Class for storing trained counts/probabilities.

Class to store commands with accompanying params (and optionally values).

Container for query store and query execution provider. Instances of this class hold the query set and execution methods for a specific

Default exception class for msticpy.

Msticpy User exception displaying friendly message.

Timespan parameter for notebook modules.

Exception class for KqlConnection errors.

Azure Cloud configuration.

Encoded version of observable.

Configuration user exception class for msticpy.

Test configuration for Kusto query tests.

HTTP Lookup Params definition.

Class holding legacy(ADAL) and modern(MSAL) credentials.

Test configuration for Kusto connection tests.

MSTICPy Configuration management class. Use the functions from the commandline or display in a Jupyter notebook to use interactive versi

Exception class for data query errors.

Class for modelling sessions data.

Workspace configuration class.

Property name lookup for Process event schema. Each property maps a generic column name on to the schema of the input data. Most of thes

Create a graph for visualizing and tracking links between entities.

Key Vault configuration exception.

Threat Intel observable lookup from providers.

Class for returning key Microsoft Sentinel elements.

Exception class for Imports that need an extra.

Dictionary class for settings with aliasing.

Kusto Driver class to execute kql queries for Azure Data Explorer.

Wrapper class for Folium/Leaflet mapping.

Exception class for NotConnected errors.

Plot map test class.

Driver to connect and query from Splunk.

Class for test cases.

Core KeyVault client.

GeoIP Lookup using MaxMindDB database. See Also -------- GeoIpLookup : Abstract base class IPStackLookup : IPStack GeoIP Impleme

IPAddress Entity class. Attributes ---------- Address : str IpAddress Address Location : GeoLocation IpAddress L

Exception class for missing/incorrect parameters.

GeoLocation class. Attributes ---------- CountryCode : str GeoLocation CountryCode CountryOrRegionName : str Geo

Driver to connect and query from OpenObserve.

VTEntityType: Enum class for VirusTotal entity types.

VTLookup: VirusTotal lookup of IoC reports. Main methods are: lookup_iocs() - accepts input of multiple IoCs in a Pandas DataFrame l

Alert Entity class. Attributes ---------- AlertDisplayName : str Alert DisplayName CompromisedEntity : str Alert

KqlDriver class to execute kql queries.

Allows simple querying of Azure Log Analytics Basic tables data using KQL. Derives from AzureMonitorDriver and uses direct REST (/search) qu

Msticpy Configuration helper class.

Observation definition. Notes ----- caption : str The title and index of the observation. Must be unique in the obse

Query template editor.

Driver to connect and query from Sumologic.

Mock credentials class.

Class for mocked response.

Host Entity class. Attributes ---------- DnsDomain : str Host DnsDomain NTDomain : str Host NTDomain HostNam

Exception class for Azure Connection errors.

Exception class for KqlConnection errors.

Exception class for resource errors.

Pivot environment loader.

Default values for query definitions.

Metadata for query definitions.

Class to manage editing of query parameters. This class provides a graphical user interface for editing query parameters. It allows user

Query definition class for templated queries. Attributes ---------- name: str The query name metadata: dict[str, Any]

Security Alert Class. Instantiates a security alert from a pandas Series and provides convenience access methods to retrieve properties.

Class for handling legacy auth conversion.

Dynamic Summary class.

Class for mocked response.

IoC Extractor - looks for common IoC patterns in input strings. The extract() method takes either a string or a pandas DataFrame as inpu

KeyVaultSettings class - reads settings from msticpyconfig. Notes ----- The KeyVault section in msticpyconfig.yaml can contain t

KqlDriver class to retrieve date from MS Defender APIs.

No data returned from VT API.

PDlookup: A class to interact with the Pulsedive API. This class allows you to look up indicators of compromise (IOCs) and explore diffe

Custom exception for Process Tree schema.

A Query definition.

Query arguments.

Query Collection class - a query template.

Class for interacting with Azure Blob Storage.

Class for returning data on an Azure tenant.

Dummy ipywidgets change event.

DataTableColumnChooser class.

DynamicSummaryItem class. Parameters ---------- summary_item_id: Optional[str] The ID of the item relation_name: Optiona

Test expected values.

Class for handling MSAL based delegated auth.

Container class for module analysis.

Msticpy configuration and settings database.

Exception class for Imports that are not installed.

Class to retrieve the queries and params from a provider.

Pivot registration for function. Notes ----- src_module : str The src_module to import src_class : str, optional

ProviderArgs dictionary.

Empty class used to create hierarchical attributes.

Attrs class that represents a Sentinel Query yaml file.

Template definition for a line in text process tree. Notes ----- The items attribute must be a list of tuples, where each tuple

Test class.

VirusTotal parameter collection.

Named tuple for IPWhoIs Result.

Account Entity class. Attributes ---------- Name : str Account Name NTDomain : str Account NTDomain UPNSuffi

Data providers edit component.

Observable lookup from providers.

DataTableColumnChooser class.

Data filtering class.

Data viewer class.