OIF Kestrel (Init).ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 8,
   "id": "e49cf11d",
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": []
    },
    {
     "data": {
      "text/html": [
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th>name</th>\n",
       "      <th>pid</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <td>firefox.exe</td>\n",
       "      <td>201</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>chrome.exe</td>\n",
       "      <td>205</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>firefox.exe</td>\n",
       "      <td>1583149</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>chrome.exe</td>\n",
       "      <td>1575820</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<div><h4>Block Executed in 1 seconds</h4><table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th>VARIABLE</th>\n",
       "      <th>TYPE</th>\n",
       "      <th>#(ENTITIES)</th>\n",
       "      <th>#(RECORDS)</th>\n",
       "      <th>process*</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <td>proclist</td>\n",
       "      <td>process</td>\n",
       "      <td>4</td>\n",
       "      <td>4</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>browsers</td>\n",
       "      <td>process</td>\n",
       "      <td>12</td>\n",
       "      <td>12</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table><p>*Number of related records cached.</p></div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "# create four process entities in Kestrel and store them in the variable `proclist`\n",
    "proclist = NEW process [ {\"name\": \"cmd.exe\", \"pid\": \"123\"}\n",
    "                       , {\"name\": \"explorer.exe\", \"pid\": \"99\"}\n",
    "                       , {\"name\": \"firefox.exe\", \"pid\": \"1583149\"}\n",
    "                       , {\"name\": \"chrome.exe\", \"pid\": \"1575820\"}\n",
    "                       ]\n",
    "\n",
    "# match a pattern of browser processes, and put the matched entities in variable `browsers`\n",
    "browsers = GET process FROM proclist WHERE [process:name IN ('firefox.exe', 'chrome.exe')]\n",
    "\n",
    "# display the information (attributes name, pid) of the entities in variable `browsers`\n",
    "DISP browsers ATTR name, pid"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "id": "ec01c764",
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": []
    },
    {
     "data": {
      "text/html": [
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th>name</th>\n",
       "      <th>pid</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <td>firefox.exe</td>\n",
       "      <td>201</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<div><h4>Block Executed in 1 seconds</h4><table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th>VARIABLE</th>\n",
       "      <th>TYPE</th>\n",
       "      <th>#(ENTITIES)</th>\n",
       "      <th>#(RECORDS)</th>\n",
       "      <th>process*</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <td>firefox</td>\n",
       "      <td>process</td>\n",
       "      <td>5</td>\n",
       "      <td>5</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table><p>*Number of related records cached.</p></div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "firefox = GET process FROM browsers WHERE [process:pid = '201']\n",
    "DISP firefox ATTR name, pid"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "e5ff889d",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Kestrel",
   "language": "kestrel",
   "name": "kestrel"
  },
  "language_info": {
   "file_extension": ".hf",
   "name": "kestrel"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}