[elhoim]

BLUF

• Priority: medium
• Problem: The EVTX gap analyzer raises AttributeError whenever it finds gaps. win_evtxgap.py:258 calls DataFrame.append, which pandas 2.0 removed, and requirements.txt pins pandas>=3.0.3.
• Fix: A one-line change from event_count.append(df_append, sort=False) to pd.concat([event_count, df_append], sort=False).
• Test: TestEvtxGapPlugin.test_run_with_missing_days, a new end-to-end test of run().
• Verified: The new test fails on master with the AttributeError and passes with the fix (module result: 2 passed, 2 skipped). black --check and pylint --rcfile=.pylintrc (Python 3.14, as in the CI matrix) are clean on both changed files.

• What existing problem does this PR solve? The EVTX gap analyzer raises AttributeError whenever it finds gaps. win_evtxgap.py:258 calls DataFrame.append, which pandas 2.0 removed, and requirements.txt pins pandas>=3.0.3.
• What new feature is being introduced with this PR? None, this is a bug fix.
• Overview of changes to existing functions if required. A one-line change from event_count.append(df_append, sort=False) to pd.concat([event_count, df_append], sort=False).

Details

What was wrong

EvtxGapPlugin.run() builds a story when it finds both missing days and record-number gaps. It then pads the per-day counts with the missing days using DataFrame.append. On pandas 3.x that line raises:

AttributeError: 'DataFrame' object has no attribute 'append'

By that point the story text and the "Top EVTX Sources" aggregation are already saved. The run leaves a half-built story and a failed analysis. The "Event Records Per Day" chart and the record-number gap section, which is the evidence of log clearing, are never written.

This line runs only when both missing_ranges and record_gaps are non-empty, because of the early return before it. That condition holds for every run that produces a gap story, so all of those runs crashed.

Reproducing input

Security records #1 and #2 on 2020-01-01, and record #5 on 2020-01-03. The analyzer raises AttributeError instead of finishing the story.

Fix

pd.concat behaves the same way here. The sort_values("day") that follows restores the row order, and the extra timestamp column is still removed afterwards.

Regression test

The test mocks event_pandas and the sketch. The sketch mock needs id=1, because the story text formats self.sketch.id with {:d}. The test checks that run() reports gaps and that the manual_feed aggregation contains {"20200101": 2, "20200102": 0, "20200103": 1}.

Checks

• All tests succeed.
• Unit tests added.
• e2e tests added.
• Documentation updated.

Closing issues

No issue is linked to this PR yet.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.