Display the widget.

Display the interactive widgets.

Display logon data for one or more events as HTML table. Parameters ---------- logon_event : pd.DataFrame Dataframe containi

Try to parse a string value to an Enum member. Parameters ---------- enum_cls : EnumType The Enum type to check against

Escape backslash characters in a string.

Mock execute_mgmt.

Perform a search query on the Pulsedive API. Parameters ---------- query : str The query to perform.

Return dictionary of anomaly periods, merging adjacent ones. Parameters ---------- data : pd.DataFrame The data to process

Return field names as a list.

Return set of fields widget controls.

Return set of queries with name `query_name`. Parameters ---------- query_name: str Name of the query

Create a WorkstationConfig from MSTICPY Workspace settings.

Return results of httpx.get.

Mock method.

Return mocked token.

Get the ASN that an IP belongs to. Parameters ---------- ip : Union[str, IpAddress] IP address to lookup. ip_address : U

Return the geographical center of the IP address locations. Parameters ---------- ip_entities : Iterable[IpAddress] IpAddres

Get the cloud endpoints for a specific resource manager url. Parameters ---------- resource_manager_url : str The resource m

Get a list of database names from the connected cluster.

Get a default resource name for a resource URI.

Get the entities from an incident. Parameters ---------- incident : str Incident GUID or Name .

Return the executable step details. Returns ------- PipelineExecStep Named tuple with the following fiel

Return md5, sha1 and sha256 hashes of input byte string. Parameters ---------- binary : bytes byte string of item to be hash

Return proxy settings from config.

Get details on a specific incident. Parameters ---------- incident : str Incident ID GUID. entit

Get the alerts from an incident. Parameters ---------- incident : str Incident GUID or Name. Re

Get the comments from an incident. Parameters ---------- incident : str Incident GUID or name.

Get the comments from an incident. Parameters ---------- incident : str Incident GUID or Name.

Get join parameters from kwargs. Parameters ---------- func_kwargs : dict[str, Any] Keyword arguments from caller Retur

Get the logon Id for the alert or the account, if supplied. If `account` is not supplied, return the logon id of the first h

Get a provider by type name. Parameters ---------- name : str The name of the provider type. Re

Get the list of queries for a parameter. Parameters ---------- param : str Parameter name Retur

Return accessor function for a secret. Parameters ---------- setting_path : str The msticpy configuratio

Get the subscription metadata for a subscription. Parameters ---------- sub_id : str Subscription ID Returns ------

Return summary information about the process trees. Parameters ---------- procs : pd.DataFrame Process events (with process

Return start and end range, coping with out-of-bounds error.

Extract token from a azure.identity object. Parameters ---------- credential : AzCredentials Azure OAuth credentials. te

Mock get_token.

Return fake token header dict.

Return resolved name from workspace ID or resource ID. Parameters ---------- workspace_id : Optional[str], optional

Return default storage linked service. Returns ------- Optional[LinkedService] Default storage service.

Import provider class.

Validate if a domain or URL's SSL cert the abuse.ch SSL Abuse List. Parameters ---------- url_domain : str

Plot an incident graph if the dataframe contains incidents or alerts. Parameters ---------- timeline : bool, optiona

Infer the correct schema to use for this data set. Parameters ---------- data : pd.DataFrame | pd.Series Data set to test

Return a python IP address object from the entity property.

Return True if running in Azure Machine Learning.

Return True if running in Synapse Pipeline.

Validate if a domain or URL be be resolved to an IP address. Parameters ---------- url_domain : str The

Return an iterator for the collection specified by the given path. The endpoint specified by path must return a collection of object

Join input and result DFs, optionally ignoring case. Parameters ---------- input_df : pd.DataFrame Input DF result_df :

Apply laplace smoothing to the input counts for the params. In particular, add 1 to each of the counts, including the unk_token. By includin

List Analytic Templates. Returns ------- pd.DataFrame A DataFrame containing the analytics templates

Return list of current data environments. Returns ------- List[str] List of current data environments

Return current list of Dynamic Summaries from a Sentinel workspace. Returns ------- pd.DataFrame The cur

Get a list of incident for a Sentinel workspace. Parameters ---------- params : Optional[dict], optional

Return list of family.query in the store. Parameters ---------- substring : Optional[str] Optional patte

Expand a list column to individual rows. Parameters ---------- cols : Union[str, Iterable[str]] The colu

List items in a watchlist. Parameters ---------- watchlist_name : str The name of the watchlist to get i

List Deployed Watchlists. Returns ------- pd.DataFrame A DataFrame containing the watchlists Ra

Lookup an indicator of compromise (IOC) in the Pulsedive API. Parameters ---------- observable : str The

Lookup Geolocation data from a pandas Dataframe. Parameters ---------- data : pd.DataFrame pandas datafr

Lookup single item in active providers. Parameters ---------- item : str item to lookup item_typ

Lookup a collection of items. Parameters ---------- data : Union[pd.DataFrame, Mapping[str, str], Iterable[str]]

Lookup a single observable.

Plot data as an intersection matrix. Parameters ---------- data : pd.DataFrame The data to plot.

Return list of mocked mounts.

Context manager to block exception display to IPython/stdout.

Return True if only interactive browser credentials available.

Convert string or int to enum. Parameters ---------- value : Union[str, int] value to parse

Convert JSON string columns to Python types. Parameters ---------- cols : Union[str, Iterable[str]] Colu

Parse a list of requirement strings into Requirement objects.

Extract components from workspace resource ID.

Populate parameter value in widgets.

Populate the query widgets with the data of a query. Parameters ---------- change : Any The change event

Populate the widgets with the metadata of the Metadata object.

Return the pipeline as text that can be executed in Python. Parameters ---------- df_name : str, optional

Execute query string and return DataFrame of results. Parameters ---------- query : str The query to exe

Execute query string and return DataFrame of results. Parameters ---------- query : str The query to exe

Execute query string and return DataFrame of results. Parameters ---------- query : str The query to exe

Execute query string and return DataFrame of results. Parameters ---------- query : str The kql query to

Read DataFrame from file.

Load plugins from folders specified in msticpyconfig.yaml.

Read a yaml data query definition file. Parameters ---------- query_file : str Path to yaml query definition file Retur

Register pivot functions from configuration file. Parameters ---------- file_path : str Path to config yaml file namespa

Reload settings from config files.

Try to resolve any parameters in `param_dict` that are aliases.

Save a QueryCollection to a YAML file. Parameters ---------- query_collection : QueryCollection The QueryCollection object t

Save the data of a query. Parameters ---------- button : Button The button object.

Search `paths` for file `pattern`.

Return the record results.

Return status of job.

Set the axes visibility and grids according to parameters.

Set the pivot timespan. Parameters ---------- value : Optional[Any], optional TimeSpan object or somethi

Show secrets from currently configured Key Vault.

Solve conflicts.

Return a KQL subscription filter clause derived from the alert properties.