Transaction Coordinator (MSDTC) and the Kernel Transaction Manager (KTM). If it is not needed, it is recommended that this service remain stopped. If it is needed, both MSDTC and KTM will start this service automatically. If this service is disabled, any MSDTC transaction interacting with a Kernel Resource Manager will fail and any services that explicitly depend on it will fail to start.', 'Signer': '', 'Company': '', 'Image Path': 'c:\\\\windows\\\\syswow64\\\\msdtckrm.dll', 'Version': '', 'Launch String': '%systemroot%\\\\system32\\\\msdtckrm.dll', 'MD5': '', 'SHA-1': '', 'PESHA-1': '', 'PESHA-256': '', 'SHA-256': '', 'IMP': ''}}, {'_index': 'demo-nessus-000001', '_type': '_doc', '_id': 'tW2C33YBoul7KFycm_-u', '_score': 2.0925374, '_source': {'Time': '', 'Entry Location': 'HKLM\\\\System\\\\CurrentControlSet\\\\Services', 'Entry': 'MMCSS', 'Enabled': 'enabled', 'Category': 'Services', 'Profile': 'System-wide', 'description': 'Enables relative prioritization of work based on system-wide task priorities. This is intended mainly for multimedia applications.If this service is stopped, individual tasks resort to their default priority.', 'Signer': '', 'Company': '', 'Image Path': 'c:\\\\windows\\\\syswow64\\\\mmcss.dll', 'Version': '', 'Launch String': '%SystemRoot%\\\\system32\\\\mmcss.dll', 'MD5': '', 'SHA-1': '', 'PESHA-1': '', 'PESHA-256': '', 'SHA-256': '', 'IMP': ''}}, {'_index': 'demo-nessus-000001', '_type': '_doc', '_id': 'tm2C33YBoul7KFycm_-u', '_score': 2.0925374, '_source': {'Time': '', 'Entry Location': 'HKLM\\\\System\\\\CurrentControlSet\\\\Services', 'Entry': 'netprofm', 'Enabled': 'enabled', 'Category': 'Services', 'Profile': 'System-wide', 'description': 'Identifies the networks to which the computer has connected, collects and stores properties for these networks, and notifies applications when these properties change.', 'Signer': '', 'Company': '', 'Image Path': 'c:\\\\windows\\\\syswow64\\\\netprofmsvc.dll', 'Version': '', 'Launch String': '%SystemRoot%\\\\System32\\\\netprofmsvc.dll', 'MD5': '', 'SHA-1': '', 'PESHA-1': '', 'PESHA-256': '', 'SHA-256': '', 'IMP': ''}}, {'_index': 'demo-nessus-000001', '_type': '_doc', '_id': 't22C33YBoul7KFycm_-u', '_score': 2.0925374, '_source': {'Time': '20170110-193221', 'Entry Location': 'HKLM\\\\System\\\\CurrentControlSet\\\\Services', 'Entry': 'nxlog', 'Enabled': 'enabled', 'Category': 'Services', 'Profile': 'System-wide', 'description': 'This service is responsible for running the nxlog agent. See www.nxlog.co', 'Signer': '(Verified) NXLog Ltd', 'Company': 'NXLog Ltd', 'Image Path': 'c:\\\\program files (x86)\\\\nxlog\\\\nxlog.exe', 'Version': '3.0.1845.0', 'Launch String': 'C:\\\\Program Files (x86)\\\\nxlog\\\\nxlog.exe\"\" -c \"\"C:\\\\Program Files (x86)\\\\nxlog\\\\conf\\\\nxlog.conf\"\"', 'MD5': 'DFE4561FB63AA2F16A3E60EE1A08E864', 'SHA-1': 'A6428BBE6D1A31313D2108A3A535BBDF26D07618', 'PESHA-1': '120B449561199ADC5E2AC24F24C547FE388460B3', 'PESHA-256': 'AF4397E043F98A712B574944008F2B4B4DDF827EB34B5C314D69E27EF4C655D9', 'SHA-256': '2772D7403E807FA329DD7200EE31D10582AEFF336A3E0E046E20253F44226166', 'IMP': '9CE11C92462D6D0B568AA07F902EC3A2'}}]"
      ]
     },
     "execution_count": 11,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Test the new function - results may be easier for standard Python automation\n",
    "query_es_return_list(\"demo-nessus\",\"Category:Services\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[{'health': 'yellow',\n",
       "  'status': 'open',\n",
       "  'index': 'demo-suricata-000001',\n",
       "  'uuid': '4W-cqiMSTz6EjGM4JHn1kg',\n",
       "  'pri': '1',\n",
       "  'rep': '1',\n",
       "  'docs.count': '10000',\n",
       "  'docs.deleted': '0',\n",
       "  'store.size': '2.3mb',\n",
       "  'pri.store.size': '2.3mb'},\n",
       " {'health': 'green',\n",
       "  'status': 'open',\n",
       "  'index': '.kibana_1',\n",
       "  'uuid': '-3a5GbnES2e0XHc1_iFQCw',\n",
       "  'pri': '1',\n",
       "  'rep': '0',\n",
       "  'docs.count': '2',\n",
       "  'docs.deleted': '0',\n",
       "  'store.size': '14.6kb',\n",
       "  'pri.store.size': '14.6kb'},\n",
       " {'health': 'yellow',\n",
       "  'status': 'open',\n",
       "  'index': 'demo-nessus-000001',\n",
       "  'uuid': 'lr85XylgQ5mK5lv3kvG04Q',\n",
       "  'pri': '1',\n",
       "  'rep': '1',\n",
       "  'docs.count': '286',\n",
       "  'docs.deleted': '0',\n",
       "  'store.size': '266.6kb',\n",
       "  'pri.store.size': '266.6kb'}]"
      ]
     },
     "execution_count": 12,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Get all indices in Elasticsearch Cluster\n",
    "es_connection.cat.indices(format=\"json\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[{'health': 'green',\n",
       "  'status': 'open',\n",
       "  'index': '.kibana_1',\n",
       "  'uuid': '-3a5GbnES2e0XHc1_iFQCw',\n",
       "  'shardsPrimary': '1',\n",
       "  'shardsReplica': '0',\n",
       "  'docsCount': '2',\n",
       "  'docsDeleted': '0',\n",
       "  'storeSize': '15026',\n",
       "  'creation.date.string': '2021-01-07T22:03:02.754Z',\n",
       "  'creation.date': '1610056982754',\n",
       "  'memory.total': '3112',\n",
       "  'pri.store.size': '15026'},\n",
       " {'health': 'yellow',\n",
       "  'status': 'open',\n",
       "  'index': 'demo-nessus-000001',\n",
       "  'uuid': 'lr85XylgQ5mK5lv3kvG04Q',\n",
       "  'shardsPrimary': '1',\n",
       "  'shardsReplica': '1',\n",
       "  'docsCount': '286',\n",
       "  'docsDeleted': '0',\n",
       "  'storeSize': '273090',\n",
       "  'creation.date.string': '2021-01-08T01:00:47.036Z',\n",
       "  'creation.date': '1610067647036',\n",
       "  'memory.total': '10068',\n",
       "  'pri.store.size': '273090'},\n",
       " {'health': 'yellow',\n",
       "  'status': 'open',\n",
       "  'index': 'demo-suricata-000001',\n",
       "  'uuid': '4W-cqiMSTz6EjGM4JHn1kg',\n",
       "  'shardsPrimary': '1',\n",
       "  'shardsReplica': '1',\n",
       "  'docsCount': '10000',\n",
       "  'docsDeleted': '0',\n",
       "  'storeSize': '2492877',\n",
       "  'creation.date.string': '2021-01-08T01:00:50.463Z',\n",
       "  'creation.date': '1610067650463',\n",
       "  'memory.total': '83824',\n",
       "  'pri.store.size': '2492877'}]"
      ]
     },
     "execution_count": 13,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Get all indices in Elasticsearch Cluster but with specific fields and format bytes to raw number\n",
    "# Also set full field names instead of short and sort by creation.date\n",
    "es_connection.cat.indices(format=\"json\", h=(\"health\",\"status\",\"index\",\"uuid\",\"shardsPrimary\",\"shardsReplica\",\"docsCount\",\"docsDeleted\",\"storeSize\",\"creation.date.string\",\"creation.date\",\"memory.total\", \"pri.store.size\"), s=\"creation.date\", bytes=\"b\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'2021-01-08T01:00:50.463000'"
      ]
     },
     "execution_count": 14,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Find out what the newest document creation date is of a given index\n",
    "date = es.get_newest_document_date_in_index(\"\", \"demo-suricata\", es_connection)\n",
    "date.isoformat()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{'_shards': {'total': 2, 'successful': 1, 'failed': 0}}"
      ]
     },
     "execution_count": 15,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Forcemerge an index - Will timeout on normal-to-large indices\n",
    "# When this times out it continues to run in the background\n",
    "es_connection.indices.forcemerge(index='demo-suricata', max_num_segments=1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{'cluster_name': 'demo',\n",
       " 'status': 'yellow',\n",
       " 'timed_out': False,\n",
       " 'number_of_nodes': 1,\n",
       " 'number_of_data_nodes': 1,\n",
       " 'active_primary_shards': 3,\n",
       " 'active_shards': 3,\n",
       " 'relocating_shards': 0,\n",
       " 'initializing_shards': 0,\n",
       " 'unassigned_shards': 2,\n",
       " 'delayed_unassigned_shards': 0,\n",
       " 'number_of_pending_tasks': 0,\n",
       " 'number_of_in_flight_fetch': 0,\n",
       " 'task_max_waiting_in_queue_millis': 0,\n",
       " 'active_shards_percent_as_number': 60.0}"
      ]
     },
     "execution_count": 8,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Check cluster health\n",
    "es_connection.cluster.health()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{'settings': {'client_json_folder': '/opt/elastic-ilm', 'debug': False, 'limit_to_client': '', 'password_authentication': False, 'ssl_enabled': False, 'ssl_certificate': 'disabled', 'check_hostname': False}, 'notification': {'smtp': 'disabled', 'ms-teams': 'disabled', 'jira': 'disabled'}, 'smtp': {'from_email': 'from@domain.com', 'username': 'user@domain.com', 'password': '', 'smtp_host': 'smtp.office365.com', 'smtp_port': 587}, 'ms-teams': {'webhook': ''}, 'retention': {'enabled': True, 'minutes_between_run': 60, 'health_check_level': 'yellow', 'ms-teams': True, 'jira': False}, 'rollover': {'enabled': True, 'minutes_between_run': 10, 'health_check_level': 'yellow', 'ms-teams': True, 'jira': False}, 'accounting': {'enabled': False, 'minutes_between_run': 240, 'output_folder': '', 'output_to_es': True, 'send_copy_to_client_name': '', 'health_check_level': 'green', 'retry_attempts': 10, 'retry_wait_in_seconds': 1200, 'fallback_health_check_level': 'yellow', 'ssd_cost': 0.03, 'sata_cost': 0.001, 'ms-teams': False, 'jira': False}}\n"
     ]
    }
   ],
   "source": [
    "# Load sample settings.toml and override a few settings for demo use\n",
    "settings = toml.load(\"settings.toml.example\")\n",
    "settings['settings']['client_json_folder'] = os.getcwd()\n",
    "settings['retention']['enabled'] = True\n",
    "settings['rollover']['enabled'] = True\n",
    "print(settings)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{'client_name': 'demo', 'ca_file': '/home/jhenderson/elastic/ca.crt', 'es_host': 'localhost', 'es_port': 9200, 'ssl_enabled': False, 'ssl_certificate': 'required', 'check_hostname': False, 'password_authentication': False, 'es_user': 'elastic', 'es_password': 'password', 'policy': {'allocation': {'global': 30, '.monitoring': 7}, 'rollover': {'global': {'size': 'auto', 'days': 30}, 'demo-nessus': {'size': 0, 'days': 30}}, 'retention': {'global': 90, '.monitoring': 7, 'demo-suricata': 0, 'demo': 45}}}\n"
     ]
    }
   ],
   "source": [
    "# Load sample client.json.example and override a few settings for demo use\n",
    "with open('client.json.example') as f:\n",
    "    client_config = json.load(f)\n",
    "client_config['es_host'] = \"localhost\"\n",
    "client_config['policy']['retention']['demo'] = 45\n",
    "print(client_config)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "demo\n"
     ]
    }
   ],
   "source": [
    "# Let's validate the retention policy is applying correcly against an index starting with demo\n",
    "retention_policies = es.get_retention_policy(client_config)\n",
    "index_policy = es.check_index_retention_policy(\"demo-nessus-000001\", retention_policies)\n",
    "# This should print demo if it grabbed the retention policy starting with demo\n",
    "print(index_policy)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "demo-suricata\n"
     ]
    }
   ],
   "source": [
    "# Let's simulate having a policy apply for demo* but a more specific one winning for demo-suricata\n",
    "client_config['policy']['retention']['demo-suricata'] = 40\n",
    "index_policy = es.check_index_retention_policy(\"demo-suricata-000001\", retention_policies)\n",
    "# This should print demo-suricata if it grabbed the retention policy starting with demo-suricata\n",
    "print(index_policy)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "global\n"
     ]
    }
   ],
   "source": [
    "# Same concept applies for rollover policies\n",
    "rollover_policies = rollover.get_rollover_policy(client_config)\n",
    "index_policy = es.check_index_rollover_policy(\"demo-suricata-000001\", rollover_policies)\n",
    "# This should print global because no rollover policy was created for demo\n",
    "print(index_policy)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "demo\n"
     ]
    }
   ],
   "source": [
    "# Set rollover policy for demo and then test again\n",
    "client_config['policy']['rollover']['demo'] = {}\n",
    "client_config['policy']['rollover']['demo']['size'] = \"auto\"\n",
    "client_config['policy']['rollover']['demo']['days'] = 30\n",
    "index_policy = es.check_index_rollover_policy(\"demo-suricata-000001\", rollover_policies)\n",
    "# This should print demo because there now is a policy applying against indices starting with demo\n",
    "print(index_policy)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{'acknowledged': True}"
      ]
     },
     "execution_count": 24,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Policy is used to validate if something should be deleted, rolled over, etc.\n",
    "# Let's test a force rollover\n",
    "es.rollover_index_with_connection(client_config, \"demo-suricata-000001\", 'demo-suricata', es_connection)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[{'index': 'demo-suricata-000001', 'is_write_index': 'false'},\n",
       " {'index': 'demo-suricata-000002', 'is_write_index': 'true'}]"
      ]
     },
     "execution_count": 25,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Check to see if demo-nessus index was rolled over - if it did it should now be demo-suricata-000002\n",
    "es_connection.cat.aliases('demo-suricata', format=\"json\", h=(\"index\",\"is_write_index\"))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Processing rollovers for demo\n",
      "Client demo has a healthy cluster (yellow)\n",
      "Adding index demo-nessus-000003 to rollover due to Size Policy\n",
      "Rollover successful for demo-nessus-000003\n",
      "'Elasticsearch' object has no attribute 'get_index_operation_message'\n"
     ]
    }
   ],
   "source": [
    "# THIS SECTION ONLY WORKS IF YOU COPY settings.toml.example TO settings.toml\n",
    "# AND client.json.example to client.json and make them able to connect to your demo cluster\n",
    "# Should output processing rollovers and retention but show no actions taken\n",
    "# This is because the demo data imports with today's date and the policies are > 1 day\n",
    "# \n",
    "# The default client.json sets the rollver policy for nessus to 0 GB. Thus it will rollvoer\n",
    "# everytime you run apply_rollover_policies\n",
    "# You can change the value and retest as you see fit\n",
    "rollover.apply_rollover_policies(\"\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 30,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Processing retention for demo\n",
      "Client demo has a healthy cluster (yellow)\n"
     ]
    }
   ],
   "source": [
    "# THIS SECTION ONLY WORKS IF YOU COPY settings.toml.example TO settings.toml\n",
    "# AND client.json.example to client.json and make them able to connect to your demo cluster\n",
    "# Should output processing rollovers and retention but show no actions taken\n",
    "# This is because the demo data imports with today's date and the policies are > 1 day\n",
    "# \n",
    "# The default client.json sets the retention policy for demo-suricata to 0 days. Thus it will delete\n",
    "# all demo-suricata indices anytime you run apply_retention_policies\n",
    "# You can change the value and retest as you see fit\n",
    "retention.apply_retention_policies(\"yellow\", \"\")"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.5"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}