msticpy.data.drivers.sentinel_query_reader module

Github Sentinel Query repo import class and helpers.

class msticpy.data.drivers.sentinel_query_reader.SentinelQuery(query_id: str = NOTHING, name: str = NOTHING, description: str = NOTHING, severity: str = NOTHING, query_frequency: str = NOTHING, query_period: str = NOTHING, trigger_operator: str = NOTHING, trigger_threshold: str = NOTHING, version: str = NOTHING, kind: str = NOTHING, folder_name: str = NOTHING, source_file_name: str = NOTHING, query_type: str = NOTHING, tactics: list = NOTHING, relevant_techniques: list = NOTHING, query: str = NOTHING, entity_mappings: dict = NOTHING, custom_details: dict = NOTHING, alert_details_override: dict = NOTHING, tags: list = NOTHING, required_data_connectors: dict = NOTHING)

Bases: object

Attrs class that represents a Sentinel Query yaml file.

Method generated by attrs for class SentinelQuery.

alert_details_override: dict
custom_details: dict
description: str
entity_mappings: dict
folder_name: str
kind: str
name: str
query: str
query_frequency: str
query_id: str
query_period: str
query_type: str
relevant_techniques: list
required_data_connectors: dict
severity: str
source_file_name: str
tactics: list
tags: list
trigger_operator: str
trigger_threshold: str
version: str
msticpy.data.drivers.sentinel_query_reader.download_and_write_sentinel_queries(query_type: str, yaml_output_folder: str, github_outputdir: str | None = None)

Download queries from GitHub and write out YAML files for the given query type.

Parameters:

  • query_type (str) – Either “Hunting Queries” or “Detections” or otherwise named query category

  • yaml_output_folder (str) – Path to the folder you want the new generated YAML files to be stored in

  • github_outputdir (Optional[str]) – Path to the directory you want the Github download to be stored in

msticpy.data.drivers.sentinel_query_reader.get_sentinel_queries_from_github(git_url: str | None = 'https://github.com/Azure/Azure-Sentinel/archive/master.zip', outputdir: str | None = None) → bool

Download Microsoft Sentinel Github archive and extract detection and hunting queries.

Parameters:

  • git_url (str, optional) – URL of the GIT Repository to be downloaded, by default “https://github.com/Azure/Azure-Sentinel/archive/master.zip”

  • outputdir (str, optional) – Provide absolute path to the output folder to save downloaded archive (e.g. ‘/usr/home’ or ‘C:downloads’). If no path provided, it will download to .msticpy dir under Azure-Sentinel directory.

msticpy.data.drivers.sentinel_query_reader.import_sentinel_queries(yaml_files: dict, query_type: str) → list

Create list of SentinelQuery attr objects.

Parameters:

  • yaml_files (dict) – Dictionary mapping query file addresses to yaml file text created by read_yaml_files

  • query_type (str) – Either “Hunting Queries” or “Detections” or otherwise named query category

Returns:

Returns a list of SentinelQuery attr objects from a dict of yaml files and query type given

Return type:

list

msticpy.data.drivers.sentinel_query_reader.read_yaml_files(parent_dir: str, child_dir: str) → dict

Create dictionary mapping query file paths with the yaml file text each contains.

Parameters:

  • parent_dir (str) – Directory storing the Hunting and Detections directories

  • child_dir (str) – Either “Hunting Queries” or “Detections” or otherwise named query category

Returns:

Dictionary mapping query file paths to corresponding yaml file text in the parent_dir/child_dir specified. Only identifies .yaml files.

Return type:

dict

msticpy.data.drivers.sentinel_query_reader.write_to_yaml(query_list: list, query_type: str, output_folder: str) → bool

Write out generated YAML files of the given query_list into the given output_folder.

Parameters:

  • query_list (list) – List of SentinelQuery attr objects generated by import_sentinel_queries()

  • query_type (str) – Either “Hunting Queries” or “Detections” or otherwise named query category

  • output_folder (str) – The name of the folder you want the written YAML files to be stored in

Returns:

True if succeeded; False if an error occurred

Return type:

bool