Lookup from a value. Parameters ---------- item : str item to lookup item_type : str, optional

Lookup collection of items. Parameters ---------- data : Union[pd.DataFrame, dict[str, str], Iterable[str]]

Lookup a single observable. Parameters ---------- observable : str Observable value to lookup ob

Lookup a collection of Observables. Parameters ---------- data : Union[pd.DataFrame, Mapping[str, str], Iterable[str

Lookup a collection of IoCs. Parameters ---------- data : Union[pd.DataFrame, Mapping[str, str], Iterable[str]]

Create distrib at `path`.

Obfuscate the data in columns of a pandas dataframe. Parameters ---------- data : pd.DataFrame dataframe

Obfuscate columns of a DataFrame. Parameters ---------- data : pd.DataFrame Input dataframe column_map : Mapping[str, An

Return string as a warning - orange text prefixed by "Warning". Parameters ---------- string : str The warning message.

Mock mounting a storage location.

Mount Azure file container to Synapse file system. Parameters ---------- store_acct_name : str Storage account container

Return a new DynamicSummary object. Notes ----- See the DynamicSummary class documentation for details of ex

Parse dict of pipelines. Parameters ---------- pipelines : Dict[str, Dict[str, Any]] Dict of pipelines.

Return the details of the response. Parameters ---------- response : Dict The returned data response

Return the details of the response. Parameters ---------- response : Dict The returned data response

Display time series anomalies visualization. Parameters ---------- value_column : str, optional Name

Plot entity graph with Bokeh. Parameters ---------- entity_graph : nx.Graph The entity graph as a networkX graph node_si

Plot entity graph with Bokeh. Parameters ---------- entity_graph : nx.Graph The entity graph as a networkX graph node_si

Plot entity graph with Bokeh. Parameters ---------- nx_graph : nx.Graph The entity graph as a networkX graph title : str

Plot a Process Tree Visualization. Parameters ---------- data : pd.DataFrame DataFrame containing one or more Process Trees

Populate new or existing msticpyconfig with settings from config.json.

Write a comment for an incident. Parameters ---------- incident_id : str Incident ID GUID. comme

Print out the call tree. Parameters ---------- call_graph : [type] [description] level : str, optional [descript

Display an interactive prompt for Workspace details.

Return the query template. Returns ------- str The template query.

Execute query string and return DataFrame of results. Parameters ---------- query : str The query to exe

Execute query string and return DataFrame of results. Parameters ---------- query : str The query to exe

Execute query string and return DataFrame of results. Parameters ---------- query : str The query to exe

Execute Sumologic query and retrieve results. Parameters ---------- query : str Sumologic query to execu

Print help for query.

Query for indicators in a Sentinel workspace. Parameters ---------- include_disabled : bool, optional Pa

Return True if query should be exposed for this driver.

Return True if query source is valid for current cluster.

Return results with optional status object.

Execute query string and return DataFrame of results. Parameters ---------- query : str The kql query to

Execute query string and return DataFrame of results. Parameters ---------- query : str Query to execute

Return query results as a DataFrame and the result status. Parameters ---------- query : str The query s

Mock query_workspace method.

Create pre-formatted details for raw results.

Return folder contents. Parameters ---------- folder : str Folder path. Returns -------

r""" Extract Audit events from a log file. Parameters ---------- filepath : str path to the input file event_type : str,

Reload keyring values from Key Vault.

Refresh global MSTICPy settings from config file.

Refresh the authentication token.

Register pivot functions for the TI Provider. Parameters ---------- pivot_reg : PivotRegistration Pivot

Register pivot functions from TI providers.

Generate nodes and edges from relationships. Parameters ---------- relationship_dfs : list[pd.DataFrame]

Remove a link between 2 nodes on the graph. Parameters ---------- source : str Name of node to remove li

Remove a node from the graph. Parameters ---------- name : str The name of the node to remove.

Print report of analysis. Parameters ---------- node_types : list[str] | None, optional Optional list of

Reset enviroment - remove all non-core msticpy packages.

Resolve a path relative to the package. Parameters ---------- part_path : str Absolute or relative path to resolve.

Mock response to query.

Convert IoC results to DataFrame.

Return dictionary of results. Returns ------- dict[str, Any] Dictionary of results keyed by node_type.

Mock run_line_magic.

Run pytest on `path`.

Save a pickle-able object to a new cell. Parameters ---------- obj : Any The object to be stored. Must be pickle-able. v

Model sessions using a sliding window approach within a markov model. Parameters ---------- data: pd.DataFrame Dataframe whi

Create a search job.

Return the message results.

Return MSTICPy modules that match `pattern`. Parameters ---------- pattern : str Substring or regular expression Return

Search queries for matching attributes. Parameters ---------- search : str Search string. Substrings sep

Set the current cluster to `cluster` and connect.

Set the default database to `database`.

Set the metadata object.

Return DataFrame with anomalies calculated based on new threshold. Parameters ---------- data : pd.DataFrame Input DataFrame

Set the parameter container.

Set the query collection.

Set a secret in the Vault. Parameters ---------- secret_name : str Name of the secret value: str

Programatically set the tab by name or index.

Ask the azure-core BearerTokenCredentialPolicy policy to get a token. Using the policy gives us for free the caching system of azure

Set flag env var to indicated that code is being unit-tested. Parameters ---------- on : bool, optional Turn unit testing fl

Initiate logging.

Display the data table control.

List current distributions.

Solve conflicts in both directions.

Return current start time for queries.

Mock submit call.

Run a dataframe method on the dataframe without changing it. Parameters ---------- df_func : str The nam

Run notebooks. Parameters ---------- src_path : str Source path for notebooks out_path : str Path to save failed

Run notebooks. Parameters ---------- src_path : str Source path for notebooks out_path : str Path to save failed

Return attributes as a JSON-serializable dictionary.

Return Pygments-highlighted code for specified language. Parameters ---------- code : str Input code as string. language

Return the item as HTML string.

Return HTML representation of entity. Returns ------- str HTML representation of entity

Return API-ready JSON representation of DynamicSummary.

Return yaml representation of pipeline. Returns ------- str Pipeline as yaml.

Return count of delimiter-separated tokens pd.Series column. Parameters ---------- value : str Data to process delimiter

Return count of delimiter-separated tokens pd.Series column. Parameters ---------- data : pd.DataFrame The DataFrame to proc

Return anomalies in Timeseries using STL. Parameters ---------- data : pd.DataFrame DataFrame as a time series data set retr

Return dict from string of "key:val; key2:val2" pairs. Parameters ---------- txt_val : str The key/value string (items separ

Base64 decode an input string. Parameters ---------- input_string : str, optional single string to decode (the default is No

Unpack an Audit message and returns a dictionary of fields. Parameters ---------- audit_str : str The auditd raw record

Update properties of an incident. Parameters ---------- incident_id : str Incident ID GUID. upda

Upload a blob of data. Parameters ---------- blob : Any The data to upload. container_name : str