msticpy.transform package

MSTICPy Data Processing Tools.

Submodules

• msticpy.transform.auditdextract module
  • extract_events_to_df()
  • generate_process_tree()
  • get_event_subset()
  • read_from_file()
  • unpack_auditd()
• msticpy.transform.base64unpack module
  • B64ExtractAccessor
    • B64ExtractAccessor.extract()
  • BinaryRecord
    • BinaryRecord.count()
    • BinaryRecord.decoded_string
    • BinaryRecord.encoding_type
    • BinaryRecord.file_hashes
    • BinaryRecord.file_name
    • BinaryRecord.file_type
    • BinaryRecord.index()
    • BinaryRecord.input_bytes
    • BinaryRecord.md5
    • BinaryRecord.original_string
    • BinaryRecord.printable_bytes
    • BinaryRecord.reference
    • BinaryRecord.sha1
    • BinaryRecord.sha256
  • get_hashes()
  • get_items_from_gzip()
  • get_items_from_tar()
  • get_items_from_zip()
  • unpack()
  • unpack_df()
  • unpack_items()
• msticpy.transform.cmd_line module
  • cmd_speed()
  • risky_cmd_line()
• msticpy.transform.iocextract module
  • IoCExtract
    • IoCExtract.DF_AT
    • IoCExtract.DNS_DF_REGEX
    • IoCExtract.DNS_REGEX
    • IoCExtract.EMAIL_DF_REGEX
    • IoCExtract.EMAIL_REGEX
    • IoCExtract.EMAIL_USER_REGEX
    • IoCExtract.IPV4_DF_REGEX
    • IoCExtract.IPV4_REGEX
    • IoCExtract.IPV6_REGEX
    • IoCExtract.LXPATH_REGEX
    • IoCExtract.LXSTDPATH_REGEX
    • IoCExtract.MD5_REGEX
    • IoCExtract.SHA1_REGEX
    • IoCExtract.SHA256_REGEX
    • IoCExtract.URL_DF_REGEX
    • IoCExtract.URL_REGEX
    • IoCExtract.WINPATH_REGEX
    • IoCExtract.add_ioc_type()
    • IoCExtract.extract()
    • IoCExtract.extract_df()
    • IoCExtract.file_hash_type()
    • IoCExtract.get_ioc_type()
    • IoCExtract.ioc_df_types
    • IoCExtract.ioc_types
    • IoCExtract.validate()
  • IoCExtractAccessor
    • IoCExtractAccessor.extract()
  • IoCPattern
    • IoCPattern.comp_regex
    • IoCPattern.group
    • IoCPattern.ioc_type
    • IoCPattern.priority
  • IoCType
    • IoCType.dns
    • IoCType.email
    • IoCType.file_hash
    • IoCType.hostname
    • IoCType.ipv4
    • IoCType.ipv6
    • IoCType.linux_path
    • IoCType.md5_hash
    • IoCType.parse()
    • IoCType.sha1_hash
    • IoCType.sha256_hash
    • IoCType.unknown
    • IoCType.url
    • IoCType.windows_path
• msticpy.transform.network module
  • df_to_networkx()
• msticpy.transform.proc_tree_build_mde module
  • convert_mde_schema_to_internal()
  • extract_process_tree()
• msticpy.transform.proc_tree_build_winlx module
  • extract_process_tree()
• msticpy.transform.proc_tree_builder module
  • build_proc_tree()
  • build_process_tree()
  • infer_schema()
• msticpy.transform.proc_tree_schema module
  • ColNames
    • ColNames.EffectiveLogonId
    • ColNames.EffectiveLogonId_par
    • ColNames.new_process_lc
    • ColNames.new_process_lc_par
    • ColNames.parent_key
    • ColNames.parent_proc_lc
    • ColNames.proc_key
    • ColNames.source_index
    • ColNames.source_index_par
    • ColNames.timestamp_orig_par
  • ProcSchema
    • ProcSchema.blank_schema_dict()
    • ProcSchema.cmd_line
    • ProcSchema.column_map
    • ProcSchema.columns
    • ProcSchema.event_filter
    • ProcSchema.event_id_column
    • ProcSchema.event_id_identifier
    • ProcSchema.event_type_col
    • ProcSchema.get_df_cols()
    • ProcSchema.host_name
    • ProcSchema.host_name_column
    • ProcSchema.logon_id
    • ProcSchema.parent_id
    • ProcSchema.parent_name
    • ProcSchema.path_separator
    • ProcSchema.process_id
    • ProcSchema.process_name
    • ProcSchema.required_columns
    • ProcSchema.target_logon_id
    • ProcSchema.time_stamp
    • ProcSchema.user_id
    • ProcSchema.user_name
  • ProcessTreeSchemaException
    • ProcessTreeSchemaException.DEF_HELP_URI
    • ProcessTreeSchemaException.args
    • ProcessTreeSchemaException.display_exception()
    • ProcessTreeSchemaException.help_uri
    • ProcessTreeSchemaException.no_display_exceptions()
    • ProcessTreeSchemaException.with_traceback()
• msticpy.transform.process_tree_utils module
  • TemplateLine
    • TemplateLine.count()
    • TemplateLine.index()
    • TemplateLine.items
    • TemplateLine.wrap
  • get_ancestors()
  • get_children()
  • get_descendents()
  • get_parent()
  • get_process()
  • get_process_key()
  • get_root()
  • get_root_tree()
  • get_roots()
  • get_siblings()
  • get_summary_info()
  • get_tree_depth()
  • tree_to_text()