Usage

PyVAST wraps VAST commands in Python methods. Instead of specifying the whole commandline at once, you can simply chain all (sub-)commands via .-notation. You can pass arguments as via Python's *args and parameters as Python keyword arguments (**kwargs). When you are done chaining methods, finalize the command invocation with a call to .exec(). See the following examples for an overview of vast commands and the analogous PyVAST method calls.

Query for an IP address and return 10 results in JSON

# CLI call
vast export --max-event=10 json '192.168.1.104'
# Python wrapper
proc = await vast.export(max_events=10).json("192.167.1.102").exec()
stdout, stderr = await proc.communicate()
print(stdout)

Import a Zeek log file

# CLI call
vast import --read=/path/to/file zeek
# Python wrapper
proc = await vast.import_().zeek(read="/path/to/file").exec()
stdout, stderr = await proc.communicate()
print(stdout)

As you can see, we use vast.import_ instead of vast.import. That is because import is a reserved keyword in python.

Module Parameterization

You can use PyVAST as Python module. After installing it via pip, simply import it normally in your Python application.

from pyvast import VAST

Once imported, there are three optional keyword arguments to instruct PyVAST with: binary, endpoint, and logger. The binary keyword defaults to "vast". In case the vast binary is not in your $PATH, set this to the actual path to the VAST binary. The endpoint keyword refers to the endpoint of the VAST node (e.g., localhost:42000). Lastly, use the logger keyword to provide a custom logging.logger object for your application.

See also the full example below.

Full Example

The following example shows a minimalistic working example with all required import statements.

#!/usr/bin/env python3
import asyncio
from pyvast import VAST
async def example():
# Use the vast binary that is installed to /opt/tenzir/bin
vast = VAST(binary="/opt/tenzir/bin/vast")
await vast.test_connection()
proc = await vast.export(max_events=10).json("192.168.1.103").exec()
stdout, stderr = await proc.communicate()
print(stdout)
asyncio.run(example())

See also the example folder in the VAST GitHub repository. In there you can find one example using Apache Arrow (pyarrow) for data export and another example for VAST's continuous query feature.