Windows command support

[caesarshift]

Hey! I and a couple of coworkers are looking at adding support to common Windows commands to jc. Before we throw up a PR, we wanted to get your feedback/preference on how to organize a couple of things:

• Some windows command change their output based on the exact command used. An example is wmic startup list brief (which comes back as a table with columns) vs wmic startup list full (which comes back as a set of k/v records separated by new lines). Would you prefer both of these to be handled in the same wmic parser, or separate parsers (wmic-brief and wmic-full, for example)?
• For functions that we may reuse across parsers, where do you want those functions placed? utils.py? parserutils.py? Somewhere else?
• Any other feedback that you may have. We expect to have a PR for your review this week.

[kellyjonbrazil]

Hi there!

That would be great! I don't have much Windows experience, myself, so this would be a great addition. Regarding your questions:

I typically try to do one parser per command, if possible. I break that rule if the command has completely different contextual information or schema sometimes. (e.g. various systemctl commands) I ended up splitting the netstat parser into multiple files to support linux/mac, even though it is the same parser to the end-user, so that approach might work for you, too.

I have been putting the re-used functions in utils.py, so feel free to do the same.

I'm looking forward to reviewing the PR. Depending on the output, you might be able to reuse one of the functions in parsers/universal.py. simple_table_parse is good for nicely formatted tables, while the sparse_table_parse is a crazy parser for tables that are somewhat nicely formatted, but contains blank values.

Oh, yeah, and obviously make sure to correctly fill out the info class so you are credited and also so we know who to go to if the parser is broken. :)

The way I usually start writing a parser is to copy the parsers/foo.py file and just find/replace foo to the parser name. Also, testing is super important, so go ahead an create a windows-[version] directory with sample output files with an .out extension and then create the corresponding JSON files with a .json extension.

Thanks again!

[kellyjonbrazil]

One more thing - it would probably be best to pull and merge from the dev branch, if possible. No big deal if you are already working from the master branch, though.