Filter the alert list by substring.

Filter the alert list by substring.

Handle change events for origin date and time controls.

Validate a compound type definition. We want to validate a value against a definition like: :: cred_key: one_of:

Validate that parameter is a valid hostname.

Ensure Ip address is a valid public IPv4 address.

Return value from dict or empty dict.

Add an edge attribute.

Add a bookmark to an incident. Parameters ---------- incident : str Either an incident name or an incide

Add a new query. Parameters ---------- button : Button The button object.

Add pivot functions from provider. Parameters ---------- prov : QueryProvider Query provider.

Add related alerts to the graph. Link to the entity that is common to both alerts.

Create fake aml file system.

Return any Sentinel Analytics associated with the alert.

Return any additional arguments.

Authenticate the Secrets/Key Vault client. Parameters ---------- auth_methods : List[str], optional List of authentication m

Return the AAD authority URI.

Return authority URI for cloud. Returns ------- str Authority URI

Return a list of builtin and plugin providers. Returns ------- list[str] List of TI Provider classes.

Mock az_connect.

Return Azure resource name.

Fixture to get loaded Azure Sentinel Provider.

Base64 IPython magic extension. Parameters ---------- line : str, optional Line cont

Base64-decode strings taken from a pandas dataframe. Parameters ---------- data : pd.DataFrame dataframe

Return blank schema dictionary.

Return current set of boolean filters.

Browse the behavior categories.

Return QueryProvider query browser. Parameters ---------- query_provider : QueryProvider Initialized query provider. Ot

Build Networkx graph of imports. Parameters ---------- modules : Dict[str, ModuleImports] Dictionary of module imports

Return True if data has changed.

Return True if data has changed.

Return True if data has changed.

Check single HTML file `doc_path`. Parameters ---------- doc_path : str Path max_threads: int, optional The maxi

Check multiple HTML files in `doc_path`. Parameters ---------- doc_path : str Path recurse: bool If True, recurs

Check the obfuscation results for a row. Parameters ---------- data : pd.DataFrame Obfuscated DataFrame orig_data : pd.D

Check that the current python version is not less than `min_ver`. Parameters ---------- min_ver : Tuple, optional Minimum re

Check a URL and child pages for broken links. Parameters ---------- start_url : [type] Starting URL all_links : bool, op

Decorate function to check kwargs names against legal arg names. Parameters ---------- legal_args : Iterable[str] Iterable o

Delete local keyring secrets cache.

Clear LRU caches before each test to ensure isolation.

Return None if magic isn't == kql.

Return None if magic isn't == kql.

Return the cloud for the settings.

Return a list of current cloud names.

Fake cluster_auditd function for partial install.

Return current cluster URI.

Return current cluster URI.

Cluster logon sessions in syslog by start/end time based on PAM events. Parameters ---------- logon_events: pd.DataFrame A D

Return current cluster URI.

Detect patterns of cmd_line activity whose speed of execution may be suspicious. Parameters ---------- cmd_events: pd.DataFrame

Return the Log Analytics connection string for dev code auth. Returns ------- str Connection string

Return a dictionary that maps fields to schema names.

Return list of columns in schema data source.

Compute command related probabilities. In particular, computes the probabilities for the individual commands, and also the probabilities

Compute the training counts for the sessions. In particular, computes counts of individual commands and of sequences of two commands. It

Compute the training counts for the sessions. In particular, computes counts of individual commands and of sequences of two commands. It

Compute counts of individual commands and of sequences of two commands. Parameters ---------- sessions: List[List[str]] each

Compute param related probabilities. In particular, computes the probabilities of the individual params, and also the probabilities of t

Compute value related probabilities. In particular, compute the probabilities of the individual values, and also the probabilities of th

Return the Computer name of the host associated with the alert. (host FQDN, if available)

Return computer from source event.

Return True if workspace id and tenant id have values. Returns ------- bool True if configuration loaded

Return mount path for MSTICPy config.

Return current Kusto config settings.

Return a list of available providers that have configuration details present. Returns ------- list[str]

Connect to data source. Parameters ---------- connection_str : str Connection string for the data source

Connect to data source.

Connect to data source. Parameters ---------- connection_str : Optional[str] Connect to a data source

Connect to data source. Parameters ---------- connection_str : Optional[str] Connect to a data source

Connect to Elastic cluster. Parameters ---------- connection_str : Optional[str], optional Connection st

Connect to data source. Parameters ---------- connection_str : str Connect to a data source

Authenticate with Prisma Cloud and establish an authenticated session. This method sends authentication credentials to the Prisma Cl

Connect to data source. Parameters ---------- connection_str: Optional[str], optional Connect to a data

Return True if the provider is connected. Returns ------- bool True if the provider is connected.

Return true if at least one connection has been made. Returns ------- bool True if a successful connecti

Return true if at least one connection has been made. Returns ------- bool True if a successful connecti

Return true if at least one connection has been made. Returns ------- bool True if a successful connecti

Return the connection status. Returns ------- bool True if the driver is connected and authenticated, Fa

Return provider connection string. Returns ------- str Provider connection string.

Return TILookup instance.

Return TILookup instance.

Return a list of current tab names and controls.

Convert DeviceProcessEvents schema data to internal MDE schema. Parameters ---------- data : pd.DataFrame Input data in MS S

Convert KQL timespan columns to pandas timedelta64[ns]. This converts string columns containing KQL timespan values to panda

Return Latitude/Longitude as a tuple of floats.

Return dict of providers.

Return dict of providers.

Fixture for NX Graph.