PyVAST wraps VAST commands in Python methods. Instead of specifying the whole
commandline at once, you can simply chain all (sub-)commands via
You can pass arguments as via Python's
*args and parameters as Python keyword
**kwargs). When you are done chaining methods, finalize the command
invocation with a call to
.exec(). See the following
examples for an overview of
vast commands and the analogous PyVAST method
Query for an IP address and return 10 results in JSON
Import a Zeek log file
As you can see, we use
vast.import_ instead of
vast.import. That is because
import is a reserved keyword in python.
You can use PyVAST as Python module. After
installing it via
pip, simply import it
normally in your Python application.
Once imported, there are three optional keyword arguments to instruct PyVAST
binary keyword defaults to
"vast". In case the
vast binary is not in your
$PATH, set this to the
actual path to the VAST binary. The
endpoint keyword refers to the endpoint of
the VAST node (e.g.,
localhost:42000). Lastly, use the
logger keyword to
provide a custom
object for your application.
See also the full example below.
The following example shows a minimalistic working example with all required import statements.