Return the end of the timeperiod. Returns ------- datetime End datetime.

Return a list of the Security Alert entities.

Return a list of the Alert or Event entities. Returns ------- List[Entity] List of the Alert or Event en

Return the list of entities extracted from the event. Returns ------- List[Entity] The list of entities

Return a list of all entity classes.

Return distance between two IP Entities. Parameters ---------- ip_src : IpAddress Source/Origin IpAddress Entity ip_dest

Return the environment name.

Return the event type/ID to process for the current schema. Returns ------- Any The value of the event I

Return the column name containing the event identifier. Returns ------- str The name of the event ID col

Execute all cells below currently selected cell.

Build process trees from the process events. Parameters ---------- procs : pd.DataFrame Process events (Windows 4688 or Linu

Build a process tree from raw MDE process logs. Parameters ---------- data : pd.DataFrame DataFrame of process events. d

Read extras packages from setup.py.

Return the first defined file hash. Returns ------- Optional[str] Returns first-defined file hash in ord

Return filtered dataframe.

Apply filtering to data if it is a DataFrame.

Return current filtered DataFrame.

Return current filters as a dict.

Find entity name.

Mock find_magic.

Mock method.

Return formatted title.

Cleanup obfuscated powershell. Parameters ---------- code : str Powershell code segment. Returns ------- str

Construct FQDN from host + dns.

Return a dictionary of mount points and targets.

Return dataframe of IP addresses.

Return a DataFrame of the Alert or Event entities. Returns ------- DataFrame Pandas DataFrame of the Ale

Return the ancestor processes of the source process. Parameters ---------- procs : pd.DataFrame Process events (with process

Get mocked setting item for path.

Query Code Signing Certificate Blocklist (CSCB).

Return the descendents of the source process. Parameters ---------- procs : pd.DataFrame Process events (with process tree m

Return the subset of columns that are present in `data`.

Return dynamic summaries for date range.

Return DynamicSummary for ID. Parameters ---------- summary_id : str The ID of the Dynamic summary objec

Pytest fixture for parameterized tests.

Get the URI of the applicable Defender for Endpoint API.

Get the tenant IDs that are managing a subscription. Parameters ---------- sub_id :str Subscription ID Returns ----

Return specified metrics on Azure Resource. Parameters ---------- metrics: str A string list of metrics

Return details related to an Azure network interface and associated NSG. Parameters ---------- network_id: str

Return the list of notebooks for the dataset. Returns ------- List[Tuple[str, str, str]] Tuples of (name

Determine using heuristics which params take categoricals vs arbitrary strings. This function helps us decide which params we should model

Return the process key of the process given its source_index. Parameters ---------- procs : pd.DataFrame Process events

Return the raw query text for `query_name`. Parameters ---------- query_name : str The name of the query

Return doc string and query as HTML.

Return raw token.

Get the recent MB additions. Parameters ---------- selector : str Get the latest sample from the l

Return the root process for the source process. Parameters ---------- procs : pd.DataFrame Process events (with process tree

Return the process tree to which the source process belongs. Parameters ---------- procs : pd.DataFrame Process events (with

Return the process tree roots for the current data set. Parameters ---------- procs : pd.DataFrame Process events (with proc

Return the current settings.

Return the processes that share the parent of the source process. Parameters ---------- procs : pd.DataFrame Process events

Pytest fixture for parameterized tests.

Get information on a specific subscription. Parameters ---------- sub_id : str The ID of the subscriptio

Get details of all subscriptions within the tenant. Returns ------- pd.DataFrame Details of the subscrip

Return test ids for parameterized tests.

Display TI records from individual TI entry.

Return the timespan as a TimeSpan object.

Mock get_token.

Accessor to training datasets. Parameters ---------- None Returns ------- np.ndarray

Return the depth of the process tree. Parameters ---------- procs : pd.DataFrame Process events (with process tree metadata)

Retrieve whois ASN information for given IP address using IPWhois python package. Parameters ---------- ip : str IP Address

Lookup Whois data from dataframe.

Return the raw NetworkX graph.

Property factory for graph_property.

Return true if file behavior data available.

Return True if EVTX data is available (Enterprise only).

Return True if memory dump data is available (Enterprise only).

Return True if PCAP data is available (Enterprise only).

Hash an Account to something recognizable. Parameters ---------- account : str Account name (UPN, NT or simple name) Re

Hash IP address or list of IP addresses. Parameters ---------- input_item : Union[List[str], str] List of IP addresses or si

Hash a SID preserving well-known SIDs and the RID. Parameters ---------- sid : str SID string Returns ------- s

Get the default help URI.

Return host name column.

Return the Hostname (not FQDN) of the host associated with the alert.

Test function for plot_map.

Identify outlier items using SkLearn IsolationForest. Parameters ---------- x : np.ndarray Input data x_predict : np.nda

Identify outlier items using RobustRandomCutForest. MIT License Copyright (c) 2018 kLabUM. (https://klabum.github.io/rrcf/). Parame

Return a collection of Identity properties for the alert.

Return a collection of Identity properties for the alert.

Import filter set replacing current filters. Parameters ---------- filters : Dict[str, FilterExpr] dict

Replace the current filters with `filters`. Parameters ---------- filters : Dict[str, FilterExpr] dict o

Return the attribute, importing module if needed.

Import a yaml data source definition. Parameters ---------- query_file : str Path to the file to import

Return any incident details associated with the alert.

Load VT3 Pivots if vt library is available.

Return list of available attributes.

Import and return dynamic attribute.

Return instance name, if any for provider. Returns ------- Optional[str] The instance name or None for d

Return instance name, if one is set. Returns ------- Optional[str] The name of driver instance or None i

Return instance name, if any for provider. Returns ------- Optional[str] The instance name or None for d

Ioc Extract IPython magic extension. Parameters ---------- line : str, optional Line

Return current set of IoC types and regular expressions for defanged IoCs. Returns ------- dict dict of

Return IoCExtract instance.

Extract IoCs from either a pandas DataFrame. Parameters ---------- columns : list The list of columns to