Authenticate using device code as a fallback method. Parameters ---------- cloud : str, optional What Azure cloud to connect

Get IPython displayable Security Alert. Parameters ---------- alert : Union[Mapping[str, Any], SecurityAlert] The alert to d

Return list of Mitre attack classifications. Returns ------- List[MitreAttack] List of MitreAttack defin

Return palette based on series size.

Fetch the file behavior data from VT.

Get table names and schema from the connected cluster/database. Parameters ---------- database : str | None

Get default set of columns (backward compat).

Retrieve dynamic summary from MS Sentinel table.

Return a subset of the events matching type event_type. Parameters ---------- data : pd.DataFrame The input data event_t

Get a specific indicator by its ID. Parameters ---------- indicator_id : str The GUID of the indicator t

Return secret from linked service.

Return the current msticpyconfig definition dictionary. Returns ------- Dict[str, Any] msticpyconfig definition dictionary

Return list of current pivot functions. Returns ------- List[str] List of pivot functions assigned to en

Return a potentially protected setting value.

Extract the reference time from kwargs.

Get the current remaining count.

r""" Download Microsoft Sentinel Github archive and extract detection and hunting queries. Parameters ---------- git_url : str, optio

Return named linked service. Returns ------- Optional[LinkedService] Named service service.

Return tenant authority URI with no leading scheme. Parameters ---------- authority_uri : str, optional

Return authority URI for tenant. Parameters ---------- authority_uri : str, optional The authority URI -

Retrieve Whois ASN information for DataFrame of IP Addresses. Parameters ---------- data : pd.DataFrame Input DataFrame

Return the workspace ID given workspace name. Parameters ---------- workspace_name : str Workspace name

Hash a simple string. Parameters ---------- input_item : str The input string delim: str, optional A string of d

Print help for query.

Hide the controls.

Initialize the notebook environment. Parameters ---------- namespace : Dict[str, Any], optional Namespace (usually globals()

Lookup IP Whois information. Parameters ---------- ip : Union[IpAddress, str, List] An IP address or list of IP addresses to

Return True if the entities are equivalent. Parameters ---------- other : Any The entity to check

Apply laplace smoothing to the input counts for the cmds. In particular, add 1 to each of the counts, including the unk_token. By including

Return a list of Bookmarks from a Sentinel workspace. Returns ------- pd.DataFrame A set of bookmarks.

Return a list of current connections. Returns ------- list[str] The alias and connection string for each

Return list of available workspaces. Returns ------- Dict Dictionary of workspaces with workspace and te

Load default settings specified by MSTICPYCONFIG env var.

Load settings from `file`.

Lookup Threat Intelligence reports for a single IoC in active providers. Parameters ---------- ioc : str

Look up single IoC observable relationship links. Parameters ---------- observable: str The observable v

Lookup IP location abstract method. Parameters ---------- ip_address : str, optional a single address to

Lookup IP location from GeoLite2 data created by MaxMind. Parameters ---------- ip_address : str, optional

Lookup a Threat name in the Pulsedive API. Parameters ---------- observable : str The IOC to lookup.

Map config.json settings to MSTICPy settings.

Parse single pipeline from dictionary. Parameters ---------- pipeline : Dict[str, Dict[str, Any]] Single

Plot folium map from DataFrame. Parameters ---------- data : pd.DataFrame The input DataFrame, must have either an IP addres

Plot reference lines/labels.

Print usage of loaded providers.

Reload settings and provider classes.

Remove any URLS in the ignore list.

Rename a setting from `old_path` to `new_path`.

Return required fields for Observation instance. Returns ------- List[str] List of field names.

Reset changed data flag.

Save the values to the Metadata object.

Scan an observable in the Pulsedive API. Parameters ---------- observable : str The observable to scan.

Search queries for match properties. Parameters ---------- search : Union[str, Iterable[str]], optional

Set setting value for path. Parameters ---------- setting_path : str Path to setting item expressed as dot-separated

Set the help string (HTML) and URIs.

Test single notebook. Parameters ---------- notebook_file : str Source path for notebook out_path : str Path to

Mock to_dataframe.

Return True if in unit testing. Returns ------- bool True if in unit testing

Print usage of provider.

Validate if a domain's TLD is valid. Parameters ---------- url_domain : str The url or domain to validat

View the current settings as text.

Instantiate RiskIQ class.

Initialize the class. Set the controls and retrieve settings.

Populate additional alert properties.

Add an alert entity to the graph.

Set a value at dotted path location in self.control_map dict.

Create the pivot function and add to entities.

Adjust the max values so the are always bigger than the defaults.

Analyze imports from a Python file and categorize them.

Analyze local package imports from a Python file.

Conduct authentication against the application.

Get ASN details from ASN number.

Connect to whois server and send query.

Create process and parent keys for unambiguous par-child relation.

Add in additional data items for indicators.

Build a credential from Azure CLI.

Build a credential from environment variables.

Build a credential from Managed Identity.

Calculate date from offset specification.

Check if index exists in Splunk host.

Return True if valid API key available.

Return true if expected process tree columns are present.

Check the current lazy-load status of the tabs.

Combine dataframe results into single DF.

Recursively convert definition dictionary to extract definitions.

Recursively convert definition list to extract definitions.

Set up buttons.

Create a Dynamic Summary in the Sentinel Workspace. Parameters ---------- summary : DynamicSummary Dynam

Create alert entities from returned dicts.