Return IoCType determined by ItemExtract. Parameters ---------- item : str Item string Returns

Safely extract a single zip archive member after path validation. Validates that the member path does not escape dest_dir. Parameters

Save current configuration to `file`. Parameters ---------- file : str The file path to save to.

Set the control stored at `path`.

Set the default workspace from workspace name or resource id. Parameters ---------- workspace : Optional[str], optio

Change the time attributes. Parameters ---------- start : Union[datetime, str] Start time - (must specif

Make the controls visible.

Replace Unix timestamps in VT data with Py/pandas Timestamp.

Return networkx graph of entities. Parameters ---------- graph : nx.Graph, optional Graph to add entitie

Upload a folder of files to the data store. Parameters ---------- folder_path : str Path to the folder o

Return legal Python identifier, which doesn't collide with builtins. Parameters ---------- identifier : str The input identi

Check what type of entity is passed in and creates relevant graph.

Add process/parent key to data. Parameters ---------- data : pd.DataFrame Input data key_name : str The name of

Add related alert to an existing graph.

Convert API response to a Pandas dataframe. Parameters ---------- response : httpx.Response A response object from an Azure

Wrap methods to be called from button events.

Wrap methods to be called from button events.

Build query string for the API request based on the provided data and pd_type. Parameters ---------- data : Any Data to be m

Check if a module is in the standard library by path.

Check whether a Watchlist exists or not. Parameters ---------- watchlist_name : str The Watchlist to che

Extract all entities from a set and replace $ref elements.

Fill empty columns in the DataFrame.

Find a node with a given name and type.

Return datetime-formatted string.

Return datetime-formatted string. python-openobserve takes datetime or microseconds since epoch as input

Carry out fishers g test for periodicity. Fisher's g test tests the null hypothesis that the time series is gaussian white noise

Try to retrieve config settings for OAuth drivers.

Return text representation of keyword params.

Get provider options to populate select list.

Return settings dictionary for workspace settings.

Get workspace or workspaces to connect to.

Async wrapper for providers that do not implement lookup_items_async. Parameters ---------- data : Union[pd.DataFram

Request to the malware bazaar api.

Make a request to the PulseDive API with the provided data. Parameters ---------- pd_query : PDQuery Req

Match imports to setup requirements and identify missing requirements.

Return IoCs found in the string.

Return API and login URIs for selected provider type. Validated against Microsoft documentation: MDE Advanced Queries: https://lear

Add an additional connection for the query provider. Parameters ---------- connection_str : Optional[str], optional

Add a datasource/query to the store. Parameters ---------- source : QuerySource The source to add. An ex

Add a collection of IP Entities to the map. Parameters ---------- ip_entities : Iterable[IpAddress] a it

Add an observation. Add an observation as an Observation instance or as a set of keyword parameters (see Observation class f

Build process trees from the process events. Parameters ---------- procs : pd.DataFrame Process events (Windows 4688 or Linu

Dynamic calculation of plot height.

Connect to URL and return response status. Parameters ---------- url : str URL to check Returns ------- UrlResu

Compute the likelihoods for each of the sessions. Note: If the lengths (number of commands) of the sessions vary a lot, then

Compute likelihood of combinations of params conditional on the cmd. In particular, go through each command from each session and

Connect to data source. Parameters ---------- connection_str : str Connect to a data source

Authenticate with the SDK.

Take in an IP Address string and converts it to an IP Entity. Parameters ---------- ip_str : str A string with a single IP A

Create a Dynamic Summary in the Sentinel Workspace. Parameters ---------- summary : DynamicSummary Dynam

Create a new indicator within the Microsoft Sentinel workspace. Parameters ---------- indicator : str Th

Create custom query source for testing.

Create plot bar to act as as range selector.

Create formatting for tool tip columns.

Return the max time buffer for a give time unit.

Delete setting item at `path`.

Detect the time interval which is highly periodic. Runs PeriodogramPollingDetector._detect_polling_arr on the time_column and popula

r""" Return a single DynamicSummary object from a DataFrame. Parameters ---------- data : pd.DataFrame DataFrame containing a

Set the provider as secondary (not used by default). Parameters ---------- providers : Union[str, Iterable[str]

Display a duration timeline of events grouped by one or more columns. Parameters ---------- data : pd.DataFrame Data to plot

Display a timeline of events. Parameters ---------- data : pd.DataFrame DataFrame as a single data set or grouped into indiv

Display time series anomalies visualization. Parameters ---------- data : pd.DataFrame DataFrame as a time series data set r

Set the provider(s) as primary (used by default). Parameters ---------- providers : Union[str, Iterable[str]

Mock the connection succeeding.

Extract IoCs from either a pandas DataFrame. Parameters ---------- data : pd.DataFrame input DataFrame f

Extract auditd raw messages into a dataframe. Parameters ---------- data : pd.DataFrame The input dataframe with raw auditd

Build the forest from training data. Parameters ---------- x : np.ndarray input data to train R

Return normalized name for use as a KeyVault secret name.

Create a WorkstationConfig from a connection string.

Create new DynamicSummary instance from json string or dict.

Return the root of the user folder.

Get a config value from Azure section.

Return the geographical center of the geo locations. Parameters ---------- loc_entities : Iterable[GeoLocation] GeoLocation

Return list of extras from setup.py. Parameters ---------- package_root : str The root folder of the package req_file

Get SelectItem options for TI data.

Return widget appropriate to value type of `var_name`. Parameters ---------- setting_path : str The setting path (parent pat

Return workspace settings from portal URL. Parameters ---------- portal_url : str URL from Sentinel Azur

Return the workspace ID given workspace name. Parameters ---------- workspace_name : str Workspace name

Return a KQL host filter clause derived from the alert properties. :param operator='==': the operator to use in the filter claus

Create list of SentinelQuery attr objects. Parameters ---------- yaml_files : dict Dictionary mapping query file addresses t

Test if valid keyring backend is available. Returns ------- bool True if Keyring has a usable backend, F

Return True if the test_object is not None or empty.

Lookup a collection of items. Parameters ---------- data : Union[pd.DataFrame, Mapping[str, str], Iterable[str]]

Plot data as an intersection matrix. Parameters ---------- data : pd.DataFrame The data to plot. x : str Column

Populate control at `path` from settings at `path`.

Populate the query dropdown widget. Parameters ---------- change : Any The change event.

Predict anomaly labels (-1 for outliers, 1 for inliers). Parameters ---------- x : np.ndarray input data

Return observable with removed de-fanging elements. Parameters ---------- ioc : str The observable to re-fang. ioc_type

Remove pivot functions from one or all entities. Parameters ---------- entity : str entity class name or

Set a secret in the keyring group. Parameters ---------- secret_name : str Name of the secret se

Return the item as HTML string.

Test if query files have a valid structure.

Adjust type and format of value returned from `ctrl.value`. Parameters ---------- ctrl : Union[widgets.Widget, SettingsControl]

Run query with pagination enabled. Parameters ---------- body: dict[str, Any] Body of the HTTP Request

Add a result row to indicate an invalid submission. Parameters ---------- observable : str The IoC obser