msticpy.context.azure.sentinel_workspaces module

Mixin Class for Sentinel Workspaces.

class msticpy.context.azure.sentinel_workspaces.ParsedUrlComponents(domain: str | None, resource_id: str, tenant_name: str | None, res_components: dict[str, str], raw_res_id: str)

Bases: object

Class to defined components for Parsed URLs.

domain: str | None
raw_res_id: str
res_components: dict[str, str]
resource_id: str
tenant_name: str | None
class msticpy.context.azure.sentinel_workspaces.SentinelWorkspacesMixin(*, connect: bool = False, cloud: str | None = None)

Bases: SentinelUtilsMixin

Mixin class for Sentinel workspaces.

Initialize connector for Azure Python SDK.

check_connected() → None

Check that Sentinel workspace is connected.

connect(auth_methods: list[str] | None = None, tenant_id: str | None = None, *, silent: bool = False, cloud: str | None = None, **kwargs) → None

Authenticate to the Azure SDK.

Parameters:

  • auth_methods (List, optional) – list of preferred authentication methods to use, by default None

  • tenant_id (str, optional) – The tenant to authenticate against. If not supplied, the default tenant for the identity will be used.

  • silent (bool, optional) – Set true to prevent output during auth process, by default False

  • cloud (str, optional) – What Azure cloud to connect to. By default it will attempt to use the cloud setting from config file. If this is not set it will default to Azure Public Cloud

  • **kwargs – Additional keyword arguments to pass to the az_connect function.

Raises:

CloudError – If no valid credentials are found or if subscription client can’t be created

See also

msticpy.auth.azure_auth.az_connect

function to authenticate to Azure SDK

get_metrics(metrics: str, resource_id: str, sub_id: str, sample_time: str = 'hour', start_time: int = 30) → dict[str, DataFrame]

Return specified metrics on Azure Resource.

Parameters:

  • metrics (str) – A string list of metrics you wish to collect (https://docs.microsoft.com/en-us/azure/azure-monitor/platform/metrics-supported)

  • resource_id (str) – The resource ID of the resource to collet the metrics from

  • sub_id (str) – The subscription ID that the resource is part of

  • sample_time (str (Optional)) – You can select to collect the metrics every hour of minute - default is hour Accepted inputs = ‘hour’ or ‘minute’

  • start_time (int (Optional)) – The number of days prior to today to collect metrics for, default is 30

Returns:

results – A Dictionary of DataFrames containing the metrics details

Return type:

dict

get_network_details(network_id: str, sub_id: str) → tuple[DataFrame, DataFrame]

Return details related to an Azure network interface and associated NSG.

Parameters:

  • network_id (str) – The ID of the network interface to return details on

  • sub_id (str) – The subscription ID that the network interface is part of

Returns:

details – A dictionary of items related to the network interface

Return type:

dict

get_resource_details(sub_id: str, resource_id: str | None = None, resource_details: dict[str, Any] | None = None) → dict

Return the details of a specific Azure resource.

Parameters:

  • resource_id (str, optional) – The ID of the resource to get details on

  • resource_details (dict, optional) –

    If ID is unknown provide the following details:

    -resource_group_name -resource_provider_namespace -resource_type -resource_name -parent_resource_path

  • sub_id (str) – The ID of the subscription to get resources from

Returns:

resource_details – The details of the requested resource

Return type:

dict

classmethod get_resource_id_from_url(portal_url: str) → str | None

Return resource ID components from Sentinel portal URL.

get_resources(sub_id: str, rgroup: str | None = None, *, get_props: bool = False) → pd.DataFrame

Return details on all resources in a subscription or Resource Group.

Parameters:

  • sub_id (str) – The subscription ID to get resources for

  • rgroup (str (Optional)) – The name of a Resource Group to get resources for

  • get_props (bool (Optional)) – Set to True if you want to get the full properties of every resource Warning this may be a slow process depending on the number of resources

Returns:

A dataframe of resource details

Return type:

pd.DataFrame

get_sentinel_workspaces(sub_id: str) → dict[str, str]

Return a list of Microsoft Sentinel workspaces in a Subscription.

Parameters:

sub_id (str) – The subscription ID to get a list of workspaces from. If not provided it will attempt to get sub_id from config files.

Returns:

A dictionary of workspace names and ids

Return type:

Dict

get_subscription_info(sub_id: str) → dict

Get information on a specific subscription.

Parameters:

sub_id (str) – The ID of the subscription to return details on.

Returns:

Details on the selected subscription.

Return type:

dict

Raises:

MsticpyNotConnectedError – If .connect() has not been called.

get_subscriptions() → DataFrame

Get details of all subscriptions within the tenant.

Returns:

Details of the subscriptions present in the users tenant.

Return type:

pd.DataFrame

Raises:

MsticpyNotConnectedError – If .connect() has not been called

classmethod get_workspace_details_from_url(portal_url: str) → dict[str, dict[str, str]]

Return workspace settings from portal URL.

Parameters:

portal_url (str) – URL from Sentinel Azure portal

Return type:

dict[str, dict[str, str]]

classmethod get_workspace_id(workspace_name: str, subscription_id: str = '', resource_group: str = '') → str | None

Return the workspace ID given workspace name.

Parameters:

  • workspace_name (str) – Workspace name (case insensitive)

  • subscription_id (str, optional) – Azure subscription UUID, by default “”

  • resource_group (str, optional) – Azure resource group name, by default “”

Returns:

The ID of the workspace if found, else None

Return type:

Optional[str]

classmethod get_workspace_name(workspace_id: str | None = None, resource_id: str | None = None) → str | None

Return resolved name from workspace ID or resource ID.

Parameters:

  • workspace_id (Optional[str], optional) – The UUID of the Sentinel workspace, by default None

  • resource_id (Optional[str], optional) – The Resource ID string of the workspace, by default None

Returns:

The workspace name, if found, else None

Return type:

Optional[str]

Raises:

ValueError – If neither workspace_id or resource_id parameters are supplied.

classmethod get_workspace_settings(workspace_id: str | None = None, resource_id: str | None = None) → dict[str, Any]

Return resolved workspace settings from workspace ID or resource ID.

Parameters:

  • workspace_id (Optional[str], optional) – The UUID of the Sentinel workspace, by default None

  • resource_id (Optional[str], optional) – The Resource ID string of the workspace, by default None

Returns:

The workspace name, if found, else None

Return type:

dict[str, str]

Raises:

ValueError – If neither workspace_id or resource_id parameters are supplied.

classmethod get_workspace_settings_by_name(workspace_name: str, subscription_id: str = '', resource_group: str = '') → dict[str, Any]

Return the workspace ID given workspace name.

Parameters:

  • workspace_name (str) – Workspace name (case insensitive)

  • subscription_id (str, optional) – Azure subscription UUID, by default “”

  • resource_group (str, optional) – Azure resource group name, by default “”

Returns:

The ID of the workspace if found, else None

Return type:

Optional[str]

list_sentinel_workspaces(sub_id: str) → dict[str, str]

Return a list of Microsoft Sentinel workspaces in a Subscription.

Parameters:

sub_id (str) – The subscription ID to get a list of workspaces from. If not provided it will attempt to get sub_id from config files.

Returns:

A dictionary of workspace names and ids

Return type:

Dict