msticpy.data.drivers.security_graph_driver module

Security Graph OData Driver class.

class msticpy.data.drivers.security_graph_driver.SecurityGraphDriver(connection_str: str | None = None, **kwargs)

Bases: OData

Driver to query security graph.

Instantiate MSGraph driver and optionally connect.

Parameters:

connection_str (str, optional) – Connection string

CONFIG_NAME = 'MicrosoftGraph'
add_query_filter(name: str, query_filter: str | Iterable)

Add an expression to the query attach filter.

api_root: str | None
api_ver: str | None
connect(connection_str: str | None = None, **kwargs)

Connect to oauth data source.

Parameters:
  • connection_str (Optional[str], optional) – Connect to a data source

  • instance (Optional[str], optional) – Optional name of configuration instance - this is added as a prefix to the driver configuration key name when searching for configuration in the msticpyconfig.yaml

Notes

Connection string fields: tenant_id client_id client_secret apiRoot apiVersion

property connected: bool

Return true if at least one connection has been made.

Returns:

True if a successful connection has been made.

Return type:

bool

Notes

This does not guarantee that the last data source connection was successful. It is a best effort to track whether the provider has made at least one successful authentication.

property driver_queries: Iterable[Dict[str, Any]]

Return queries retrieved from the service after connecting.

Returns:

List of Dictionary of query_name, query_text. Name of container to add queries to.

Return type:

List[Dict[str, str]]

get_driver_property(name: str) Any

Return value or KeyError from driver properties.

static get_http_timeout(**kwargs)

Get http timeout from settings or kwargs.

property instance: str | None

Return instance name, if one is set.

Returns:

The name of driver instance or None if the driver does not support multiple instances

Return type:

Optional[str]

property loaded: bool

Return true if the provider is loaded.

Returns:

True if the provider is loaded.

Return type:

bool

Notes

This is not relevant for some providers.

oauth_url: str | None
query(query: str, query_source: QuerySource | None = None, **kwargs) DataFrame | Any

Execute query string and return DataFrame of results.

Parameters:
  • query (str) – The query to execute

  • query_source (QuerySource) – The query definition object

Returns:

A DataFrame (if successful) or the underlying provider result if an error.

Return type:

Union[pd.DataFrame, results.ResultSet]

property query_attach_spec: Dict[str, Set[str]]

Parameters that determine whether a query is relevant for the driver.

query_usable(query_source: QuerySource) bool

Return True if query should be exposed for this driver.

query_with_results(query: str, **kwargs) Tuple[DataFrame, Any]

Execute query string and return DataFrame of results.

Parameters:

query (str) – The kql query to execute

Returns:

A DataFrame (if successful) and Kql ResultSet.

Return type:

Tuple[pd.DataFrame, results.ResultSet]

req_body: Dict[str, str | None] | None
request_uri: str | None
property schema: Dict[str, Dict]

Return current data schema of connection.

Returns:

Data schema of current connection.

Return type:

Dict[str, Dict]

property service_queries: Tuple[Dict[str, str], str]

Return queries retrieved from the service after connecting.

Returns:

Dictionary of query_name, query_text. Name of container to add queries to.

Return type:

Tuple[Dict[str, str], str]

set_driver_property(name: str, value: Any)

Set an item in driver properties.