Querying and Importing Data

• Data Provider Library
  • Description:
  • Instantiating a Query Provider
  • Connecting to a Data Environment
  • Connecting to an Azure Sentinel Workspace
  • Connecting to an OData Source
  • Using Local Data - the LocalData provider
  • Listing available queries
  • Running a pre-defined query
  • Running an ad hoc query
  • Splitting Query Execution into Chunks
  • Creating new queries
  • Adding a new set of queries and running them
• Data Queries Reference
  • Queries for AzureSentinel
  • Queries for LocalData
  • Queries for MDE
  • Queries for SecurityGraph
  • Queries for Splunk
• Setting up Process Auditing for Linux in Azure Sentinel
  • Add your Linux VMs to the Log Analytics Workspace
  • Configure Auditing on your Linux VMs
  • Add Auditd as a Custom log in Log Analytics
  • Reading Audit Data from Log Analytics
• Data Uploaders
  • Uploading data to Azure Sentinel/Log Analytics
  • Uploading data to Splunk
• Data Masking Functions
  • Import the module
  • Individual Masking Functions
  • Masking DataFrames
  • Creating custom mappings
  • Using hash_item to preserve the structure/look of the hashed input
  • Checking Your Masking Results
• Splunk - Data Connector
  • Description
  • Instantiating a query provider
  • Listing available queries
  • Running pre-defined queries
  • Running an ad hoc Splunk query
  • References
• Mordor data provider and browser
  • Using the Data Provider to download datasets
  • Mordor Browser
• Reading from and writing to Azure Blob AzureBlobStorage
  • Description
  • Import the module
  • Initialize the class and connect
  • List Containers
  • Create a Container
  • List Blobs
  • Write to a Blob
  • Read from a Blob
  • Delete a Blob
  • Generate a SAS Token for a Blob
• SQL TO KQL Conversion (Experimental)
  • Caveat Emptor!
  • Simple SQL Query
  • SQL Joins
  • Table Renaming
  • Join with Aliases
  • Unions and Group By
  • Aliased and Calculated Select Columns