msticpy.context.azure.sentinel_watchlists module
Mixin Classes for Sentinel Watchlist Features.
- class msticpy.context.azure.sentinel_watchlists.SentinelWatchlistsMixin
Bases:
objectMixin class for Sentinel Watchlist feature integrations.
- add_watchlist_item(watchlist_name: str, item: Dict | Series | DataFrame, overwrite: bool = False)
Add or update an item in a Watchlist.
- Parameters:
watchlist_name (str) – The name of the watchlist to add items to
item (Union[Dict, pd.Series, pd.DataFrame]) – The item to add, this can be a dictionary of valies, a Pandas Series, or DataFrame
overwrite (bool, optional) – Wether you want to overwrite an item if it already exists in the watchlist, by default False
- Raises:
MsticpyUserError – If the specified Watchlist does not exist.
MsticpyUserError – If the item already exists in the Watchlist and overwrite is set to False
CloudError – If the API returns an error.
- create_watchlist(watchlist_name: str, description: str, search_key: str, provider: str = 'MSTICPy', source: str = 'Notebook', data: DataFrame | None = None) str | None
Create a new watchlist.
- Parameters:
watchlist_name (str) – The name of the watchlist you want to create, this can’t be the name of an existing watchlist.
description (str) – A description of the watchlist to be created.
search_key (str) – The search key is used to optimize query performance when using watchlists for joins with other data. This should be the key column that will be used in the watchlist when joining to other data tables.
provider (str, optional) – This is the label attached to the watchlist showing who created it, by default “MSTICPy”
source (str, optional) – The source of the data to be put in the watchlist, by default “Notebook”
data (pd.DataFrame, optional) – The data you want to upload to the watchlist
- Returns:
The name/ID of the watchlist.
- Return type:
Optional[str]
- Raises:
MsticpyUserError – Raised if the watchlist name already exists.
CloudError – If there is an issue creating the watchlist.
- delete_watchlist(watchlist_name: str)
Delete a selected Watchlist.
- Parameters:
watchlist_name (str) – The name of the Watchlist to deleted
- Raises:
MsticpyUserError – If Watchlist does not exist.
CloudError – If the API returns an error.
- delete_watchlist_item(watchlist_name: str, watchlist_item_id: str)
Delete a Watchlist item.
- Parameters:
watchlist_name (str) – The name of the watchlist with the item to be deleted
watchlist_item_id (str) – The watchlist item ID to delete
- Raises:
MsticpyUserError – If the specified Watchlist does not exist.
CloudError – If the API returns an error.