msticpy.data package

Data sub-package.

This sub-package contains data-access related modules and sub-packages.

It is split into the following sub-packages:

• azure - Azure and MS Sentinel API related modules

• browsers - notebook interactive data browsers for various components such as Threat Intel, Data Queries

• context - context provider modules such as TI providers, geoip providers

• core - core data query provider components

• drivers - query provider interface drivers for external data sources.

• queries - queries for core data providers

• uploaders - loaders for some data services.

Subpackages

• msticpy.data.azure package
  • Submodules
    • msticpy.data.azure.azure_blob_storage module
    • msticpy.data.azure.azure_data module
• msticpy.data.core package
  • Submodules
    • msticpy.data.core.data_providers module
      • QueryProvider
    • msticpy.data.core.data_query_reader module
      • find_yaml_files()
      • read_query_def_file()
      • validate_query_defs()
    • msticpy.data.core.param_extractor module
      • extract_query_params()
    • msticpy.data.core.query_container module
      • QueryContainer
    • msticpy.data.core.query_defns module
      • DataEnvironment
      • DataFamily
      • Formatters
      • QueryParamProvider
    • msticpy.data.core.query_provider_connections_mixin module
      • QueryProviderConnectionsMixin
      • QueryProviderProtocol
    • msticpy.data.core.query_provider_utils_mixin module
      • QueryParam
      • QueryProviderProtocol
      • QueryProviderUtilsMixin
    • msticpy.data.core.query_source module
      • QuerySource
    • msticpy.data.core.query_store module
      • QueryStore
    • msticpy.data.core.query_template module
      • Query
      • QueryArgs
      • QueryCollection
      • QueryDefaults
      • QueryMetadata
      • QueryParameter
• msticpy.data.drivers package
  • import_driver()
  • Submodules
    • msticpy.data.drivers.azure_kusto_driver module
      • AuthParams
      • AzureKustoDriver
      • KFields
      • KustoConfig
      • QuerySourceFields
      • get_cluster_name()
    • msticpy.data.drivers.azure_monitor_driver module
      • AzureMonitorDriver
    • msticpy.data.drivers.cybereason_driver module
      • CybereasonDriver
    • msticpy.data.drivers.driver_base module
      • DriverBase
      • DriverProps
    • msticpy.data.drivers.elastic_driver module
      • ElasticDriver
    • msticpy.data.drivers.kql_driver module
      • KqlDriver
    • msticpy.data.drivers.kusto_driver module
      • KustoDriver
    • msticpy.data.drivers.local_data_driver module
      • LocalDataDriver
    • msticpy.data.drivers.local_osquery_driver module
      • OSQueryLogDriver
    • msticpy.data.drivers.local_velociraptor_driver module
      • VelociraptorLogDriver
    • msticpy.data.drivers.mdatp_driver module
      • MDATPDriver
    • msticpy.data.drivers.mordor_driver module
      • MitreAttack
      • MordorDriver
      • MordorEntry
      • download_mdr_file()
      • get_mdr_data_paths()
      • search_mdr_data()
    • msticpy.data.drivers.odata_driver module
      • OData
    • msticpy.data.drivers.resource_graph_driver module
      • ResourceGraphDriver
    • msticpy.data.drivers.security_graph_driver module
      • SecurityGraphDriver
    • msticpy.data.drivers.sentinel_query_reader module
      • SentinelQuery
      • download_and_write_sentinel_queries()
      • get_sentinel_queries_from_github()
      • import_sentinel_queries()
      • read_yaml_files()
      • write_to_yaml()
    • msticpy.data.drivers.splunk_driver module
    • msticpy.data.drivers.sumologic_driver module
      • SumologicDriver
• msticpy.data.storage package
  • Submodules
    • msticpy.data.storage.azure_blob_storage module
      • AzureBlobStorage
• msticpy.data.uploaders package
  • Submodules
    • msticpy.data.uploaders.loganalytics_uploader module
      • LAUploader
    • msticpy.data.uploaders.splunk_uploader module
    • msticpy.data.uploaders.uploader_base module
      • UploaderBase

Submodules

• msticpy.data.azure_blob_storage module
• msticpy.data.azure_data module
• msticpy.data.azure_sentinel module
• msticpy.data.data_obfus module
  • ObfuscationAccessor
    • ObfuscationAccessor.mask()
  • check_masking()
  • check_obfuscation()
  • hash_account()
  • hash_dict()
  • hash_ip()
  • hash_item()
  • hash_list()
  • hash_sid()
  • hash_string()
  • mask_df()
  • obfuscate_df()
  • replace_guid()
• msticpy.data.data_providers module
• msticpy.data.query_container module
• msticpy.data.query_defns module
• msticpy.data.sql_to_kql module