Parse an auditd message string into Dict format required by unpack_auditd. Parameters ---------- audit_str : str The Audit m

Print a message if operation is tried with no data.

Print results of any URLs that did not return 200 status. Parameters ---------- results : Dict[str, Dict[str, UrlResult]] Li

Process SELECT clause.

Closure returning function to display query.

Quote string if it is a literal.

Query RADB for ASN information.

Raise an error if no database is specified.

Try to find a usable config from the MSTICPy config file.

Return parsed requirements from requirements file.

Map partial names of module imports to full names.

Return a mapping of column stems and columns with `prefix`.

Return column list in original order.

Reset the change state of the sub-editors.

Expand and optionally creates cache folder.

Resolve path.

Return Dns Python resolver response to dict.

Run any action function and display details, if any.

Run any action function and display details, if any.

Save the metadata of a query. Parameters ---------- metadata : str The metadata string.

Return results for a single input row.

Return required subset of providers. Parameters ---------- providers : list[str], optional Explicit list

Select the first alert by default.

Set item at the path from `member_dict` to `value`.

Configure in-memory settings for MP Azure authn_methods.

Set node attributes from column values.

Set slider properties based on current before and after values.

Return a setting from the settings dictionary or the default.

Get the severity level for a reputation score classification.

Run action on the first item by default.

Sort the labels if required.

Return HTML formatted summary.

Update the displayed columns.

Update the sub-editors with the current query collection.

Update timespan and start and end text controls.

Update UI controls from attributes.

Return parsed Url components as dict.

Validate that optional columns are in the data.

If validate TLDS check with TLD list.

Submit the request to VT. Parameters ---------- submission_string : str The observable (or observable co

Conduct lookup of IP Whois information.

Extract type and options from definition.

Add MarkerClusters and to the map. Parameters ---------- clusters: Iterable[MarkerCluster] Iterable of M

Add a pivot function to entities. Parameters ---------- func : Callable[[Any], Any] The function to add

Add a provider to the current collection. Parameters ---------- provider : TIProvider Provider instance

Add data queries to entities. Parameters ---------- prov_qry_funcs : PivotQueryFunctions Collection of wrapped query functio

Add a tab with name `tab_name` and content `control`.

Add or update an item in a Watchlist. Parameters ---------- watchlist_name : str The name of the watchli

Return anomalies in Timeseries using STL. Parameters ---------- time_column : str, optional If the input

Return DataFrame with anomalies calculated based on new threshold. Parameters ---------- threshold : float

Return PivotBrowser.

Build process tree paths. Parameters ---------- input_tree : pd.DataFrame DataFrame containing process and parent key defini

Build a MS Sentinel resource ID. Parameters ---------- subscription_id : str Subscription ID to use resource_group : str

Call function handling input params in different formats.

Change initial letter Microsoft Sentinel API entity properties to upper case.

Calculate and set map center based on current coordinates.

Apply processing checks to the input value. Parameters ---------- value : str The value to be checked.

Check and install missing packages from provided list of packages. Parameters ---------- required_packages : List[str] List

Check to see if there is a CLI session with a valid AAD token.

Check that specified columns are in the DataFrame. Parameters ---------- data : pd.DataFrame [description] req_columns :

Check the status of a search job. Parameters ---------- search_name : str The name of the search job to

Merge multiple dictionaries - later dicts have higher precedence.

Compute probability of a set of params + values given the cmd. Parameters ---------- cmd: str name of command (e.g. for Exch

Compute probability of a set of params given the cmd. Parameters ---------- cmd: str name of command (e.g. for Excha

Compute some likelihood based scores/metrics for each of the sessions. In particular, computes the likelihoods and geometric mean of

Mock connect function.

Test method.

Connect to Azure Resource Graph via Azure SDK. Parameters ---------- connection_str : Optional[str], optional

Return the CRC32 hash of the input column. Parameters ---------- value : str Data to process Returns ------- in

Create an entity from a mapping type (e.g. pd.Series) or dict or kwargs. Returns ------- Entity Instanti

Create tests for cluster name combos.

Return a doc string for the query. Returns ------- str New-line delimited docstring dynamically

Return a FeatureGroupSubGroup with `name` for a MarkerCluster. Parameters ---------- cluster: MarkerCluster

Create and return a Folium Marker at a given location. Parameters ---------- location: tuple[float,float]

Create a MarkerCluster with locations. Parameters ---------- locations: Iterable[tuple[float, float]] Co

Create subgroup of markers from locations. Parameters ---------- locations: Iterable[tuple[float, float]]

Create function wrapper for pivot function. Parameters ---------- target_func: Callable The target function to wrap. piv

Decode a geohash. Parameters ---------- geohash: str A string representation of a location Returns ------- Tupl

Return collection of geohashes decoded into location coordinates. Parameters ---------- geohashes: Iterable[str] Collection

Decrement the counter.

r""" Count the delimiters in input column. Parameters ---------- value : str Data to process delim_list : str, optional

r""" Return a hash (CRC32) of the delimiters from input column. Parameters ---------- value : str Data to process delim_l

Return string as "key:val; key2:val2" pairs from `dict_val`. Parameters ---------- dict_val : Union[str, Dict[str, Any]] Dic

Execute a query on Prisma Cloud and return results as a DataFrame. This method serves as a unified interface for executing different