msticpy.analysis package

MSTICPy Analysis Tools.

This sub-package has a few classes of analysis tools:

• data - this sub-package contains data-processing tools for dealing with tranforming data (e.g. auditd, process tree) or extracting specific data formats (iocextract, b64, cmdline)

• other items are miscellaneous analysis modules such anomalous sequence, time series, eventcluster.

Subpackages

• msticpy.analysis.anomalous_sequence package
  • Subpackages
    • msticpy.analysis.anomalous_sequence.utils package
      • Submodules
  • Submodules
    • msticpy.analysis.anomalous_sequence.anomalous module
      • score_and_visualise_sessions()
      • score_sessions()
      • visualise_scored_sessions()
    • msticpy.analysis.anomalous_sequence.model module
      • Model
      • SessionType
    • msticpy.analysis.anomalous_sequence.sessionize module
      • create_session_col()
      • sessionize_data()

Submodules

• msticpy.analysis.cluster_auditd module
  • cluster_auditd_processes()
• msticpy.analysis.code_cleanup module
  • format_powershell()
• msticpy.analysis.eventcluster module
  • add_process_features()
  • char_ord_score()
  • char_ord_score_df()
  • crc32_hash()
  • crc32_hash_df()
  • dbcluster_events()
  • delim_count()
  • delim_count_df()
  • delim_hash()
  • plot_cluster()
  • token_count()
  • token_count_df()
• msticpy.analysis.observationlist module
  • Observation
    • Observation.additional_properties
    • Observation.all_fields()
    • Observation.caption
    • Observation.data
    • Observation.data_type
    • Observation.description
    • Observation.display()
    • Observation.filter
    • Observation.filtered_data
    • Observation.link
    • Observation.required_fields()
    • Observation.schema
    • Observation.score
    • Observation.tags
    • Observation.time_column
    • Observation.time_span
    • Observation.timestamp
  • Observations
    • Observations.add_observation()
    • Observations.display_observations()
    • Observations.observations
• msticpy.analysis.outliers module
  • identify_outliers()
  • plot_outlier_results()
  • remove_common_items()
• msticpy.analysis.polling_detection module
  • PeriodogramPollingDetector
    • PeriodogramPollingDetector.data
    • PeriodogramPollingDetector.detect_polling()
• msticpy.analysis.syslog_utils module
  • cluster_syslog_logons_df()
  • create_host_record()
  • risky_sudo_sessions()
• msticpy.analysis.timeseries module
  • MsticpyTimeSeriesAccessor
    • MsticpyTimeSeriesAccessor.analyze()
    • MsticpyTimeSeriesAccessor.anomaly_periods()
    • MsticpyTimeSeriesAccessor.apply_threshold()
    • MsticpyTimeSeriesAccessor.kql_periods()
    • MsticpyTimeSeriesAccessor.plot()
  • create_time_period_kqlfilter()
  • extract_anomaly_periods()
  • find_anomaly_periods()
  • set_new_anomaly_threshold()
  • timeseries_anomalies_stl()
  • ts_anomalies_stl()