Return a QueryCollection instance.

Return a QueryDefaults object.

Return a QueryEditor instance.

Print help for `query_name`. Parameters ---------- query_name : str The name of the query.

Return a QueryMetadata instance.

Return list of family.query in the store. Returns ------- Iterable[str] List of queries

Query parameters derived from alert. Returns ------- dict(str, str) -- Dictionary of parameter names

Query parameters derived from alert. Returns ------- Dict[str, Any] Dictionary of parameter name

Query parameters derived from alert. Returns ------- Dict[str, Any] Dictionary of parameter names/values

Query parameters derived from alert. Returns ------- Dict[str, Any] Dictionary of parameter name

Return dict of query parameters. These parameters are sourced in the object implementing this method. Returns

Test fixture to create query provider.

Query provider.

Return the default QueryTime control for queries.

Mock query_with_results.

Test method.

Return query with fake results.

Return query with fake results.

Execute query string and return DataFrame plus native results. Parameters ---------- query : str The que

Execute query string and return DataFrame plus native results. Parameters ---------- query : str The que

Execute query string and return DataFrame of results. Parameters ---------- query : str Query to execute

Return query with fake results.

Place holder.Not used.

Execute query string and return DataFrame of results. Parameters ---------- query : str Query to execute

Execute query string and return DataFrame of results. Parameters ---------- query : str The kql query to

Execute query string and return DataFrame of results. Parameters ---------- query : str Query to execute

Execute query string and return DataFrame of results. Parameters ---------- query : str Query to execute

Find and compute likelihood of the rarest window of `window_len` in the session. Parameters ---------- session: List[Cmd] li

Find and compute the likelihood of the rarest window of `window_len` in the session. Parameters ---------- session: List[Cmd]

Find and compute likelihood of the rarest window in the session. Parameters ---------- session: List[str] list of commands (

Read query file.

Read schema file.

Read a mock schema file for testing.

Refresh local keyring secrets cache from Key Vault.

Refresh the authentication token.

Register pivot functions from configuration file. Parameters ---------- pivot_reg_path : str Path to con

Register pivot functions for a Provider. Parameters ---------- pivot_reg : PivotRegistration Pivot regis

Register pivot functions for the TI Provider. Parameters ---------- pivot_reg : PivotRegistration Pivot

Return relationships dict.

Reload provider settings from config.

Remove rows from input DataFrame. Parameters ---------- data : pd.DataFrame Input dataframe columns : list[str]

Display a VTGraph in a Jupyter Notebook. Parameters ---------- graph_id: Graph ID width

Replace a parameter in a query string with a formatted string. Parameters ---------- param_name : str The name of the parame

Return columns required for Init.

Return the set of parameters with no default values. Returns ------- Iterable[dict] List of parameters

Reset changed data flag.

Reset changed data flag.

Remove MSTICPy custom exception handler.

Reset the time range used to [now - 1day] - [now].

Return match of cloud alias or name.

Return IoCType determined by IoCExtract. Parameters ---------- observable : str IoC observable string

Return the resource ID for the workspace.

Return the resource manager URI.

Return DataFrame representation of Lookup response. Parameters ---------- item_lookup : pd.DataFrame Out

Pytest fixture to create ResourceGraphDriver for other tests.

Detect patterns of risky commands in syslog messages. Risky patterns are defined in a json format file. Parameters ---------- e

Detect if a sudo session occurs at the point of a suspicious event. Parameters ---------- sudo_sessions: dict Dictionary of

Run a pivot function on the current DataFrame. Parameters ---------- func : Callable[..., pd.DataFrame]

Mock run_cell_magic.

Return sandbox ID of detonation.

Query Provider fixture.

Save the map to `path`. Parameters ---------- path: str File path to save the current map

Msticpy SaveToCell IPython magic extension. Parameters ---------- line : str, optional Line contents, by

Mock method.

Return current data schema of connection. Returns ------- Dict[str, Dict] Data schema of current connect

Mock schema property.

Return current data schema of connection. Returns ------- Dict[str, Dict] Data schema of current connect

Return current data schema of connection. Returns ------- Dict[str, Dict] Data schema of current connect

Return current data schema of connection. Returns ------- dict[str, dict] Data schema of current connect

Return current data schema of connection. Returns ------- Dict[str, Dict] Data schema of current connect

Return current data schema of connection. Returns ------- Dict[str, Dict] Data schema of current connect

Return current data schema of connection. Returns ------- Dict[str, Dict] Data schema of current connect

Return schema for current database.

Return list of tables in the data schema of the connection. Returns ------- List[str] Tables in the of c

Return list of tables in the data schema of the connection. Returns ------- List[str] Tables in the of c

Model sessions and then produces an interactive timeline visualisation plot. In particular, the sessions are modelled using a sliding window

Get a screenshot of a url with Browshot. Parameters ---------- url : str The url a screenshot is wanted for. api_key : s

Return searchable metadata and query for all queries.

Display matching modules as list or HTML table. Parameters ---------- pattern : str Substring or regular expression

Return the list of secret names from the vault.

Return a list of Bokeh column definitions for the DataFrame.

Return the selected columns.

Return the ID of the selected data set.

Return a list of the selected items. If the input list is a list of tuples, this returns a list of the selected tuples.

Return list of selected values. If the input list is a list of tuples, this returns a list of values of the items.

Generate MicrosoftSentinel instance for testing.

Generate MicrosoftSentinel for testing.

Generate MicrosoftSentinel for testing.

Return initialized query provider.

Return queries retrieved from the service after connecting. Returns ------- Tuple[Dict[str, str], str] D

Return dynamic queries available on connection to service. Returns ------- Tuple[Dict[str, str], str] Di

Sessionize the input data. In particular, the resulting dataframe will have 1 row per session. It will contain the following columns: th

Setup test.

Setup test.

Create keyring for tests.

Intialize test.

Test initialization.