msticpy API

• Guide to Reading the API Reference
  • API Documentation Structure
  • Type Annotations
    • Mapping
    • Iterable
    • Optional
    • Union
    • Any
  • References
• msticpy package
  • Getting Started
  • Package structure
  • Configuration
  • Initialization
  • Subpackages
    • msticpy.analysis package
      • Subpackages
        • msticpy.analysis.anomalous_sequence package
          • Subpackages
          • Submodules
      • Submodules
        • msticpy.analysis.cluster_auditd module
          • cluster_auditd_processes()
        • msticpy.analysis.code_cleanup module
          • format_powershell()
        • msticpy.analysis.eventcluster module
          • add_process_features()
          • char_ord_score()
          • char_ord_score_df()
          • crc32_hash()
          • crc32_hash_df()
          • dbcluster_events()
          • delim_count()
          • delim_count_df()
          • delim_hash()
          • plot_cluster()
          • token_count()
          • token_count_df()
        • msticpy.analysis.observationlist module
          • Observation
          • Observations
        • msticpy.analysis.outliers module
          • identify_outliers()
          • plot_outlier_results()
          • remove_common_items()
        • msticpy.analysis.polling_detection module
          • PeriodogramPollingDetector
        • msticpy.analysis.syslog_utils module
          • cluster_syslog_logons_df()
          • create_host_record()
          • risky_sudo_sessions()
        • msticpy.analysis.timeseries module
          • MsticpyTimeSeriesAccessor
          • create_time_period_kqlfilter()
          • extract_anomaly_periods()
          • find_anomaly_periods()
          • set_new_anomaly_threshold()
          • timeseries_anomalies_stl()
          • ts_anomalies_stl()
    • msticpy.auth package
      • Submodules
        • msticpy.auth.azure_auth module
          • az_connect()
          • az_user_connect()
          • fallback_devicecode_creds()
          • get_default_resource_name()
        • msticpy.auth.azure_auth_core module
          • AzCredentials
          • AzureCliStatus
          • AzureCredEnvNames
          • az_connect_core()
          • check_cli_credentials()
          • list_auth_methods()
          • only_interactive_cred()
        • msticpy.auth.cloud_mappings module
          • AzureCloudConfig
          • create_cloud_ep_dict()
          • create_cloud_suf_dict()
          • default_auth_methods()
          • get_all_endpoints()
          • get_all_suffixes()
          • get_azure_config_value()
          • get_defender_endpoint()
          • get_m365d_endpoint()
        • msticpy.auth.cred_wrapper module
          • CredentialWrapper
        • msticpy.auth.keyring_client module
          • KeyringClient
        • msticpy.auth.keyvault_client module
          • BHKeyVaultClient
          • BHKeyVaultMgmtClient
        • msticpy.auth.keyvault_settings module
          • KeyVaultSettings
        • msticpy.auth.msal_auth module
          • MSALDelegatedAuth
        • msticpy.auth.secret_settings module
          • SecretsClient
    • msticpy.common package
      • Subpackages
        • msticpy.common.utility package
          • Submodules
      • Submodules
        • msticpy.common.azure_auth module
        • msticpy.common.check_version module
          • check_version()
        • msticpy.common.data_types module
          • ObjectContainer
        • msticpy.common.data_utils module
          • df_has_data()
          • ensure_df_datetimes()
        • msticpy.common.exceptions module
          • MsticpyAzureConfigError
          • MsticpyAzureConnectionError
          • MsticpyConfigError
          • MsticpyConnectionError
          • MsticpyDataQueryError
          • MsticpyException
          • MsticpyImportExtraError
          • MsticpyKeyVaultConfigError
          • MsticpyKeyVaultMissingSecretError
          • MsticpyKqlConnectionError
          • MsticpyMissingDependencyError
          • MsticpyNoDataSourceError
          • MsticpyNotConnectedError
          • MsticpyParameterError
          • MsticpyResourceError
          • MsticpyUserConfigError
          • MsticpyUserError
        • msticpy.common.pkg_config module
          • current_config_path()
          • get_config()
          • get_http_timeout()
          • get_settings()
          • has_config()
          • refresh_config()
          • set_config()
          • validate_config()
        • msticpy.common.provider_settings module
          • ProviderArgs
          • ProviderSettings
          • auth_secrets_client()
          • clear_keyring()
          • get_protected_setting()
          • get_provider_settings()
          • get_secrets_client_func()
          • refresh_keyring()
          • reload_settings()
        • msticpy.common.proxy_settings module
          • get_http_proxies()
        • msticpy.common.settings module
        • msticpy.common.timespan module
          • TimeSpan
        • msticpy.common.wsconfig module
          • WorkspaceConfig
    • msticpy.config package
      • Submodules
        • msticpy.config.ce_azure module
          • CEAzure
        • msticpy.config.ce_azure_sentinel module
          • CEAzureSentinel
        • msticpy.config.ce_common module
          • dict_to_txt()
          • get_def_tenant_id()
          • get_defn_or_default()
          • get_or_create_mpc_section()
          • get_wgt_ctrl()
          • print_debug()
          • py_to_widget()
          • txt_to_dict()
          • widget_to_py()
        • msticpy.config.ce_data_providers module
          • CEDataProviders
        • msticpy.config.ce_keyvault module
          • CEKeyVault
        • msticpy.config.ce_msticpy module
          • CEMsticpy
        • msticpy.config.ce_other_providers module
          • CEOtherProviders
        • msticpy.config.ce_provider_base module
          • CEProviders
        • msticpy.config.ce_simple_settings module
          • CESimpleSettings
        • msticpy.config.ce_ti_providers module
          • CETIProviders
        • msticpy.config.ce_user_defaults module
          • CEAutoLoadComps
          • CEAutoLoadQProvs
        • msticpy.config.comp_edit module
          • CEItemsBase
          • CompEditDisplayMixin
          • CompEditFrame
          • CompEditHelp
          • CompEditItemButtons
          • CompEditItems
          • CompEditSimple
          • CompEditStatusMixin
          • CompEditTabs
          • CompEditUtilsMixin
          • SettingsControl
        • msticpy.config.compound_ctrls module
          • ArgControl
          • UserDefLoadComponent
          • UserDefQryProvCtrl
          • get_arg_ctrl()
        • msticpy.config.file_browser module
          • FileBrowser
        • msticpy.config.mp_config_control module
          • MpConfigControls
          • ValidationResult
          • get_mpconfig_definitions()
        • msticpy.config.mp_config_edit module
          • MpConfigEdit
        • msticpy.config.mp_config_file module
          • MpConfigFile
        • msticpy.config.query_editor module
          • CustomChange
          • IPyDisplayMixin
          • MetadataEditWidget
          • QueryEditWidget
          • QueryEditor
          • QueryParameterEditWidget
          • box_layout()
          • load_queries_from_yaml()
          • replace_in_query()
          • save_queries_to_yaml()
          • sel_fmt()
          • txt_fmt()
          • txtarea_fmt()
    • msticpy.context package
      • Subpackages
        • msticpy.context.azure package
          • Submodules
        • msticpy.context.contextproviders package
          • Submodules
        • msticpy.context.tiproviders package
          • Submodules
        • msticpy.context.vtlookupv3 package
          • Submodules
      • Submodules
        • msticpy.context.contextlookup module
          • ContextLookup
        • msticpy.context.domain_utils module
          • DomainValidator
          • dns_components()
          • dns_resolve()
          • dns_resolve_df()
          • ip_rev_resolve()
          • ip_rev_resolve_df()
          • screenshot()
          • url_components()
        • msticpy.context.geoip module
          • GeoIPDatabaseError
          • GeoIpLookup
          • IPStackLookup
          • entity_distance()
          • geo_distance()
        • msticpy.context.http_provider module
          • APILookupParams
          • HttpProvider
        • msticpy.context.ip_utils module
          • IpWhoisAccessor
          • convert_to_ip_entities()
          • create_ip_record()
          • get_asn_details()
          • get_asn_from_ip()
          • get_asn_from_name()
          • get_ip_type()
          • get_whois_df()
          • get_whois_info()
          • ip_whois()
        • msticpy.context.lookup module
          • Lookup
          • ProgressCounter
        • msticpy.context.lookup_result module
          • LookupStatus
          • SanitizedObservable
        • msticpy.context.preprocess_observable module
          • PreProcessor
          • get_schema_and_host()
          • preprocess_observable()
        • msticpy.context.provider_base module
          • PivotProvider
          • Provider
          • generate_items()
        • msticpy.context.tilookup module
          • TILookup
    • msticpy.data package
      • Subpackages
        • msticpy.data.azure package
          • Submodules
        • msticpy.data.core package
          • Submodules
        • msticpy.data.drivers package
          • import_driver()
          • Submodules
        • msticpy.data.storage package
          • Submodules
        • msticpy.data.uploaders package
          • Submodules
      • Submodules
        • msticpy.data.azure_blob_storage module
        • msticpy.data.azure_data module
        • msticpy.data.azure_sentinel module
        • msticpy.data.data_obfus module
          • ObfuscationAccessor
          • check_masking()
          • check_obfuscation()
          • hash_account()
          • hash_dict()
          • hash_ip()
          • hash_item()
          • hash_list()
          • hash_sid()
          • hash_string()
          • mask_df()
          • obfuscate_df()
          • replace_guid()
        • msticpy.data.data_providers module
        • msticpy.data.query_container module
        • msticpy.data.query_defns module
        • msticpy.data.sql_to_kql module
    • msticpy.datamodel package
      • Subpackages
        • msticpy.datamodel.entities package
          • find_entity()
          • Submodules
        • msticpy.datamodel.soc package
          • Submodules
      • Submodules
        • msticpy.datamodel.pivot module
    • msticpy.init package
      • Subpackages
        • msticpy.init.pivot_core package
          • Submodules
        • msticpy.init.pivot_init package
          • Submodules
      • Submodules
        • msticpy.init.azure_ml_tools module
          • check_aml_settings()
          • check_mp_ver()
          • check_python_ver()
          • check_versions()
          • get_aml_user_folder()
          • is_in_aml()
          • populate_config_to_mp_config()
        • msticpy.init.azure_synapse_tools module
        • msticpy.init.logging module
          • LoggingConfig
          • set_logging_level()
          • setup_logging()
        • msticpy.init.mp_pandas_accessors module
          • MsticpyCoreAccessor
        • msticpy.init.mp_plugins module
          • msticpyconfig.yaml
          • PluginReg
          • load_plugins_from_path()
          • read_plugins()
        • msticpy.init.nbinit module
        • msticpy.init.nbmagics module
        • msticpy.init.pivot module
        • msticpy.init.user_config module
          • load_user_defaults()
    • msticpy.nbtools package
      • Submodules
        • msticpy.nbtools.data_viewer module
        • msticpy.nbtools.entityschema module
        • msticpy.nbtools.foliummap module
        • msticpy.nbtools.morph_charts module
        • msticpy.nbtools.nbdisplay module
        • msticpy.nbtools.nbwidgets module
        • msticpy.nbtools.observationlist module
        • msticpy.nbtools.process_tree module
        • msticpy.nbtools.security_alert module
          • SecurityAlert
        • msticpy.nbtools.security_alert_graph module
          • add_related_alerts()
          • create_alert_graph()
        • msticpy.nbtools.security_base module
          • SecurityBase
        • msticpy.nbtools.security_event module
          • SecurityEvent
        • msticpy.nbtools.ti_browser module
        • msticpy.nbtools.timeline module
        • msticpy.nbtools.timeline_duration module
        • msticpy.nbtools.timeline_pd_accessor module
        • msticpy.nbtools.timeseries module
        • msticpy.nbtools.utility module
        • msticpy.nbtools.wsconfig module
    • msticpy.nbwidgets package
      • Submodules
        • msticpy.nbwidgets.core module
          • IPyDisplayMixin
          • RegisteredWidget
          • TimeUnit
          • default_before_after()
          • default_max_buffer()
          • parse_time_unit()
        • msticpy.nbwidgets.get_environment_key module
          • GetEnvironmentKey
        • msticpy.nbwidgets.get_text module
          • GetText
        • msticpy.nbwidgets.lookback module
          • Lookback
        • msticpy.nbwidgets.option_buttons module
          • OptionButtons
        • msticpy.nbwidgets.progress module
          • Progress
        • msticpy.nbwidgets.query_time module
          • QueryTime
        • msticpy.nbwidgets.select_alert module
          • AlertSelector
          • SelectAlert
        • msticpy.nbwidgets.select_item module
          • SelectItem
          • SelectString
        • msticpy.nbwidgets.select_subset module
          • SelectSubset
    • msticpy.transform package
      • Submodules
        • msticpy.transform.auditdextract module
          • extract_events_to_df()
          • generate_process_tree()
          • get_event_subset()
          • read_from_file()
          • unpack_auditd()
        • msticpy.transform.base64unpack module
          • B64ExtractAccessor
          • BinaryRecord
          • get_hashes()
          • get_items_from_gzip()
          • get_items_from_tar()
          • get_items_from_zip()
          • unpack()
          • unpack_df()
          • unpack_items()
        • msticpy.transform.cmd_line module
          • cmd_speed()
          • risky_cmd_line()
        • msticpy.transform.iocextract module
          • IoCExtract
          • IoCExtractAccessor
          • IoCPattern
          • IoCType
        • msticpy.transform.network module
          • df_to_networkx()
        • msticpy.transform.proc_tree_build_mde module
          • convert_mde_schema_to_internal()
          • extract_process_tree()
        • msticpy.transform.proc_tree_build_winlx module
          • extract_process_tree()
        • msticpy.transform.proc_tree_builder module
          • build_proc_tree()
          • build_process_tree()
          • infer_schema()
        • msticpy.transform.proc_tree_schema module
          • ColNames
          • ProcSchema
          • ProcessTreeSchemaException
        • msticpy.transform.process_tree_utils module
          • TemplateLine
          • get_ancestors()
          • get_children()
          • get_descendents()
          • get_parent()
          • get_process()
          • get_process_key()
          • get_root()
          • get_root_tree()
          • get_roots()
          • get_siblings()
          • get_summary_info()
          • get_tree_depth()
          • tree_to_text()
    • msticpy.vis package
      • Submodules
        • msticpy.vis.code_view module
          • display_html()
          • list_pygments_styles()
          • to_html()
        • msticpy.vis.data_viewer module
          • DataTableColumnChooser
          • DataTableFilter
          • DataViewerBokeh
          • FilterExpr
        • msticpy.vis.data_viewer_panel module
          • DataTableColumnChooser
          • DataViewer
        • msticpy.vis.entity_graph_tools module
          • EntityGraph
          • plot_entitygraph()
        • msticpy.vis.figure_dimension module
          • bokeh_figure()
          • set_figure_size()
        • msticpy.vis.foliummap module
          • FoliumMap
          • decode_geo_hash()
          • decode_geohash_collection()
          • get_center_geo_locs()
          • get_center_ip_entities()
          • get_map_center()
          • plot_map()
        • msticpy.vis.matrix_plot module
          • PlotParams
          • plot_matrix()
        • msticpy.vis.mordor_browser module
          • MordorBrowser
        • msticpy.vis.morph_charts module
          • MorphCharts
        • msticpy.vis.mp_pandas_plot module
          • MsticpyPlotAccessor
        • msticpy.vis.nbdisplay module
          • display_alert()
          • display_logon_data()
          • draw_alert_entity_graph()
          • exec_remaining_cells()
          • format_alert()
          • format_logon()
        • msticpy.vis.network_plot module
          • plot_entity_graph()
          • plot_nx_graph()
        • msticpy.vis.process_tree module
          • ProcessTreeAccessor
          • TreeResult
          • build_and_show_process_tree()
          • plot_process_tree()
        • msticpy.vis.query_browser module
          • browse_queries()
        • msticpy.vis.ti_browser module
          • browse_results()
          • get_ti_select_options()
          • raw_results()
          • ti_details_display()
        • msticpy.vis.timeline module
          • PlotParams
          • display_timeline()
        • msticpy.vis.timeline_common module
          • calc_auto_plot_height()
          • check_df_columns()
          • create_data_grouping()
          • create_range_tool()
          • create_tool_tips()
          • get_color_palette()
          • get_def_source_cols()
          • get_ref_event_time()
          • get_tick_formatter()
          • get_time_bounds()
          • plot_ref_events()
          • plot_ref_line()
          • set_axes_and_grids()
        • msticpy.vis.timeline_duration module
          • PlotParams
          • display_timeline_duration()
        • msticpy.vis.timeline_pd_accessor module
          • TimeLineAccessor
        • msticpy.vis.timeline_values module
          • PlotParams
          • display_timeline_values()
        • msticpy.vis.timeseries module
          • display_timeseries_anomalies()
          • display_timeseries_anomolies()
        • msticpy.vis.vtobject_browser module
          • VTObjectBrowser