Skip to content

MDATP/AzureData Support and ProcessTree Viewer
Compare
Choose a tag to compare
@ianhelle ianhelle released this 20 Dec 19:20
v0.2.8
1c1bc16

Overview

This release contains three important features:

  • Query support for Microsoft Defender ATP
  • Interactive Process Tree browser.
  • Support for querying Azure properties for subscriptions and resources

New Features

  • Microsoft Defender Query Support. Added a query provider/driver to
    query Defender alerts, machines, processes and arbitrary KQL queries of
    the Hunting data
  • Template queries for MDATP for hunting and standard entities
  • Process Tree Viewer - Bokeh interactive graphical view for one or
    more Process Trees in a data set. Supports both Windows and Linux.
  • Process tree utilities - data library to create and query process trees.
  • Azure properties of subscriptions and resources such as VMs can be
    queried from Notebooks.
  • Query providers now accept ISO-string format for datatime fields
    for queries (in addition to datetime and timedelta)
  • Added Progress widget to nbwidgets.

Fixes

Assets 2