Display in IPython.

Display the current observations using IPython.display.

Validate if a domain or URL be be resolved to an IP address. Parameters ---------- url_domain : str The url or domain to val

Download a Python package and its dependencies for local use. Parameters ---------- python_version: str Python version to us

Display a QueryTime widget to get the timespan. Parameters ---------- timespan : Optional[TimeSpan], optional

Enable Layer Control on the map. Parameters ---------- None

Execute simple query string. Parameters ---------- query : str [description] use_connections : U

Mock execute.

Get the parameters needed for the query. Parameters ---------- query_source : QuerySource Query source args : Tuple[Quer

Return field names as a list.

Return field names as a list.

Return field names as a list.

Return specific IoCType based on hash length. Parameters ---------- file_hash : str File hash string

Return list of anomaly period as TimeSpans. Parameters ---------- data : pd.DataFrame The data to process time_column :

Return iterable of yaml files found in `source_path`. Parameters ---------- source_path : str The source path to search in.

Plot folium map from DataFrame. Parameters ---------- ip_column : Optional[str], optional The name of th

Return logon data for one or more events as HTML table. Parameters ---------- logon_event : Union[pd.DataFrame, pd.Series] D

Return SentinelInstanceDetails from a resource ID.

Parse pipelines from yaml string. Parameters ---------- yml_str : str Yaml dict of pipelines. Y

Generate query list document.

Generate process tree data from auditd logs. Parameters ---------- audit_data : pd.DataFrame The Audit data containing proce

Calculate the Haversine distance. Parameters ---------- origin : tuple[float, float] Latitude, Longitude of origin of distan

Return job ID.

Return mocked value from KV.

Return workspace name.

Return all TI indicators in a Microsoft Sentinel workspace. Parameters ---------- limit: int, optional I

Return list of Linked services of `svc_type`. Parameters ---------- svc_type : str Service Type (AzureBl

Create the ArgControl based on the current value of the setting.

Get details about an ASN(s) from its number. Parameters ---------- asns : Union[str, List] A single ASN or list of ASNs to l

Get a list of ASNs that match a name. Parameters ---------- name : str The name of the ASN to search for Returns --

Get a blob from the Azure Blob Storage account. Parameters ---------- container_name : str The name of t

Return the child processes for the source process. Parameters ---------- procs : pd.DataFrame Process events (with process t

Get the cloud endpoints for a specific cloud. If resource_manager_url is supplied, it will be used instead of the cloud name. Parameter

Get the cloud endpoints for a specific cloud. Parameters ---------- cloud : str The name of the cloud to get endpoints for.

Return the cluster name from the cluster uri.

Get the tenant ID for a subscription. Parameters ---------- sub_id : str Subscription ID Returns ------- Option

Get the URI of the applicable Defender for Endpoint API.

Return list of extras from setup.py. Parameters ---------- extra : str, optional The name of the extra to return, by default

Return a VTFileBehavior object with file detonation results. Parameters ---------- file_id : Optional[str], optional

Retrieve the file behavior data. Parameters ---------- sandbox : str, optional Name of specific sandbox

Return sorted list of folders with '..' inserted if not root.

Get http timeout from settings or kwargs.

Return first matching type. Parameters ---------- observable : str The IoC Observable to check

Return decompressed gzip contents. Parameters ---------- binary : bytes byte array of gz file Returns ------- T

Return dictionary of tar file contents. Parameters ---------- binary : bytes byte array of zip file Returns -------

Return dictionary of zip contents. Parameters ---------- binary : bytes byte array of zip file Returns -------

Get M365 login URL.

Calculate median point between Entity IP locations. Parameters ---------- entities : Iterable[Entity] An iterable of entitie

Mock get_mdr_data_paths.

Generate Mordor data sets from GitHub repo. Parameters ---------- item_type : str, optional The type of item required, by de

Fetch the object from VT.

Get the attributes for a parameter name. Parameters ---------- param_name : str Parameter name

Get the parameters for a query function. Parameters ---------- query_func_name : str Query name - the na

Return the parent of the source process. Parameters ---------- procs : pd.DataFrame Process events (with process tree metada

Get queries and parameter data types for `param`. Parameters ---------- param : str The parameter name.

Get queries schema.

Return the query list as a DataFrame.

Get Pivot settings metadata for a query. Parameters ---------- family : str Data family query :

Get the QuerySource for the named `family` and `query`. Parameters ---------- family : str Data family n

Return the details of a specific Azure resource. Parameters ---------- resource_id: str, optional The ID

Return details on all resources in a subscription or Resource Group. Parameters ---------- sub_id: str T

Generate a shared access string (SAS) token for a blob. Parameters ---------- container_name : str The n

Return URL scheme and host and cleaned URL. Parameters ---------- url : str Input URL require_url_encoding : bool

Return function to get or create secrets client. Returns ------- Callable Function to get, replace or create a SecretsClient

Return metrics about TI indicators in a Microsoft Sentinel workspace. Returns ------- pd.DataFrame A tab

Return raw token.

Return the URI for a vault name. Parameters ---------- vault_name : str The Vault name. Returns

Return workspace settings from Sentinel portal URL. Parameters ---------- url : str The URL of the Azure

Return True if a settings path exists.

Hash dictionary values. Parameters ---------- item_dict : Dict[str, Union[Dict[str, Any], List[Any], str]] Input item can be

Hash list of strings. Parameters ---------- item_list : List[str] Input list Returns ------- List[Any]

Import a yaml data source definition. Parameters ---------- query_file : str Path to the file to import

Import multiple query definition files from directory path. Parameters ---------- source_path : str The

Initialize Synapse Spark notebook pipeline. Parameters ---------- identity_type : IdentityType, optional The authentication

Install all wheel files in a directory. Parameters ---------- directory: str Directory containing wheel files

Install msticpy with extra from distrib path. Parameters ---------- extra : str extra to install (default none) path : s

Reverse lookup for IP Address. Parameters ---------- ip_address : str The IP address to query. Returns -------

Return True if benign.

Return True if running in Spark on Azure Machine Learning.

Return True if the passed type is supported. Parameters ---------- item_type : Union[str, IoCType] type

Return KQL filter expression for anomaly time periods. Parameters ---------- time_column : str, optional

Apply laplace smoothing to the input counts for the values. In particular, add 1 to each of the counts, including the unk_token. By includin

Return all Microsoft Sentinel alert rules for a workspace. Returns ------- pd.DataFrame A table of the w

Return all custom hunting queries in a Microsoft Sentinel workspace. Returns ------- pd.DataFrame A tabl

Return all saved queries in a Microsoft Sentinel workspace. Returns ------- pd.DataFrame A table of the

Load all compatible plugins found in plugin_path.

Load providers from user defaults in msticpyconfig.yaml. Returns ------- Dict[str, object] Dict of object name and provider

Lookup a single IoC observable. Parameters ---------- ioc : str IoC Observable value ioc_type :

Look single IoC observable related items. Parameters ---------- observable: str The observable value

Lookup collection of IoC observables. Parameters ---------- data : Union[pd.DataFrame, dict[str, str], Iterable[str]

Look up and single IoC observable relationships. Parameters ---------- observables_df: pd.DataFrame A Pa

Lookup a collection of IoCs. Parameters ---------- data : Union[pd.DataFrame, Mapping[str, str], Iterable[str]]

Lookup IP location from IPStack web service. Parameters ---------- ip_address : str, optional a single a