Inconsistent connection behaviour between regular Python and IPyNB

[lesleyxyz]

I have received a tenant_id, client_id, client_scret, workspace_id and workspace_name.

When I use Kqlmagic to connect like the following:

%kql loganalytics://tenant='tenant_id';clientid='client_id';clientsecret='client_secret';workspace='workspace_id';alias='workspace_name'

It works perfectly.

But when I use msticpy to connect using the following:

qry_prov = QueryProvider(data_environment='LogAnalytics')
qry_prov.connect(connection_str="loganalytics://tenant='tenant_id';clientid='client_id';clientsecret='client_secret';workspace='workspace_id';alias='workspace_name'")

It fails to connect.
I am assuming it is because using this data environment I can only supply a tenant_id and workspace_id.

When I try

qry_prov = QueryProvider('MDATP')
qry_prov.connect(tenant_id=tenant_id, client_id=client_id, client_secret=client_secret)

It connects succesfully, but then I can only access qry_prov.MDATP.* and not the qry_prov.SecurityAlert.list_alerts() that I require.

[ianhelle]

Actually, it passes the connection string directly to Kqlmagic. Currently it calls IPython.run_cell_magic() - so it should behave exactly the same way as the first example (using %kql).
Are you getting any error returned?
Also are you already connected to a workspace with a different tenantId? there is a limitation of kql magic (or possible somewhere in Azure_identity) that prevents you authenticating to multiple tenants in the same notebook.

The second issue seems unrelated.
We just did some updates to the MDE provider (you should also be able to invoke it with QueryProvider("MDE") since MDATP has been deprecated). The updates are available in 1.3.0 - the schema we were using in earlier versions definitely no longer works.

What do you see in the MDE provider if you type qry_prov.list_queries()?

[lesleyxyz]

Thank you for your reply!

LogAnalytics

When using data_environment='LogAnalytics' I only get the following error:

Please wait. Loading Kqlmagic extension...
Could not connect to kql query provider for loganalytics://tenant='redacted';clientid='redacted';clientsecret='redacted';workspace='redacted';alias='redacted'

I just did some tests (because you said it passes the connection string to Kqlmagic) and found something interesting when using the following code:

qry_prov = QueryProvider(data_environment='LogAnalytics')
qry_prov.connect(connection_str="loganalytics://tenant='tenant_id';clientid='client_id';clientsecret='client_secret';workspace='workspace_id';alias='workspace_name'")
print(qry_prov.connected)

In regular .py files by executing python it fails (returns False), while in Jupyter notebooks it succeeds (returns True).
Is it a requirement to run msticpy in a Jupyter notebook?

MDE

Using MDE I can perform the following queries (qry_prov.list_queries())
But I need to retrieve Security Incidents / AlertEvents from LogAnalytics

['MDATP.file_path', 'MDATP.host_alerts', 'MDATP.host_connections', 'MDATP.ip_alerts', 'MDATP.ip_connections', 'MDATP.list_alerts', 'MDATP.list_connections', 'MDATP.list_filehash', 'MDATP.list_files', 'MDATP.list_host_processes', 'MDATP.process_cmd_line', 'MDATP.process_creations', 'MDATP.process_paths', 'MDATP.protocol_connections', 'MDATP.sha1_alerts', 'MDATP.url_alerts', 'MDATP.url_connections', 'MDATP.user_files', 'MDATP.user_logons', 'MDATP.user_network', 'MDATP.user_processes', 'MDATPHunting.accessibility_persistence', 'MDATPHunting.av_sites', 'MDATPHunting.b64_pe', 'MDATPHunting.brute_force', 'MDATPHunting.cve_2018_1000006l', 'MDATPHunting.cve_2018_1111', 'MDATPHunting.cve_2018_4878', 'MDATPHunting.doc_with_link', 'MDATPHunting.dropbox_link', 'MDATPHunting.email_link', 'MDATPHunting.email_smartscreen', 'MDATPHunting.malware_recycle', 'MDATPHunting.network_scans', 'MDATPHunting.powershell_downloads', 'MDATPHunting.service_account_powershell', 'MDATPHunting.smartscreen_ignored', 'MDATPHunting.smb_discovery', 'MDATPHunting.tor', 'MDATPHunting.uncommon_powershell', 'MDATPHunting.user_enumeration']

[ianhelle]

I found a way to avoid calling Kqlmagic functions via IPython cell magics.
In PR #190 this should be fixed. Planning to release as 1.3.1

[ianhelle]

@lesleyxyz - This should be released now. Thanks for the feedback!