Mock action method.

Add a custom function to the provider. Parameters ---------- name : str The name of the query. q

Add data queries from `provider` to entities. Parameters ---------- provider : QueryProvider Query provider get_timespan

Add an entity to the graph. Parameters ---------- ent : Entity The entity object to add the graph

Add FeatureGroupSubGroups and to the map. Parameters ---------- subgroups: Iterable[FeatureGroupSubGroup]

Add decoded geohashes to the map. Parameters ---------- geohashes : Iterable[str] Iterable of geolocatio

Add TI functions to entities. Parameters ---------- ti_lookup : TILookup TILookup instance. container : str The

Add a collection of GeoLocation objects to the map. Parameters ---------- ip_addresses : Iterable[str] I

Add a collection of lat/long tuples to the map. Parameters ---------- locations : Iterable[tuple[float, float]]

Create markers from locations and add to MarkerCluster. Parameters ---------- locations: Iterable[tuple[float, float

Add mock mount entry.

Add a node to the graph representing a note or comment. Parameters ---------- name : str The name of the

Add VT3 relationship functions as pivot functions. Parameters ---------- api_scope : Optional[str], optional "public" or "pr

Add a tag to an existing indicator. Parameters ---------- indicator_id : str The GUID of the indicator t

Add a pivot function to entities. Parameters ---------- func : Callable[[Any], Any] The function to add pivot_reg : Pivo

Analyze and build call graph of simple module. Parameters ---------- module : str Module path all_calls : bool R

Analyze imports for package. Parameters ---------- package_root : str The path containing the package and requirements.txt

Return list of anomaly period as TimeSpans. Parameters ---------- time_column : str, optional The name o

Append list of DynamicSummaryItems to existing list. Parameters ---------- data : Union[Iterable[DynamicSummaryItem]

Apply a filter to the query sources. Parameters ---------- query_filter : Callable[[bool], QuerySource]

Convert an optional list/str/str with delims into a list. Parameters ---------- arg : Union[str, list[str]] A string, delimi

Return the attribute to use for the specified entity. Parameters ---------- entity : Union[entities.Entity, str]

Mock az_connect.

Authenticate to the SDK using user based authentication methods, Azure CLI or interactive logon. Parameters ---------- tenant_id : s

Get a list of blobs in a container. Parameters ---------- container_name : str The name of the container

Open the browser to browser/search for a file.

Return QueryProvider query browser. Other Parameters ---------------- kwargs : passed to SelectItem cons

Return TI Results list browser. Parameters ---------- data : pd.DataFrame TI Results data from TIProviders severities :

Return TI Results list browser. Parameters ---------- data : pd.DataFrame TI Results data from TIProvide

Build wheel files from tar.gz files in a directory. Parameters ---------- directory: str Directory containing tar.gz files

Bulk create indicators from a DataFrame. Parameters ---------- data : pd.DataFrame A dataframe containin

Return sum of ord values of characters in string. Parameters ---------- data : pd.DataFrame The DataFrame to process col

Check the current versions of the Python kernel and MSTICPy. Parameters ---------- min_py_ver : Union[Tuple[int, int], str]

Check multiple HTML files in `doc_path`. Parameters ---------- doc_path : str Path recurse: bool If True, recurs

Check single HTML string. Parameters ---------- html : str html content doc_name : str name of document being ch

Check links in an html document (file). Parameters ---------- html_path : str Path to the file all_links : bool, optiona

Check links in Markdown document. Parameters ---------- doc_path : str Path to the document Returns ------- Dic

Check and optionally update the current version of msticpy. Parameters ---------- min_msticpy_ver : Tuple[int, int] Minimum

Check the current version of the Python kernel. Parameters ---------- min_py_ver : Tuple[int, int] Minimum Python version

Recursively check URL page and child links. Parameters ---------- page_url : str Url to check all_links : bool, optional

Check the current version against latest on PyPI.

Clear any cached secrets from keyring.

Clear the status text.

Close the client connection.

Clusters process data into specific processes. Parameters ---------- audit_data : pd.DataFrame The Audit data containing pro

Compute the geometric mean of the likelihood for each of the sessions. This is done by raising the likelihood of the session to the

Compute the likelihood of the input `window`. Parameters ---------- window: List[Cmd] part or all of a session, where a sess

Compute the likelihood of the input `window`. Parameters ---------- window: List[Cmd] part or all of a session, where a sess

Compute the likelihood of the input `window`. Parameters ---------- window: List[str] part or all of a session, where a sess

Compute the likelihoods of a sliding window of `window_len` in the session. Parameters ---------- session: List[Cmd] list of

Compute the likelihoods of a sliding window in the session. Parameters ---------- session: List[Cmd] list of Cmd datatype

Compute the likelihoods of a sliding window of length `window_len` in the session. Parameters ---------- session: List[str]

Connect to data source.

Connect to Splunk host.

Return containers in the Azure Blob Storage Account.

Return the CRC32 hash of the input column. Parameters ---------- data : pd.DataFrame The DataFrame to process column : s

Create a networkx graph from the alert and contained entities.

Create baseline file for current packages.

Create a bookmark in the Sentinel Workspace. Parameters ---------- name : str The name of the bookmark t

Create a new container within the Azure Blob Storage account. Parameters ---------- container_name : str

Group input data and add indexes and tooltips. Parameters ---------- data : pd.DataFrame Input dataframe source_columns

Return GeoLocation entity - test helper.

Return a get_config function with settings set to settings.

Create a Sentinel Incident. Parameters ---------- title : str The title of the incident to create

Create and return a MarkerCluster with name. Parameters ---------- name: str Name of the MarkerCluster

Create a MarkerCluster and add geohash locations. Parameters ---------- geohashes: Iterable[str] Collect

Create a FeatureSubGroup with collection of geohash locations. Parameters ---------- geohashes: Iterable[str]

Create a Search job. Parameters ---------- query : str The KQL query to run as a job. start : da

Create a "session_ind" column in the dataframe. In particular, the session_ind column will be incremented each time a new session starts

Create the TI Pivot functions.

Return KQL time filter expression from anomaly periods. Parameters ---------- periods : Dict[datetime, datetime] Dict of sta

Test simple lookup of IoC.

Create a new watchlist. Parameters ---------- watchlist_name : str The name of the watchlist you want to

Return the current instance of the wrapped class.

Return dictionary of current Synapse mount points.

Return default values for driver properties.

Delete the control stored at `path`.

Delete a deployed Analytic rule from a Sentinel workspace. Parameters ---------- analytic_rule : str The

Delete a blob from the Azure Blob Storage account. Parameters ---------- container_name : str The contai

Delete the selected bookmark. Parameters ---------- bookmark: str, optional The name or GIUD of the book

Delete the Dynamic Summary for `summary_id`. Parameters ---------- summary_id: str, optional The UUID of

Delete a specific TI indicator. Parameters ---------- indicator_id : str The GUID of the indicator to de

Delete parameter item.

Delete a query. Parameters ---------- button : Button The button object.

Delete a search result. Parameters ---------- search_name: str The name of the search to delete.

Delete a secret in the keyring group. Parameters ---------- secret_name : str Name of the secret

Delete a selected Watchlist. Parameters ---------- watchlist_name : str The name of the Watchlist to del

r""" Count the delimiters in input column. Parameters ---------- data : pd.DataFrame The DataFrame to process column : st

r""" Return a list of DynamicSummary objects from a DataFrame of summaries. Parameters ---------- data : pd.DataFrame

r""" Return a single DynamicSummary object from a DataFrame. Parameters ---------- data : pd.DataFrame Da

Display the interactive widgets.

Display the interactive widget.

Display the widget.

Display in IPython.

Display the widget.

Display in IPython.