Before we get into the heavy stuff,
let's take a look at some of the built‑in functions
that are either directly available or, at most,
need to be simply imported without the pip install first.
The following clips can be found in most Python training and
are some of the more common functions you will likely see in
your cybersecurity scripts.
Especially in an analyst role,
you'll be dealing with the input that comes from a ton of various sources,
on top of the fact that you need to be mindful of the input and output
requirements from the functions we will be discussing.
Let's talk a little bit about the most common data types first.
There are three defined types of numbers, integers, float, and complex numbers.
Complex is used in arithmetic, graphics,
and other deep math functions,
and that's something we'll really get into in this course.
Float, also referred to as doubles,
are numbers containing a decimal while integers are whole numbers.
Boolean types are one of two values, true or false,
sometimes represented as 1 and 0 when characterized as a number.
Primarily considered in if statements,
loops and other conditional expressions that
determine the path of the algorithm.
Finally, strings, which is made up of data characters.
They're assigned to variables through matching delimiters.
Strings will be the most common data type you will work with,
so let's dive a little deeper into this group and
understand everything you can do with a string.
I want to focus on four key areas you will likely need some background
and education on to get the most out of your scripts.
First, understand the index of the string,
how to slice it, how to combine or concatenate it,
and finally, formatting,
which is all about controlling the output when printing a
string that will contain bits that may change.
So looking closer at indexing.
Like everything else in Python, strings are an object variable that contain data,
or more specifically character data.
This means strings are made up of the individual characters,
and hence can be indexed starting with 0 as the first character.
In this example, the STR variable is assigned the string Python,
all uppercase, with a whitespace at the front and another whitespace at the end.
I just want to point out I'm only using a single word string in this variable,
but it's very realistic to have full sentences and beyond
assigned to a string variable with each character of that
sentence being assigned a place in the index.
Let's play with this a little.
This image represented in code would look like this: STR = " PYTHON "
with double quotes and whitespace surrounding it.
Printing out individual characters of the string,
I can see the character at the 0 index, or very first character in the string,
is the first whitespace followed by the capital letter P at the 1 index.
Similar to how the index starts at 0 for the first character of the string,
the last character of the string can be represented by the ‑1 index.
In this example, ‑2 is the character and in the string.
But, that whitespace is ugly, so let's clean it up a little bit.
It is not a simple reassignment of the 0 and 7 index
in the string as it is immutable,
meaning that individual bits cannot be replaced.
But what I can do with a method called slicing is select the
parts I want of the string and either assign it to a new string
or reassign it back to the original,
replacing both the actual string itself and also its place
in memory with a new string cut down.
Again, STR = " PYTHON " with the spaces around it.
But now using the list bracket to call out what index I want,
I can input a range that will give me all the characters in the range and
assign it back to the STR variable as I'm doing here,
and as you can see then prints out PYTHON without any spaces.
The central colon sets up a range,
and if you want to start at the very beginning or capture until the very end,
leave that end of the range blank and Python will start capturing
characters all the way to the end on either side.
Slicing comes in handy when you have a formatted log that
has a very specific formatting to it.
As you read in each line of the log, the text for that line becomes a new string.
I can then slice out specific parts like data and time,
server,
account name or any other information If I know where in
the string that information may live.
Another useful string function that is important while
searching log files is the operators in and not in.
This allows you to determine if a set of characters is found
anywhere inside another string or not.
When parsing a log file,
the in operator allows me to pull out all the lines that
the user unsuccessfully logged in.
Or, if I'm looking for a specific activity from a particular user,
I can pull out every line that the user was found in.
Maybe I want to pull out all the pages that threw an error,
but I don't want to focus on any one error.
I can use the not in operator and ignore all the lines with
the 200 status that successfully loaded,
giving me the logs for the errors encountered.
The plus sign operator is not just for math and allows you to
combine two strings together into a single new string.
This can be useful when you are wanting to construct an email address.
If you know that the format is the first name plus the
last name plus the asperand and domain,
you can basically extract information out of a CSV file and create
a new column in the database for email with it.
The star operator allows you to display a string however many times
that number on the other side of the operator is.
I have used this to display an ASCII bar graph in the past,
giving you a visual representation of how many times
the status shows up in the log.
Displaying a string can be as simple as a print of Hello
World in or two parts as shown here.
Python also has available a percent sign operator,
which allows you to display values in a string of a specific type,
but requires you to know and select the right format symbol.
In this case,
%s is a string and will cast string on whatever is in the format parentheses.
In the next example of formatting string output,
the Format method can be invoked along with the curly brackets and
act in the same manner as the format symbols,
except this time they are simply a placeholder and you don't have to
worry about selecting the proper format symbol.
In the first example, we drop two placeholders,
and in the format parentheses, two strings to drop into those placeholders.
The brackets can be considered objects and allow you to order your output.
In the second example,
I am placing a 1 in the first bracket signifying the
second format element and a 0 in the second bracket
signifying the first format element.
This is good when you want the output to contain the element
in multiple areas of the output string.
On top of all the functions, methods,
and other elements of strings that we have talked about,
there are a few additional functions I think will be beneficial for you,
or at least for you to be aware of and research on your own to understand
how you may want to incorporate them into your code.
Index works similar to the operator we just discussed,
but instead of returning to Boolean,
it returns the value of the index where it was found in the string,
and where index returns the first value of the placeholder
for the first instance in the string,
the Rindex returns the place in the line for the last instance in the string.
The Join method, similar to the plus operator, joins all the values entered
into the parentheses as a single string separated by a string calling the
function. When looped while pulling information from a database, if the string
calling the function is simply a comma, this is a quick and dirty way of
creating a CSV file. Strip, Lstrip, and Rstrip remove the whitespace from the
two ends of the string. Strip applies to both ends, Lstrip works from the left
or the front of the string, and Rstrip works from the right or the end of the
string.
The Split function separates out your string into a list. Unless specified,
it will split the string at various spaces in the text.
If you're using the function on a CSV file, for example,
you'll want to split with a comma set as the optional separator.
Finally, Count returns how many times the supplied value is found in the string.
As we get into the demos and start playing with the packages and libraries
we will be talking through in the next module, these set, mapping, and
sequence data types will be discussed more and more.
We've already touched on lists a couple times while discussing strings.
The biggest difference between the four types is that tuples are immutable,
meaning the individual items that make up the tuple cannot be
changed, added to or removed from once it's created.
If you want to change the values,
you basically have to recreate the entire tuple. This means
temples are collections that are ordered and unchangeable.
Now lists, sets, and dictionaries,
although similar to tuples in that they hold many values in
an array of sorts are in fact mutable,
meaning the values in the container may change individually.
Think of it as a class in other object‑oriented programming languages. Lists and
sets are used to store multiple items in a single variable,
but sets are not stored in any specific order and are not indexed,
so you cannot change a specific item directly. When loaded, they will pop from
the container in random order. Dictionaries allow you to store multiple items
like the rest, but the values are stored tied to a key. Instead of calling the
index number to retrieve a specific value,
you call the paired key item.