Save current dataframe to `var_name` in the IPython user namespace. Parameters ---------- var_name : str

Return TI Details display function.

Display a timeline of events. Parameters ---------- time_column : str, optional Name of the timestamp co

Display a duration timeline of events grouped by one or more columns. Parameters ---------- group_by : Union[Iterabl

Display a timeline of events. Parameters ---------- time_column : str, optional Name of the timestamp co

Return summary items as DataFrame.

Generate a dataframe of nodes in the graph.

Return the item as HTML string.

Return object as a JSON string.

Return JSON representation of DynamicSummary.

Return a dictionary with layout and style for a textarea widget. Parameters ---------- width : str, optional The width of th

Base64 decode strings taken from a pandas dataframe. Parameters ---------- data : pd.DataFrame dataframe containing column t

Update a dynamic summary in the Sentinel Workspace. Parameters ---------- summary : DynamicSummary Dynam

Update an existing indicator within the Microsoft Sentinel workspace. Parameters ---------- indicator_id : str

Upload a pandas DataFrame to Log Analytics. Parameters ---------- data : pd.DataFrame Pandas DataFrame t

Return expected property type.

Validate settings against definitions. Parameters ---------- show_all : bool, optional Show success vali

Validate msticpy config settings. Parameters ---------- mp_config : Union[SettingsDict, Dict[str, Any], None], optional The

Run the validator against currently loaded settings.

Verify return results.

Verify return results.

Extract IoCs from either a pandas DataFrame. Parameters ---------- ip_column : str Column name of IP Add

Write out generated YAML files of the given query_list into the given output_folder. Parameters ---------- query_list : list

Initialize the class.

Create a new instance of AlertSelector. Parameters ---------- alerts : pd.DataFrame DataFrame of alerts.

Select an item from a list or dict. Parameters ---------- description : str, optional The widget label t

Init function to get the API key if necessary. Parameters ---------- pd_key: str An API key for the Puls

Create instance of MitreAttack. Parameters ---------- attack : Dict[str, Any], optional attack data as d

Instantiate the Cmd class. Parameters ---------- name: str name of the command. e.g. for Exchange online

Instantiate the class wrapper.

Parse successful response to ensure everything was properly retrieved. Parameters ---------- response: httpx.Respons

Add alert node to the graph.

Add alerts to incident.

Add commandline default features. Parameters ---------- output_df : pd.DataFrame The dataframe to add features to force

Add driver queries to the query store.

Add status info, if query produced no results.

Add an incident entity to the graph.

Add the KeyVault instance responsible for storing `secret_name`.

Add a lazily-loaded tab with name `tab_name` and definition `control_def`.

Add missing required items to requests based on existing values.

Add process name default features. Parameters ---------- output_df : pd.DataFrame The dataframe to add features to force

Add RDAP data to WhoIs result.

Define script arguments.

Create argparse arguments.

Add list of DynamicSummaryItems. Parameters ---------- data : Union[Iterable[DynamicSummaryItem], Iterable[Dict[str,

Add DynamicSummary items from an iterable of dicts. Parameters ---------- data : Iterable[Dict[str, Any]]

Add current set of decoding results to collection.

Add root, branch, leaf properties and set proc_key as index.

Convert a scalar or Iterable value to a DataFrame. Parameters ---------- arg_val: Any The value to be converted col_name

Determine what type of sessions we have. In particular, assess the input `self.sessions` to see whether each session is a li

Awaitable coroutine for widget.

Authenticate using multiple authentication sources. Parameters ---------- auth_methods : list[str], optional List of authent

Build a credential from Certificate.

Build a credential from Client Secret.

Build a credential from Device Code.

Build a credential from Interactive Browser logon.

Return dictionaries mapping Mitre items to Mordor datasets. Parameters ---------- mdr_metadata : Dict[str, MordorEntry] Dict

Build a credential from PowerShell logon session.

Top level function to create displayable DataFrame.

Build the query string for the MB API.

Build an API URL from an Azure resource ID. Parameters ---------- sentinel_instance : SentinelInstanceDetails

Build authentication authentication string to pass to LA API. Parameters ---------- date : str datetime

Build a credential from Visual Studio Code.

Reorder the auth methods to put Azure CLI first.

Pull down Tor exit node list and save to internal attribute.

Pull IANA TLD list and save to internal attribute.

Check package version matches required version and reload.

Check the age of geo ip database file and download if it older than 30 days. User can set auto_update or force_update to True or Fal

Check for Azure CLI credentials.

Check whether the Cmd datatype has the expected attributes.

Get any other IoCs from decoded URL.

Return params that require iteration and those that don't.

Check for a duplicate value in existing results. Parameters ---------- observable : str The IoC observa

Diagnostic for _extract_inferred_parents.

Check Item Type and cleans up item. Parameters ---------- item : str item item_type : str, optio