azure / azure-sentinel-notebooks Goto Github PK

Interactive Azure Sentinel Notebooks provides security insights and actions to investigate anomalies and hunt for malicious behaviors.

License: MIT License

Jupyter Notebook 99.72% Python 0.27% Shell 0.01% PowerShell 0.01%

azure-sentinel-notebooks's Introduction

Microsoft Sentinel Notebooks

Jupyter notebooks are an interactive development and data analysis environment hosted in a browser. The open API supported by Microsoft Sentinel allows you to use Jupyter notebooks to query, transform, analyze and visualize Microsoft Sentinel data. This makes notebooks a powerful addition to Microsoft Sentinel and is especially well-suited to ad-hoc investigations, hunting or customized workflows.

More information on getting started with Microsoft Sentinel and Azure Notebooks

This repository contains notebooks contributed by Microsoft and the community to assist hunting and investigation tasks in Microsoft Sentinel.

Finding a notebook in the repo

Top Level notebooks

There are several notebooks at the top level of the repo - eventually only a few introductory notebooks will reside here. For the moment, notebooks at the top level include all of those used in the Microsoft Sentinel portal.

If you have never used notebooks in Microsoft Sentinel before you should run through the Getting Started Notebook

Other Folders

scenario-notebooks

This contains notebooks designed for use by you in Microsoft Sentinel. Some of these are intended to illustrate specific techniques or investigation approaches

tutorials-and-examples

example-notebooks Examples of techniques or features
feature-tutorials MSTICPy feature tutorial notebooks
how-tos Articles and notebooks illustrating specific techniques
other-language-kernels Notebooks using alternative kernels
training-notebooks Notebooks used in training webinars
deprecated-notebooks Older, deprecated notebooks

There are also support folders - source and utils

Full list of notebooks

Notebook	Folder
A Getting Started Guide For Azure Sentinel ML Notebooks.ipynb
A Getting Started Guide For PowerShell AML Notebooks.ipynb
A Tour of Cybersec notebook features.ipynb
ConfiguringNotebookEnvironment.ipynb
Credential Scan on Azure Blob Storage.ipynb
Credential Scan on Azure Data Explorer.ipynb
Credential Scan on Azure Log Analytics.ipynb
Entity Explorer - Account.ipynb
Entity Explorer - Domain and URL.ipynb
Entity Explorer - IP Address.ipynb
Entity Explorer - Linux Host.ipynb
Entity Explorer - Windows Host.ipynb
Guided Hunting - Anomalous Office365 Exchange Sessions.ipynb
Guided Hunting - Azure Resource Explorer.ipynb
Guided Hunting - Base64-Encoded Linux Commands.ipynb
Guided Hunting - Covid-19 Themed Threats.ipynb
Guided Investigation - Anomaly Lookup.ipynb
Guided Investigation - Incident Triage.ipynb
Guided Investigation - Process-Alerts.ipynb
Guided Investigation - Solarwinds Post Compromise Activity.ipynb
Guided Triage - Alerts.ipynb
Hands-on 1. Data Discovery using Azure REST API.ipynb
Hands-on 2. Surfing Data using Azure SDK.ipynb
Machine Learning in Notebooks Examples.ipynb
AffectedKeyCredentials-CVE-2021-42306.ipynb	scenario-notebooks
AutomatedNotebooks-IncidentTriage.ipynb	scenario-notebooks
AutomatedNotebooks-Manager.ipynb	scenario-notebooks
Guided Hunting - Detect potential network beaconing using Apache Spark via Azure Synapse.ipynb	scenario-notebooks
Guided Hunting - Office365-Exploring.ipynb	scenario-notebooks
Guided Investigation - MDE Webshell Alerts.ipynb	scenario-notebooks
Guided Investigation - WAF data.ipynb	scenario-notebooks
Guided Analysis - User Security Metadata.ipynb	scenario-notebooks/UserSecurityMetadata
papermill_test_runner.ipynb	src/Test
Example - Azure Storage VT Hash Lookup.ipynb	tutorials-and-examples/example-notebooks
Example - Guided Hunting - Office365-Exploring.ipynb	tutorials-and-examples/example-notebooks
Example - Guided Investigation - Process-Alerts.ipynb	tutorials-and-examples/example-notebooks
M365 Defender - APIs ep3.ipynb	tutorials-and-examples/example-notebooks
M365 Defender - hunting.ipynb	tutorials-and-examples/example-notebooks
MDE APIs Demo Notebook.ipynb	tutorials-and-examples/example-notebooks
MSTICPy Tour.ipynb	tutorials-and-examples/example-notebooks
Senserva Connections Graph Notebook.ipynb	tutorials-and-examples/example-notebooks
SigmaRuleImporter.ipynb	tutorials-and-examples/example-notebooks
VirusTotal File Behavior Explorer - MS and Sysmon detonation.ipynb	tutorials-and-examples/example-notebooks
msticpy demo.ipynb	tutorials-and-examples/example-notebooks
AnomalousSequence.ipynb	tutorials-and-examples/feature-tutorials
AzureBlobStorage.ipynb	tutorials-and-examples/feature-tutorials
AzureSentinelAPIs.ipynb	tutorials-and-examples/feature-tutorials
Base64Unpack.ipynb	tutorials-and-examples/feature-tutorials
DataObfuscation.ipynb	tutorials-and-examples/feature-tutorials
DataUploader.ipynb	tutorials-and-examples/feature-tutorials
DataViewer.ipynb	tutorials-and-examples/feature-tutorials
Data_Queries.ipynb	tutorials-and-examples/feature-tutorials
EventClustering.ipynb	tutorials-and-examples/feature-tutorials
EventTimeline.ipynb	tutorials-and-examples/feature-tutorials
FoliumMap.ipynb	tutorials-and-examples/feature-tutorials
GeoIPLookups.ipynb	tutorials-and-examples/feature-tutorials
IoCExtract.ipynb	tutorials-and-examples/feature-tutorials
MDATPQuery.ipynb	tutorials-and-examples/feature-tutorials
MPSettingsEditor.ipynb	tutorials-and-examples/feature-tutorials
MordorData.ipynb	tutorials-and-examples/feature-tutorials
NotebookWidgets.ipynb	tutorials-and-examples/feature-tutorials
PivotFunctions-Introduction.ipynb	tutorials-and-examples/feature-tutorials
PivotFunctions.ipynb	tutorials-and-examples/feature-tutorials
ProcessTree.ipynb	tutorials-and-examples/feature-tutorials
ResourceGraphDriver.ipynb	tutorials-and-examples/feature-tutorials
Splunk-DataConnector.ipynb	tutorials-and-examples/feature-tutorials
SqlToKql.ipynb	tutorials-and-examples/feature-tutorials
Sumologic-DataConnector.ipynb	tutorials-and-examples/feature-tutorials
TIProviders.ipynb	tutorials-and-examples/feature-tutorials
TimeSeriesAnomaliesVisualization.ipynb	tutorials-and-examples/feature-tutorials
VTLookupV3.ipynb	tutorials-and-examples/feature-tutorials
VirusTotalLookup.ipynb	tutorials-and-examples/feature-tutorials
Adding Hunting Bookmarks.ipynb	tutorials-and-examples/how-tos
Adding Secrets to Azure Key Vault.ipynb	tutorials-and-examples/how-tos
Automation Gallery - Credential Scan on Azure Blob Storage.ipynb	tutorials-and-examples/how-tos
Automation Setup - Configure Azure Machine Learning Compute Cluster and Managed Identity.ipynb	tutorials-and-examples/how-tos
Automation Setup - Configure Azure Machine Learning Pipelines.ipynb	tutorials-and-examples/how-tos
Azure Sentinel Query Creator.ipynb	tutorials-and-examples/how-tos
Configurate Azure ML and Azure Synapse Analytics.ipynb	tutorials-and-examples/how-tos
Notebook Template.ipynb	tutorials-and-examples/how-tos
Provisioning DSVM.ipynb	tutorials-and-examples/how-tos
TroubleShootingNotebooks.ipynb	tutorials-and-examples/how-tos
A Getting Started Guide For CSharp AML Notebooks.ipynb	tutorials-and-examples/other-language-kernels
A Python Crash Course - Part 1 - Fundamentals.ipynb	tutorials-and-examples/training-notebooks
Training - MSTICPy Training 1221.ipynb	tutorials-and-examples/training-notebooks
Training - MSTICPy Training 3 - 2022-01-13.ipynb	tutorials-and-examples/training-notebooks
generate-nb-toc.ipynb	utils
A Getting Started Guide For Azure Sentinel Notebooks.ipynb	tutorials-and-examples/deprecated-notebooks
Example - Step-by-Step Linux-Windows-Office Investigation.ipynb	tutorials-and-examples/deprecated-notebooks
Get Started.ipynb	tutorials-and-examples/deprecated-notebooks

Viewing the notebooks

You can view any of the notebooks directly on GitHub just by clicking on them.

For higher fidelity rendering we'd recommend Jupyter nbviewer.

Open a notebook here and copy the URL (or copy the a link from the table above)
Go to https://nbviewer.jupyter.org/ and paste the URL into the location text box.
Hit the Go! button

Find help and troubleshooting articles in the Wiki

Sentinel Notebooks Wiki

More Information

Getting Started notebook.
Configuring notebook environment notebook.
Run a demonstration notebook in
Read more about the use of Jupyter notebooks in Microsoft Sentinel on the Microsoft Sentinel Technical Community blog.
Read more about the Azure ML Notebooks Service.
Read more about MSTICPy - the CyberSecurity Python library that powers most of the notebooks

Feedback

For questions or feedback, please file an issue or contact [email protected]

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

azure-sentinel-notebooks's People

Contributors

Stargazers

Watchers

Forkers

secopsgit rinure dk26 jn7163 girishpoojary akudrati sts-sadr itzdan basfmthibodeaux ctac-team-rulez albandrod k3aczyk henrypi73 thmcelro ericlandmine jcarullo techabib azureandsecurityotaku parthdmaniar hkamel https-github-com-vfulitod176641 genrocker digitalarche sirarthur30-hotmail-com cybermonitor tianderturpijn siddharthkirar1995 phenggeler rvoak-ms stratatech-education-group raylazerdragon olabodeolushi rajkrishnamurthy rsquared2016 antigrammatik threatpage isabella232 sa404-ai x3nc0n selbenna rvoak jaredallen13 joker2013 rajeshsura189 kiranese iwafula025 cybersecops gabrieltalavera ujjwalk dwnatwick sureshkumar-mss j0s3ph-c7 v-thepet sreedharande allbad aya0908 saditech pawelgiza tali-ash 2xyo teachjing zha0 nttdata-ken maximus-net mastershonuff erensarisaltik goodwoodrevival love-a snteran tamiral tj-senserva oferinbar aktapaz ehloworldio waynekearns subhashc jitmun noogleswafra 0-1-2-3-4 xaviercallens yaelrbergman udanashivm nlubalo victoraranda juliaval29 vdutta1980 meirmen python-repository-hub amritpal-singh-98 justinnp romainbou mang0kitty pensivepaddle ksagala kamrulshohag connorbrewer h0axd nettitude-ms innovationexploited jalfrey

azure-sentinel-notebooks's Issues

error when run Credential Scan on Azure Data Explorer.ipynb in # Initialize Kusto data client and create table list

Notebook "A Getting Started Guide for Azure Sentinel notebooks with PowerShell" outdated, incompatible and may downgrade libraries in new comput instances

The notebook file "A Getting Started Guide for Azure Sentinel notebooks with PowerShell" has not been updated in two years.

Doesn't support Ubuntu Focal 20.04 compute instances
Requires .NET 5.0 SDK. Current release uses .NET 7
Most installation steps in the notebook are not necessary on new compute instances created in current Sentinel ML interfaces.

Of note is if you create a new instance and then run this notebook, one of the first steps is to download and install v18.04 of the Microsoft debian repository config, which results in a downgrade. Effectively, this destroys the utility of the compute instance and possibly opens up vulnerabilities.

Current guidance, from the dotnet interactive developers, is provided here: https://github.com/dotnet/interactive/blob/main/docs/NotebookswithJupyter.md

A Tour of Cybersec Notebook Featires

My data environment is set to MSSentinel (or AzureSentinel - legacy name)

Even though I have the necessary permissions and authenticated to Sentinel Workspace and can run test queries on Sentinel tables, when I am using predefined Queries from the Queries list, I get an error:

MsticpyDataQueryError Traceback (most recent call last)
Cell In[34], line 1
----> 1 qry_prov.Azure.list_all_signins_geo()

Auth error for Credential Scan on Blob Storage notebook

Hello -

I'm receiving the below error in the first cell of section 2 - Authentication to Azure Storage, after authenticating in the web browser:

"The public API of azure-cli-core has been deprecated starting 2.21.0, and this method can no longer return a valid credential. If you need to still use this method, you need to install 'azure-cli-core<2.21.0'. You may corrupt data if you use current CLI and old azure-cli-core. See also: https://aka.ms/azsdk/python/identity/migration"

Currently running the cells sequentially as suggested. Thanks.

AutomatedNotebooks-IncidentTriage.ipynb - error when evaluating IPv4 Entity

When the NB evaluates IP address it displays the initial lookup but then stop with an error.

1.1.1.1, ip address type: Public
Whois data retrieved
WhoIs data

Getting data from Threat Intel...
Getting data from Passive DNS...

MsticpyUserConfigError - No Threat Intel Provider configuration found.

"Adding Hunting Bookmarks" notebook not working

In the "Adding Hunting Bookmarks" bookmark, in the 4th code pane, an error message is thrown every time it gets run. The error is:

AttributeError Traceback (most recent call last)
in
1 # Retrieve access token
2 creds, sub_id = get_azure_cli_credentials()
----> 3 token = creds._token_retriever()
4 access_token = token[2]['accessToken']

AttributeError: '_CliCredentials' object has no attribute '_token_retriever'

Getting issue in Get Started.ipynb while running Search a term Query

Hi,

In Get Started.ipynb notebook, following query is not working:

scope to a table and a column
%kql search in ({selected_table.value}) {selected_columns.value[0]}: '*local service' | take 5

Error:

query execution error:
{
    "error": {
        "code": "BadArgumentError",
        "innererror": {
            "code": "SyntaxError",
            "innererror": {
                "code": "SYN0002",
                "line": 1,
                "message": "Query could not be parsed at '{' on line [1,11]",
                "pos": 11,
                "token": "{"
            },
            "message": "A recognition error occurred in the query."
        },
        "message": "The request had some invalid properties"
    }
}

Screenshot:

Query error in Machine Learning examples notebook

In Markov chain anomaly section we use qry_prov.Azure.OfficeActivity - this should be qry_prov.Office365.OfficeActivity.

Question : dataset for notebook Mitre and GPT2

Hi there,
I was wondering if it would be possible to share the dataset you used for finetuning the model of the following notebook (https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/mitremap-notebook/).
Thanks!

Authenticate to Azure Resources

Having an issue with this spot, 'Authentication to Azure Resources' not sure where I should define workspace. I thought that was covered in line 2.

ImportError: No module named pandas_bokeh

Getting this error on using the Linux notebook.

Importing python packages....

ImportErrorTraceback (most recent call last)

in ()
4 import re
5 import pandas as pd
----> 6 import pandas_bokeh
7 pandas_bokeh.output_notebook()
8 import numpy as np

ImportError: No module named pandas_bokeh

How can I use the example NoteBook

In the Grandlist at sentinel i can see 25 templates are provided on Portal but u guys have many good examples here , even some 3rd party repos got ipynb files for notebooks , is there a way i can import those to my sentinel , instead of using exiting 25 templates or creating from srcatch everytime i create a ml wrkspace..?

Validation Pipeline Failing

The validation pipeline has an issue with the Python 3.6 checks that is unrelated to the content being checked.

##[warning]You should provide GitHub token if you want to download a python release. Otherwise you may hit the GitHub anonymous download limit.
##[error]Failed to download Python from the Github Actions python registry (https://github.com/actions/python-versions). Error: Error: Could not find Python matching spec 3.6 (x64) in the python-versions registry. Beware that only systems listed in the Github Actions python versions manifest (https://github.com/actions/python-versions/blob/main/versions-manifest.json) are fit for downloading python on-flight. Also, proxy is not supported.
##[error]Version spec 3.6 for architecture x64 did not match any version in Agent.ToolsDirectory.

[SigmaRuleImporter.ipynb] Tables does not exist

Converted rules access tables that do not exist:

[FR] Add links to Sentinel and/or MSTICPy documentation to MSTICPy config error messages

SigmaRuleImporter error when saving KQL queries

When trying to export the KQL queries, the cell runs for a bit without a problem, and successfully outputs some of the KQL queries then it runs into this issue:

TypeError                                 Traceback (most recent call last)
Cell In[22], line 7
      4 sub_dir = root.joinpath(categ)
      6 for file_name, contents in kql_files.items():
----> 7     kql_txt = contents[1]
      8     if not kql_txt == NOT_CONVERTIBLE:
      9         sub_dir.mkdir(exist_ok=True)

TypeError: 'WindowsPath' object is not subscriptable

Azure Sentinel Template: Guided Investigation - Process Alerts.ipynb - Buggy feature with Get List of Alerts widget

Under the section: Get List of Alerts --> Set query time boundaries, users need to select a time range. Not any time range would work, especially the default one. An error like below would be displayed. The error did not give needed info to help users to understand the issue was with time range selection. I intuitively guessed out it was related to the range selection by giving it different values.

MsticpyDataQueryError - we've hit an error while running

StatusDescription None
(err_code: None)
Query:
SecurityAlert | project-rename StartTimeUtc = StartTime, EndTimeUtc = EndTime, AlertDisplayName = DisplayName, Severity = AlertSeverity | extend AlertType = iif(isempty(AlertType), AlertName, AlertType) | where true | where TimeGenerated >= datetime(2021-10-26T10:14:13.361754Z) | where TimeGenerated <= datetime(2021-10-28T11:14:13.361754Z) | extend extendedProps = parse_json(ExtendedProperties) | extend CompromisedEntity = tostring(extendedProps["Compromised Host"]) | project-away extendedProps
;

For more help on fixing this error see:
Query failed

Failed to run workbook Import and convert Neo23x0 Sigma scripts

Use the first Notebook :

https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/tutorials-and-examples/example-notebooks/SigmaRuleImporter.ipynb

Run the first rectangle
Download and unzip the Sigma repo

Guided Analysis - User Security Metadata.ipynb Issues

The Guided Analysis - User Security Metadata.ipynb notebook has multiple issues that prevent it from running correctly. The first is that it doesn't import the User class from Utils so it throws an exception when calling it the first time. Once imported that class has non functioning features that cause further exceptions.

MPEdit GUI not displaying properly in Browser

Describe the bug
There appears to be an issue with how the MsticPy configuration editor [MpConfigEdit()] displays within a web browser. More specifically- the GUI display appears to be stuck on the "workspace settings" tab and will remain stuck, even when you switch to different tabs e.g. "TI Providers", "Data Providers" etc. This issue DOES NOT occur- when you run the code directly within visual studio code.

To Reproduce
Steps to reproduce the behavior:

Open web browser (Chrome or Edge)
Within MS Sentinel- create a ML workspace and open the "Getting Started with Azure ML Notebooks and Microsoft Sentinel" notebook
Create a compute instance
Complete _"Getting Started with Azure ML Notebooks and Microsoft Sentinel" notebook steps 1-3.1
When running the code in step 3.2 and 4.1 [launching the MPEdit GUI] the GUI does not display properly

Expected behavior [Visual Studio Code]
These screenshots were taken from when I ran the code in visual studio code editor- where the MSEditor renders as expected. Note each tab in the editor renders different menu options

Screenshots of Issue [Microsoft Azure Machine Learning Studio]
These screenshots were taken when executing the notebook code directly in the web browser via Microsoft Azure Machine Learning Studio. Note: Irrespective of which tab in the is selected- the editor always displays the "workplace settings" menu. Not only this- none of the buttons within the workspace settings options appear to work either. This prevents users from configuring settings such as TI, Azure Key Vault, GEOIP, via the GUI.

Desktop (please complete the following information):

OS: [Windows]
Browser [tired Chrome and Edge]
Version [Chrome Version 101.0.4951.67]
Compute Instance Kernel 3.8

Additional context

Hi, I am a brand new user of Azure Sentinel Notebooks. Although- I was able to resolve this issue by opening the notebook in visual code editor- this may be an issue for other new notebook users. Especially- because configuring the msticpiconfig.yaml file is vital for most of the "out of the box" notebook templates.
Thanks in advance- Ryan

Bad link in Wiki page

The Wiki page here:
https://github.com/Azure/Azure-Sentinel-Notebooks/wiki/Can-I-install-MSTICPy-by-default-on-a-new-AML-compute

has a broken link for a shell script. Correct link is:
https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/HowTos/aml-compute-setup.sh

Script aml-compute-setup.sh does not install correct dependency for typing_extensions library

Creating a brand new AML compute instance and running the aml-compute-setup.sh script from this repository seems to successfully install msticpy.py
However, upon trying to import the library the following error is generated:

Python 3.8.1 (default, Jan 8 2020, 22:29:32)
[GCC 7.3.0] :: Anaconda, Inc. on linux
Type "help", "copyright", "credits" or "license" for more information.

import msticpy
Traceback (most recent call last):
File "", line 1, in
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/msticpy/init.py", line 34, in
from .nbtools.nbinit import init_notebook, current_providers
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/msticpy/nbtools/init.py", line 20, in
from . import nbdisplay
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/msticpy/nbtools/nbdisplay.py", line 11, in
from bokeh.io import output_notebook
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/bokeh/io/init.py", line 24, in
from .doc import curdoc
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/bokeh/io/doc.py", line 29, in
from .state import curstate
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/bokeh/io/state.py", line 53, in
from ..document import Document
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/bokeh/document/init.py", line 50, in
from .document import DEFAULT_TITLE ; DEFAULT_TITLE
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/bokeh/document/document.py", line 56, in
from ..core.json_encoder import serialize_json
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/bokeh/core/json_encoder.py", line 75, in
from ..util.serialization import (
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/bokeh/util/serialization.py", line 51, in
from typing_extensions import Literal, TypedDict, TypeGuard
ImportError: cannot import name 'TypeGuard' from 'typing_extensions' (/anaconda/envs/azureml_py38/lib/python3.8/site-packages/typing_extensions.py)

Further inspection indicates the "TypeGuard" function isn't available in the version of installed typing_extensions library. Log of script output indicates typing_extensions-3.7.4.3 was to be installed, but a listing of current modules via pip shows typing-extensions-3.10.0.2

Data processing issue with Azure Sentinel Template: Guided Investigation - Process Alerts.ipynb

error found in "Show these related alerts on a graph" and "Browse List of Related Alerts" sections when processing data for displaying. Various errors were displayed. Here is the top and bottom part of the output.

AttributeError Traceback (most recent call last)
in
2
3 if related_alerts is not None and not related_alerts.empty:
----> 4 rel_alert_graph = security_alert_graph.add_related_alerts(related_alerts=related_alerts,
global rel_alert_graph = undefined
global security_alert_graph.add_related_alerts = <function add_related_alerts at 0x7f0c8f505820>
global related_alerts = TenantId TimeGenerated
0 xxxxxxxx-xxxx-4e32-xxxx-9bc4bxxx075e 2021-10-26 10:30:18.562000+00:00
1 xxxxxxxx-xxxx-4e32-xxxx-9bc4bxxx075e 2021-10-26 10:30:18.333000+00:00

......
......

entity_type_name = 'url'
raw_entity = {'$id': '13', 'Url': 'https://on-d.oss-cn-shenzhen.aliyuncs.com/download/%E5%8C%97%E4%BA%AC%E5%B8%82%E7%BD%91%E4%B8%8A%E7%A8%8E%E5%8A%A1%E5%B1%80%28%E8%87%AA%E7%84%B6%E4%BA%BA%E7%89%88%29_01210003296.exe', 'Type': 'url'}
450
451 raise TypeError("Could not find a suitable type for {}".format(entity_type))

/anaconda/envs/azureml_py38/lib/python3.8/site-packages/msticpy/datamodel/entities/url.py in init(self=Url(Type=url), src_entity={'$id': '13', 'Type': 'url', 'Url': 'https://on-d.oss-cn-shenzhen.aliyuncs.com/downlo...%AA%E7%84%B6%E4%BA%BA%E7%89%88%29_01210003296.exe'}, **kwargs={})
31 """
32 super().init(src_entity=src_entity, **kwargs)
---> 33 if self.Url:
self.Url = undefined
34 self.dict.update(url_components(self.Url))
35

/anaconda/envs/azureml_py38/lib/python3.8/site-packages/msticpy/datamodel/entities/entity.py in getattr(self=Url(Type=url), name='Url')
196 if name in self._entity_schema:
197 return None
--> 198 raise AttributeError(f"{name} is not a valid attribute.")
global AttributeError = undefined
199
200 def iter(self):

AttributeError: Url is not a valid attribute.

Lookup Threat Intel reports for selected alerts - ValueError: The truth value of a DataFrame is ambiguous. Use a.empty, a.bool(), a.item(), a.any() or a.all()

How to fix this code line giving a ValueError?

selected_alert_type['TI Risk'] = selected_alert_type.progress_apply(lookup, axis=1)

Typo in Configure Azure ML and Azure Synapse Analytics

Configurate vs Configure

https://github.com/Azure/Azure-Sentinel-Notebooks/blob/1b613c3f55f676e85aa448ffbc18a28ec6f44e6c/Configurate%20Azure%20ML%20and%20Azure%20Synapse%20Analytics.ipynb

Mitremap-notebook: Error - Gpt2tokenizer object has no attribute _added_tokens_decoder

When I run the below mentioned code I get the error "Gpt2tokenizer object has no attribute _added_tokens_decoder"

configs, inference_df, iocs_df = main.go(
config_widgets
)