Microsoft Sentinel APIs
- Microsoft Sentinel Analytics
- Microsoft Sentinel Bookmarks
- Microsoft Sentinel Incidents
- Microsoft Sentinel Watchlists
This package contains functionality making calls to Microsoft Sentinel directly. These can be used to get data from Microsoft Sentinel, as well as perform configuration and other actions on the Microsoft Sentinel Workspace
Microsoft Sentinel API documentation
The first step in using this package is to install the msticpy package.
!pip install msticpy --upgrade --user
Collecting msticpy Building wheels for collected packages: msticpy Building wheel for msticpy (setup.py): started Building wheel for msticpy (setup.py): finished with status 'done' Successfully built msticpy Installing collected packages: msticpy Successfully installed msticpy-0.3.0
#imports from msticpy.data.azure.azure import AzureData, MicrosoftSentinel print('Imports Complete')
Instantiating and Connecting the Microsoft Sentinel API Connector
When instantiating the class you need to pass it details of the Sentinel workspace you want to interact with. This can be provided as a complete resource ID, e.g.
Alternatively you can provide the Subscription ID, Resource Group name and Workspace name seperately and let the class build the resource ID for you. Alternatively you can provide the Subscription ID, Resource Group name and Workspace name. e.g.
MicrosoftSentinel(sub_id="fdee8146-8bcf-460f-86f3-3f788c285efd" res_grp="myRG", ws_name="myWorkspace")
If no workspace details are provided it will attempt to use default workspace details from your config file.
You can also specify a specific Azure Cloud if your workspace isn’t in Azure’s public cloud.
In order to connect to the Microsoft Sentinel API and retrieve the required data we need to instantiate the MicrosoftSentinel class and authenticate to Azure. Authentication to the Microsoft Sentinel API is handled via an the azure_auth package.
By default [‘env’, ‘cli’, ‘msi’, ‘interactive’] is used but you can provide an alternative list to .connect via the auth_methods parameter.
azs = MicrosoftSentinel() azs.connect(auth_methods=['cli','interactive'])
Get Microsoft Sentinel Workspaces
If you want to see Sentinel workspace in a subscription you can call list_sentinel_workspaces.
list_sentinel_workspaces returns a list of Microsoft Sentinel workspaces within
a specified subscription.
this will only return workspaces that the authenticated account is permitted to view.
It is possible to get details of, update, and create Incidents via the MicrosoftSentinel connector. Details on working with Incidents can be found in Sentinel Incidents
You can return a dataframe detailing all hunting queries configured in the workspace. This allows for analysis and configuration of hunting queries, as well as the ability to take a hunting query and run it with a QueryProvider.
You can interact with Analytics and Analytic templates, including creating new analytics via this feature. More details can be found in Sentinel Analytics
You can interact with Bookmarks, including creating new bookmarks and deleting existing bookmarks via this feature. More details can be found in Sentinel Bookmarks
You can interact with Watchlists, including creating new watchlists and adding items to a watchlist via this feature. More details can be found in Sentinel Watchlists