Closure for holding path of config file.

Read files in data paths.

Get the database name from query source metadata.

Return the package default config file.

Return attribute at dotted path.

Generate iterable of Mordor queries.

Retrieve Prisma Cloud settings from MSTICPY configuration. Parameters ---------- config_name : str The n

Try to retrieve config settings for Cybereason drivers. Returns ------- dict[str, str]

Return the entity and pivot function as objects.

Return entity attribute or obj if not an entity.

Return list of extras from setup.py. Parameters ---------- extra : str, optiona The name of the extra to return, by default

Return function from class instance - created or found in namespace.

Return placeholder record for non-public IP Types.

Return a layout for the graph.

Get a color from folium.color options.

Extract input value from args or kwargs.

Return the installed version of MSTICPY.

Extract the part of the query containing the observable.

Get functions for IP IoC Types.

Extract contained files from an archive type.

Return list of JOIN sub-expressions.

Return a dictionary of Kusto cluster settings from msticpyconfig.yaml.

Return the vault and secret name for a config path.

Read files in data paths.

Read files in data paths.

Obtain logging configuration from environment or config.

Fetch a file from Mordor repo.

Closure to wrap fetching Mordor tree from GitHub.

Get functions for non-IP IoC types.

Get params from attributes of arg objects. Parameters ---------- args : Tuple[Any] Args list from calling function param

Get config from msticpyconfig.

Return a mapping between parent and child column names.

Return the function accessor `df_func` for the DataFrame `df`.

Return Pulsedive api key from configuration.

Get the list of all modules from file paths.

Return matching parent class for plugin_class.

Return popup text for marker.

Get the database name from query source.

Return query folder for current environment.

Return any kwargs not already in params.

Return any kwargs not already in params.

Format query sample.

Return the workspace schema.

Return a func to access a secret.

Return dictionary of displayable options.

Extract the provider args from the settings.

Download and load abuse.ch SSL Abuse List.

Extract subscription Id from resource string.

Return summary item records for dynamic summary.

Return active dynamic summary header record.

Get config from msticpyconfig.

Extract simple table names from the data_cache entries.

Get an analytic template ID. Parameters ---------- template : str Template ID or Name res_id : s

Get the tenant ID from login domain.

Return tool tip formatter.

Return tooltip text for marker.

Closure for holding trace setting.

Return unique set of processes.

Closure for holding utf16 decoding setting.

Recursive get values from control dictionary.

Validate and return vault name and URI.

Closure for holding trace setting.

Read VM metadata from definition file.

Retrieve the VT key from settings.

Retrieve the VT enterprise key from settings.

Return the VirusTotal API URL for the supplied type. :param api_type: The IoC type

Retrieve Synapse Managed Identity details from token.

Import packages from default set (defined statically).