Return the path of the current config file, if any. Returns ------- Optional[str] path of the current config file

Create a networkx graph from a DataFrame. Parameters ---------- data : pd.DataFrame Input data source_col : str C

Return the process event as a Series. Parameters ---------- procs : pd.DataFrame Process events (with process tree metadata)

Import a yaml data source definition. Parameters ---------- query_file : str Path to the file to import

Class factory to return entity from raw dictionary representation. Parameters ---------- raw_entity : Mapping[str, A

Return the importing module and a callable for lazy importing. Parameters ---------- importer_name: str The module performin

Load a YAML file into a QueryCollection. Parameters ---------- yaml_file : Union[str, Path] The path to the YAML file to loa

Lookup Threat Intelligence reports for a collection of IoCs in active providers. Parameters ---------- data : Union[

Execute OpenObserve query and retrieve results. Parameters ---------- query : str OpenObserve query to e

Execute the query via the /search endpoint and return a DataFrame + result status. Parameters ---------- query : str

Re-read the config settings.

Safely extract a single tar archive member after path validation. Validates that the member path does not escape dest_dir and rejects sy

Save currently edited parameter.

Return IDs for items matching terms. Parameters ---------- mdr_data : Dict[str, MordorEntry] Mordor dataset terms : str,

Return a dictionary with layout and style for a select widget. Parameters ---------- width : str, optional The width of the

Upload a file to the data store. Parameters ---------- file_path : str Path to the file to upload

Return a list of time ranges split by `split_delta`.

Check required client is present, if not create it. Parameters ---------- client_name : str The name of

Ensure datetime is timezone-aware, defaulting to UTC if naive.

Format datetime for display, ensuring UTC timezone.

Get an incident ID. Parameters ---------- incident : str An incident identifier Returns

Get the control with matching name.

Generate module name variants from a file path.

Get provider options to populate select list.

Layout creation for widgets.

Translate query or subquery.

Read a yaml config definition file. Parameters ---------- config_file : str Path to yaml config file Returns ------

Add a link between 2 nodes on the graph. Parameters ---------- source : str Name of node to link from

Add a new parameter.

Add an expression to the query attach filter.

Add list of DynamicSummaryItems replacing existing list. Parameters ---------- data : Union[Iterable[DynamicSummaryI

Build process tree from data and plot a tree. Parameters ---------- data : pd.DataFrame Window process creation or Linux Aud

Find the rarest window and corresponding likelihood for each session. In particular, uses a sliding window approach to find the rare

Connect to data source. Parameters ---------- connection_str : str Connect to a data source

Connect to Sumologic via sumologic-sdk. Parameters ---------- connection_str : Sumologic API url endpoin

Display a timeline of events. Parameters ---------- data : Union[dict, pd.DataFrame] Either dict of data sets to plo

Run a notebook. Parameters ---------- nb_path : str | Path Path to the notebook to run out_dir : str | Path | None, opti

Execute simple query string. Parameters ---------- query : str [description] Returns --

Filter output columns matching names in `cols` expression(s). Parameters ---------- cols : Union[str, Iterable[str]]

Return value or KeyError from driver properties.

Validate value is an IP address and determine IPType category. (IPAddress category is e.g. Private/Public/Multicast). Parameters --

Return true if `uuid_str` is a value GUID/UUID. Parameters ---------- uuid_str : str String to test Returns -------

Preprocess and check validity of observable against declared IoC type. Parameters ---------- observable : _type_ the value o

Test method.

Return the secret value. Parameters ---------- secret_object : Any If it is a func, call and return the

Create dictionary mapping query file paths with the yaml file text each contains. Parameters ---------- parent_dir : str Dir

Set a dict of providers to primary/secondary. Parameters ---------- prov_dict : dict[str, bool] Dictiona

Upload a Pandas DataFrame to the data store. Parameters ---------- data : pd.DataFrame The DataFrame to

Add an Entity to the graph.

Check if an iteam is present in a config.

Check environment against known names.

Create an in-memory tar.gz archive.

Extract package specifications from requirements strings. Parameters ---------- pkg_specs : list[str] List of requirement sp

Return the latest avaliable API version for the resource. Parameters ---------- resource_id: str, optional

Return the current event loop, or create a new one.

Get items from the API.

Handle general connection errors.

Wait for an async call, making it sync.

Verify individual column.

Connect to data source. Parameters ---------- connection_str : str | WorkspaceConfig | None Connection s

Connect to oauth data source. Parameters ---------- connection_str: Optional[str], optional Connect to a

Get the default (all) authentication options.

Return default before and after bounds for a TimeUnit.

Format an endpoint with "/" if needed .

Return the type and options (or a default) for the setting definition. Parameters ---------- defn : Optional[Tuple[str, dict]]

Return list of data file links. Returns ------- List[Dict[str, str]] list of dictionaries describing fil

Return the full VT object as a DataFrame. Parameters ---------- vt_id : str The ID of the object

Return (and create if it doesn't exist) a settings section. Parameters ---------- mp_controls : MpConfigControls The MP Conf

Return resource ID components from Sentinel portal URL.

Retrieve a secret from the Vault. Parameters ---------- secret_name : str Name of the secret Re

Return the first linked service of specific `svc_type`. Parameters ---------- svc_type : str Service Typ

Return linked storage service (named) or default storage.

Return tick formatting for different zoom levels.

Return resolved workspace settings from workspace ID or resource ID. Parameters ---------- workspace_id : Optional[s

Hash a simple string. Parameters ---------- input_str : str The input string Returns ------- str The ob

Print a list of builtin providers with optional usage. Parameters ---------- show_query_types : bool, optional

Add a shortcut to a pivot function to the class. Parameters ---------- func_name : str The name of sourc

Parse string or numeric value to ResultSeverity. Parameters ---------- value : Any ResultSeverity, str o

Return the TimeUnit enum matching the input string.

Plot a graph of entities. Parameters ---------- hide : bool, optional Set true to not display the graphi

Add a reference marker line and label at `ref_time`.

Execute query string and return DataFrame of results. Parameters ---------- query : str The query to exe

Execute query string and return DataFrame of results. Parameters ---------- query : str The query to exe

Load or reload Pivot functions from environment and/or providers list. Parameters ---------- namespace : Dict[str, A