Skip to content

Commit

Permalink
Dynamic Summaries Sentinel API and DynamicSummary class. (#593)
Browse files Browse the repository at this point in the history 
* * Completed unit tests and linting fixes for sentinel_dynamic_summary

* Added documentation.
* Fixed up a bunch of intialization code in sentinel_core.py to try to ensure that params
  and defaults set in __init__ or connect work as expected.
* Updated test_sentinel* modules to use common fixtures - updated the sentinel_loader fixture to
  deal with updates to Sentinel core class.
* Added missing workspace name to mp test config

* Added a couple of helper attributes for DynamicSummary classes.

Renamed modules to sentinel_dynamic_summary.py and senti sentinel_dynamic_summary_types.py
Fixed some documentation links and added explanation for use of fields attribute

* Fixing unit tests for test_dynamic_summary.py

Tidied up inconsistent use of MicrosoftSentinel._default_workspace and .workspace_config properties.
Added property and class method to WorkspaceConfig (in wsconfig.py) to allow easy conversion between ws_config and MSTICPy settings representation of workspace settings.
Correcting docstring error in cybereason_driver.py
Fixing test_kql_driver.py - since Kql driver can now be instantiated without a connection string parameter
Fixing test_pivot_register.py tests to avoid using online ip_whois checks.
Fixing a few PyLance/MyPy warnings about param = None that are not marked Optional

* Fixing mypy warnings in azure_data.py

* Pylint warning suppressions in sentinel_dynamic_summary_types.py

Co-authored-by: Pete Bryan <peter.bryan@microsoft.com>
  • Loading branch information
@ianhelle @petebryan
ianhelle and petebryan committed Jan 24, 2023
1 parent 3800076 commit 5ae9c93
Show file tree
Hide file tree
Showing 34 changed files with 2,708 additions and 399 deletions.
2 changes: 2 additions & 0 deletions docs/source/api/msticpy.context.azure.rst
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,8 @@ Submodules
msticpy.context.azure.sentinel_analytics
msticpy.context.azure.sentinel_bookmarks
msticpy.context.azure.sentinel_core
msticpy.context.azure.sentinel_dynamic_summary
msticpy.context.azure.sentinel_dynamic_summary_types
msticpy.context.azure.sentinel_incidents
msticpy.context.azure.sentinel_search
msticpy.context.azure.sentinel_ti
Expand Down
7 changes: 7 additions & 0 deletions docs/source/api/msticpy.context.azure.sentinel_dynamic_summary.rst
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
msticpy.context.azure.sentinel\_dynamic\_summary module
=======================================================

.. automodule:: msticpy.context.azure.sentinel_dynamic_summary
:members:
:undoc-members:
:show-inheritance:
7 changes: 7 additions & 0 deletions docs/source/api/msticpy.context.azure.sentinel_dynamic_summary_types.rst
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
msticpy.context.azure.sentinel\_dynamic\_summary\_types module
==============================================================

.. automodule:: msticpy.context.azure.sentinel_dynamic_summary_types
:members:
:undoc-members:
:show-inheritance:
11 changes: 11 additions & 0 deletions docs/source/data_acquisition/DataQueries.rst
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,9 +38,12 @@ AzureNetwork list_azure_network_flows_by_ip Retrieves Azure network an
AzureNetwork network_connections_to_url List of network connections to a URL end (datetime), start (datetime), url (str) CommonSecurityLog
AzureSentinel get_bookmark_by_id Retrieves a single Bookmark by BookmarkId bookmark_id (str), end (datetime), start (datetime) HuntingBookmark
AzureSentinel get_bookmark_by_name Retrieves one or more Bookmarks by Bookmark Name bookmark_name (str), end (datetime), start (datetime) HuntingBookmark
AzureSentinel get_dynamic_summary_by_id Retrieves Dynamic Summary by SummaryId end (datetime), start (datetime), summary_id (str) DynamicSummary
AzureSentinel get_dynamic_summary_by_name Retrieves Dynamic Summary by Name end (datetime), start (datetime), summary_name (str) DynamicSummary
AzureSentinel list_bookmarks Retrieves list of bookmarks end (datetime), start (datetime) HuntingBookmark
AzureSentinel list_bookmarks_for_entity Retrieves bookmarks for entity string end (datetime), start (datetime) HuntingBookmark
AzureSentinel list_bookmarks_for_tags Retrieves Bookmark by one or mare Tags bookmark_tags (list), end (datetime), start (datetime) HuntingBookmark
AzureSentinel list_dynamic_summaries Retrieves Dynamic Summaries by date range end (datetime), start (datetime) DynamicSummary
Heartbeat get_heartbeat_for_host Retrieves latest OMS Heartbeat event for host. end (datetime), host_name (str), start (datetime) Heartbeat
Heartbeat get_heartbeat_for_ip Retrieves latest OMS Heartbeat event for ip address. end (datetime), ip_address (str), start (datetime) Heartbeat
Heartbeat get_info_by_hostname Deprecated - use 'get_heartbeat_for_host' end (datetime), host_name (str), start (datetime) Heartbeat
Expand Down Expand Up @@ -134,6 +137,14 @@ MDE user_files Lists all files created by
MDE user_logons Lists all user logons by user account_name (str), end (datetime), start (datetime) -
MDE user_network Lists all network connections associated with a user account_name (str), end (datetime), start (datetime) -
MDE user_processes Lists all processes created by a user account_name (str), end (datetime), start (datetime) -
MSSentinel get_bookmark_by_id Retrieves a single Bookmark by BookmarkId bookmark_id (str), end (datetime), start (datetime) HuntingBookmark
MSSentinel get_bookmark_by_name Retrieves one or more Bookmarks by Bookmark Name bookmark_name (str), end (datetime), start (datetime) HuntingBookmark
MSSentinel get_dynamic_summary_by_id Retrieves Dynamic Summary by SummaryId end (datetime), start (datetime), summary_id (str) DynamicSummary
MSSentinel get_dynamic_summary_by_name Retrieves Dynamic Summary by Name end (datetime), start (datetime), summary_name (str) DynamicSummary
MSSentinel list_bookmarks Retrieves list of bookmarks end (datetime), start (datetime) HuntingBookmark
MSSentinel list_bookmarks_for_entity Retrieves bookmarks for entity string end (datetime), start (datetime) HuntingBookmark
MSSentinel list_bookmarks_for_tags Retrieves Bookmark by one or mare Tags bookmark_tags (list), end (datetime), start (datetime) HuntingBookmark
MSSentinel list_dynamic_summaries Retrieves Dynamic Summaries by date range end (datetime), start (datetime) DynamicSummary
MultiDataSource get_timeseries_anomalies Time Series filtered anomalies detected using built-in KQL time series function-series_decompose_anomalies end (datetime), start (datetime), table (str) na
MultiDataSource get_timeseries_data Retrieves TimeSeriesData prepared to use with built-in KQL time series functions end (datetime), start (datetime), table (str) na
MultiDataSource get_timeseries_decompose Time Series decomposition and anomalies generated using built-in KQL time series function- series_decompose end (datetime), start (datetime), table (str) na
Expand Down
1 change: 1 addition & 0 deletions docs/source/data_acquisition/Sentinel.rst
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ Microsoft Sentinel APIs

SentinelAnalytics
SentinelBookmarks
SentinelDynamicSummaries
SentinelIncidents
SentinelWatchlists
SentinelSearch
Expand Down

0 comments on commit 5ae9c93

Please sign in to comment.