Entity Explorer - Linux Host.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    " # Host Explorer\n",
    " \n",
    "**Note: This notebook has been superceeded by the Entity Explorer - Host notebook and will be removed in a future update. <br>\n",
    "Please migrate to the Host notebook: https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/Entity%20Explorer%20-%20Host.ipynb**\n",
    "\n",
    " <details>\n",
    "     <summary> <u>Details...</u></summary>\n",
    "\n",
    " **Notebook Version:** 2.0<br>\n",
    " **Python Version:** Python 3.8 (including Python 3.8 - AzureML)<br>\n",
    " **Required Packages**: msticpy, msticnb<br>\n",
    " \n",
    " **Data Sources Required**:\n",
    " - Log Analytics - SecurityAlert, SecurityEvent (EventIDs 4688 and 4624/25), AzureNetworkAnalytics_CL, Heartbeat\n",
    " - (Optional) - VirusTotal, AlienVault OTX, IBM XForce, Open Page Rank, (all require accounts and API keys)\n",
    " </details>\n",
    "\n",
    " Brings together a series of queries and visualizations to help you determine the security state of the host that you are investigating.\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<!DOCTYPE html>\n",
    "<html>\n",
    "  <head>\n",
    "  </head>\n",
    "  <body>\n",
    "    <h1>Contents<span class=\"tocSkip\"></span></h1>\n",
    "    <div class=\"toc\">\n",
    "      <ul class=\"toc-item\">\n",
    "        <li><span><a href=\"#Notebook-initialization\">Notebook initialization</a></span></li>\n",
    "        <li><span><a href=\"#Enter-host-name-and-query-time\">Enter host\n",
    "              name and query time</a></span></li>\n",
    "        <li><span><a href=\"#Review-host-overview\">Review Host Overview</a></span></li>\n",
    "        <li><span><a href=\"#Review-alerts\">Review Alerts</a></span></li>\n",
    "        <li><span><a href=\"#Review-bookmarks\">Review Bookmarks</a></span></li>\n",
    "        <li><span><a href=\"#Summarize-host-events\">Summarize Host Events</a></span></li>\n",
    "        <li><span><a href=\"#Noteable-host-events\">Noteable Host events</a></span></li>\n",
    "        <li><span><a href=\"#Review-host-logons\">Review Host Logons</a></span></li>\n",
    "        <li><span><a href=\"#Host-processes\">Host Processes</a></span></li>\n",
    "        <li><span><a href=\"#Extract-IOCs-from-processes\">Extract IOCs from Processes</a></span></li>\n",
    "        <li><span><a href=\"#Review-network-connections\">Review Network Connections</a></span></li>\n",
    "        <li><span><a href=\"#More-information\">More information</a></span></li>\n",
    "      </ul>\n",
    "    </div>\n",
    "    \n",
    "  </body>\n",
    "</html>\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "---\n",
    "### Notebook initialization\n",
    "The next cell:\n",
    "- Checks versions and optionally installs required packages\n",
    "- Imports the required packages into the notebook\n",
    "- Sets a number of configuration options.\n",
    "\n",
    "<details>\n",
    "    <summary><u>More details...</u></summary>\n",
    "\n",
    "This should complete without errors. If you encounter errors or warnings look at the following two notebooks:\n",
    "- [TroubleShootingNotebooks](https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/TroubleShootingNotebooks.ipynb)\n",
    "- [ConfiguringNotebookEnvironment](https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/ConfiguringNotebookEnvironment.ipynb)\n",
    "\n",
    "If you are running in the Microsoft Sentinel Notebooks environment (Azure Notebooks or Azure ML) you can run live versions of these notebooks:\n",
    "- [Run TroubleShootingNotebooks](./TroubleShootingNotebooks.ipynb)\n",
    "- [Run ConfiguringNotebookEnvironment](./ConfiguringNotebookEnvironment.ipynb)\n",
    "\n",
    "You may also need to do some additional configuration to successfully use functions such as Threat Intelligence service lookup and Geo IP lookup. \n",
    "There are more details about this in the `ConfiguringNotebookEnvironment` notebook and in these documents:\n",
    "- [msticpy configuration](https://msticpy.readthedocs.io/en/latest/getting_started/msticpyconfig.html)\n",
    "- [Threat intelligence provider configuration](https://msticpy.readthedocs.io/en/latest/data_acquisition/TIProviders.html#configuration-file)\n",
    "\n",
    "</details>\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "gather": {
     "logged": 1618337601419
    }
   },
   "outputs": [],
   "source": [
    "from datetime import datetime, timedelta, timezone\n",
    "from IPython.display import HTML, display\n",
    "\n",
    "# %pip install msticpy --upgrade\n",
    "# %pip install msticnb --upgrade\n",
    "display(HTML(\"<h3>Starting Notebook setup...</h3>\"))\n",
    "\n",
    "import msticpy as mp\n",
    "\n",
    "mp.init_notebook(\n",
    "    additional_packages=[\"msticnb>=1.0\"],\n",
    ");"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "tags": [
     "parameters"
    ]
   },
   "outputs": [],
   "source": [
    "# papermill default parameters\n",
    "ws_name = \"Default\"\n",
    "host_name = \"\"\n",
    "# If user_name is supplied in this parameter then activty for that host will be limited to this user.\n",
    "user_name = None\n",
    "end = datetime.now(timezone.utc)\n",
    "start = end - timedelta(days=2)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Get WorkspaceId and Authenticate to Microsoft Sentinel\n",
    "<details>\n",
    "<summary><u>Details...</u></summary>\n",
    "If you are using user/device authentication, run the following cell.\n",
    " - Click the 'Copy code to clipboard and authenticate' button.\n",
    " - This will pop up an Azure Active Directory authentication dialog (in a new tab or browser window). The device code will have been copied to the clipboard.\n",
    " - Select the text box and paste (Ctrl-V/Cmd-V) the copied value.\n",
    " - You should then be redirected to a user authentication page where you should authenticate with a user account that has permission to query your Log Analytics workspace.\n",
    "\n",
    " Use the following syntax if you are authenticating using an Azure Active Directory AppId and Secret:\n",
    " ```\n",
    " %kql loganalytics://tenant(aad_tenant).workspace(WORKSPACE_ID).clientid(client_id).clientsecret(client_secret)\n",
    " ```\n",
    " instead of\n",
    " ```\n",
    " %kql loganalytics://code().workspace(WORKSPACE_ID)\n",
    " ```\n",
    "\n",
    "**Note:** you may occasionally see a JavaScript error displayed at the end of the authentication - you can safely ignore this.<br>\n",
    "\n",
    "On successful authentication you should see a ```popup schema``` button.\n",
    "To find your Workspace Id go to [Log Analytics](https://ms.portal.azure.com/#blade/HubsExtension/Resources/resourceType/Microsoft.OperationalInsights%2Fworkspaces). Look at the workspace properties to find the ID.\n",
    "</details>"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "gather": {
     "logged": 1618337654726
    }
   },
   "outputs": [],
   "source": [
    "print(\n",
    "    \"Configured workspaces: \",\n",
    "    \", \".join(msticpy.settings.get_config(\"AzureSentinel.Workspaces\").keys()),\n",
    ")\n",
    "import ipywidgets as widgets\n",
    "\n",
    "ws_param = widgets.Combobox(\n",
    "    description=\"Workspace Name\",\n",
    "    value=ws_name,\n",
    "    options=list(msticpy.settings.get_config(\"AzureSentinel.Workspaces\").keys()),\n",
    ")\n",
    "ws_param"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "gather": {
     "logged": 1617819011673
    }
   },
   "outputs": [],
   "source": [
    "from msticpy.common.timespan import TimeSpan\n",
    "from msticpy.context.tilookup import TILookup\n",
    "\n",
    "# Authentication\n",
    "qry_prov = QueryProvider(data_environment=\"MSSentinel\")\n",
    "qry_prov.connect(WorkspaceConfig(workspace=ws_param.value))\n",
    "\n",
    "nb_timespan = TimeSpan(start, end)\n",
    "qry_prov.query_time.timespan = nb_timespan\n",
    "md(\"<hr>\")\n",
    "md(\"Confirm time range to search\", \"bold\")\n",
    "qry_prov.query_time"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Authentication and Configuration Problems\n",
    "\n",
    "<br>\n",
    "<details>\n",
    "    <summary>Click for details about configuring your authentication parameters</summary>\n",
    "    \n",
    "    \n",
    "The notebook is expecting your Microsoft Sentinel Tenant ID and Workspace ID to be configured in one of the following places:\n",
    "- `config.json` in the current folder\n",
    "- `msticpyconfig.yaml` in the current folder or location specified by `MSTICPYCONFIG` environment variable.\n",
    "    \n",
    "For help with setting up your `config.json` file (if this hasn't been done automatically) see the [`ConfiguringNotebookEnvironment`](https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/ConfiguringNotebookEnvironment.ipynb) notebook in the root folder of your Azure-Sentinel-Notebooks project. This shows you how to obtain your Workspace and Subscription IDs from the Microsoft Sentinel Portal. You can use the SubscriptionID to find your Tenant ID). To view the current `config.json` run the following in a code cell.\n",
    "\n",
    "```%pfile config.json```\n",
    "\n",
    "For help with setting up your `msticpyconfig.yaml` see the [Setup](#Setup) section at the end of this notebook and the [ConfigureNotebookEnvironment notebook](https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/ConfiguringNotebookEnvironment.ipynb)\n",
    "</details>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Import and initialize notebooklets\n",
    "\n",
    "This imports the **msticnb** package and the notebooklets classes.\n",
    "\n",
    "These are needed for the notebook operations"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "import msticnb as nb\n",
    "\n",
    "nb.init(query_provider=qry_prov)\n",
    "pivot.timespan = qry_prov.query_time.timespan"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Enter host name and query time window\n",
    "Type the host name that you want to search for and the time bounds over which you want to search. "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "gather": {
     "logged": 1617819547778
    }
   },
   "outputs": [],
   "source": [
    "host_txt = nbwidgets.GetText(\n",
    "    prompt=\"Enter the Host name to search for:\", value=host_name\n",
    ")\n",
    "display(host_txt)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Review host overview\n",
    "\n",
    "The following cells runs the Host Summary Notebooklet to provide an overview of the host, and its activty within the timeframe specified.\n",
    "Use the output of this cell to understand the context of its host and identify areas of further investigation."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "host_nb = nb.nblts.azsent.host.HostSummary()\n",
    "\n",
    "md(\n",
    "    \"Note: Different result properties are populated depending on the account type\",\n",
    "    \"large, bold\",\n",
    ")\n",
    "host_result = host_nb.run(\n",
    "    value=host_txt.value,\n",
    "    timespan=qry_prov.query_time.timespan,\n",
    "    silent=True\n",
    ")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Review alerts\n",
    "The following cell returns a list of all Microsoft Sentinel alerts reated to the host. You can browse and review these alerts."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "host_result.notebooklet.browse_alerts()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Below is a timeline of the alerts related to the host."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "if host_result.alert_timeline:\n",
    "    display(host_result.display_alert_timeline())\n",
    "else:\n",
    "    md(f\"No alerts for {host_txt.value}\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Review bookmarks\n",
    "If there are any bookmarks referencing this host they can be viewed by calling `host_result.related_bookmarks`. <br>\n",
    "Review these bookmarks to see if this host has been flagged as part of a previous investigation or threat hunt."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "if (\n",
    "    isinstance(host_result.related_bookmarks, pd.DataFrame)\n",
    "    and not host_result.related_bookmarks.empty\n",
    "):\n",
    "    display(host_result.related_bookmarks)\n",
    "else:\n",
    "    md(f\"No bookmarks for {host_txt.value}\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Summarize Host Events\n",
    "\n",
    "As there are likely to be a large number of log events for a host the below table is a summary of all the events from the host.<br>\n",
    "You can use this table to idenfify addtional queries to run to review specific types of log entries.\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "host_result.summary"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Noteable Host Events\n",
    "Some log events such as those of a high severity are considered to be \"noteable\" events.\n",
    "Review these events and combined with the summary of all events you can identify additional queries to run to review specific types of log entries.\n",
    "\n",
    "To access the DataFrames output by this code call `host_result.scheduled_tasks`, `host_result.account_actions` or `host_result.notable_events` to access to data."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "schld_source_columns = [\n",
    "    \"Service\",\n",
    "    \"ServiceType\",\n",
    "    \"ServiceStartType\",\n",
    "    \"ScheduledTaskDetails\",\n",
    "    \"Account\",\n",
    "    \"TimeGenerated\",\n",
    "    \"Activity\",\n",
    "]\n",
    "account_source_columns = [\"TargetAccount\", \"Activity\", \"TimeGenerated\", \"Account\"]\n",
    "notable_source_columns = [\"Account\", \"TimeGenerated\", \"Activity\"]\n",
    "if host_result.host_entity.OSFamily.name == \"Linux\":\n",
    "    schld_source_columns = [\"CMD\", \"User\", \"CronUser\", \"EditStatus\", \"TimeGenerated\"]\n",
    "    account_source_columns = [\"User\", \"Group\", \"TimeGenerated\", \"UserGroupAction\"]\n",
    "    notable_source_columns = [\"Facility\", \"TimeGenerated\", \"SeverityLevel\"]\n",
    "\n",
    "if not host_result.scheduled_tasks.empty:\n",
    "    host_result.scheduled_tasks.mp_plot.timeline(\n",
    "        group_by=\"Type\",\n",
    "        source_columns=schld_source_columns,\n",
    "        title=\"Service and Scheduled Task Events\",\n",
    "    )\n",
    "    md(\"Events related to Services and Scheduled Tasks:\", \"bold\")\n",
    "    display(host_result.scheduled_tasks)\n",
    "\n",
    "if not host_result.account_actions.empty:\n",
    "    host_result.account_actions.mp_plot.timeline(\n",
    "        group_by=\"EventID\",\n",
    "        source_columns=account_source_columns,\n",
    "        title=\"Account modification Events\",\n",
    "    )\n",
    "    md(\"Events related to account modifications:\", \"bold\")\n",
    "    display(host_result.account_actions)\n",
    "\n",
    "if not host_result.notable_events.empty:\n",
    "    host_result.notable_events.mp_plot.timeline(\n",
    "        group_by=\"EventID\", source_columns=notable_source_columns, title=\"Other Events\"\n",
    "    )\n",
    "    md(\"Other Events\", \"Bold\")\n",
    "    display(host_result.notable_events)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Review Host Logons\n",
    "Host activity is often driven by user actions. The following cell runs the Host Logon Notebooklet that summarizes logon sessions related to the host.<br>\n",
    "Review the output of this notebooklet to identify logon sessions of note."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "host_logons_nb = nb.nblts.azsent.host.HostLogonsSummary()\n",
    "\n",
    "md(\n",
    "    \"Note: Different result properties are populated depending on the account type\",\n",
    "    \"large, bold\",\n",
    ")\n",
    "host_logons_result = host_logons_nb.run(\n",
    "    value=host_txt.value,\n",
    "    timespan=qry_prov.query_time.timespan,\n",
    ")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "def most_common_users():\n",
    "    if host_result.host_entity.OSFamily.name == \"Windows\":\n",
    "        accounts = host_logons_result.logon_sessions[\"Account\"].value_counts()\n",
    "        accounts.drop(index=\"NT AUTHORITY\\SYSTEM\", inplace=True)\n",
    "        computer_accounts  = [row for row in accounts.index if row.endswith(\"$\")]\n",
    "        accounts.drop(index=computer_accounts, inplace=True)\n",
    "        return [account.split(\"\\\\\")[1] for account in accounts.index]\n",
    "\n",
    "\n",
    "users = most_common_users()\n",
    "user_name = user_name or users[0]\n",
    "user_param = widgets.Combobox(\n",
    "    description=\"Select User Account To Focus On\",\n",
    "    value=user_name,\n",
    "    options=list(users),\n",
    ")\n",
    "user_param"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "user_name = user_param.value\n",
    "if isinstance(host_logons_result.logon_sessions, pd.DataFrame) and not host_logons_result.logon_sessions.empty:\n",
    "    md(f\"Logon sessions for {user_name}:\", \"bold\")\n",
    "    display(host_logons_result.logon_sessions[host_logons_result.logon_sessions[\"TargetUserName\"].str.contains(user_name, case=False)])\n",
    "else:\n",
    "    md(\"No valid logon sessions found\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Host Processes\n",
    "The following is a process tree of all the processes executed on the host in the time window defined.\n",
    "You can interact with the tree to see parent and child processes."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "if isinstance(host_result.processes, pd.DataFrame) and not host_result.processes.empty:\n",
    "    host_result.processes.mp_plot.process_tree()\n",
    "else:\n",
    "    md(\"No process execution information found.\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The above process tree may be too large to find events of value, the following is a processes tree to processeses associated with the defined user (if no user is defined then the most commonly seen user is used)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "gather": {
     "logged": 1617821408848
    }
   },
   "outputs": [],
   "source": [
    "if isinstance(host_result.processes, pd.DataFrame) and not host_result.processes.empty:\n",
    "    if not host_result.processes[\n",
    "        host_result.processes[\"Account\"].str.contains(user_name, case=False)\n",
    "    ].empty:\n",
    "        md(f\"Processes executed by {user_name}\", \"bold\")\n",
    "        host_result.processes[\n",
    "            host_result.processes[\"Account\"].str.contains(user_name, case=False)\n",
    "        ].mp_plot.process_tree()\n",
    "    else:\n",
    "        md(f\"No processes executed by {user_name}\")\n",
    "else:\n",
    "    md(\"No process execution information found.\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Extract IOCs related to these processes and look them up against Threat Intelligence\n",
    "Process data often contains command line activity, we can extract IoCs from these command lines and look them up in Threat Intelligence sources to help narrow focus on interesting processes.\n",
    "\n",
    "To access the DataFrames output by this code call `host_result.processes` or `process_ti_results` to access to data."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "from msticnb.nb.azsent.host.host_summary import _process_ti\n",
    "\n",
    "if isinstance(host_result.processes, pd.DataFrame) and not host_result.processes.empty:\n",
    "    user_processes = host_result.processes[\n",
    "        host_result.processes[\"Account\"].str.contains(user_name, case=False)\n",
    "    ]\n",
    "    if host_result.host_entity.OSFamily.name == \"Windows\":\n",
    "        cmd_column = \"CommandLine\"\n",
    "    else:\n",
    "        cmd_column = \"SyslogMessage\"\n",
    "\n",
    "    ti_prov = host_nb.ti_prov if hasattr(host_nb, \"ti_prov\") else TILookup()\n",
    "\n",
    "    process_ti_results = _process_ti(user_processes, cmd_column, ti_prov)\n",
    "    if isinstance(process_ti_results, pd.DataFrame) and not process_ti_results.empty:\n",
    "        md(f\"TI results for processes executed by {user_name}\")\n",
    "        display(process_ti_results)\n",
    "    else:\n",
    "        md(\"No TI results found.\")\n",
    "else:\n",
    "    md(\"No process execution information found.\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Review Network Connections\n",
    "A hosts network traffic can often help identify anomolous or suspicious patterns of activity.<br>\n",
    "The cell below runs the Host Network Connections Notebooklet that summarizes network connections related to the host.<br>\n",
    "Review the output of this cell to identify suspicious network connection patterns.\n",
    "\n",
    "\n",
    "To access the DataFrames output by this code call `host_network_result.flows`, `host_network_result.flows_ti` to access to data."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "host_network_nb = nb.nblts.azsent.host.HostNetworkSummary()\n",
    "\n",
    "md(\n",
    "    \"Note: Different result properties are populated depending on the account type\",\n",
    "    \"large, bold\",\n",
    ")\n",
    "host_network_result = host_network_nb.run(\n",
    "    value=host_result.host_entity,\n",
    "    timespan=qry_prov.query_time.timespan,\n",
    ")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "## Use other notebooklets and pivots functions to drill down on other entities\n",
    "\n",
    "You may want to drill down on other entities in the Host data.\n",
    "You can use methods of the IpAddress or Account entities, for example,\n",
    "to look at these in more detail.\n",
    "\n",
    "Run the ip_address_summary notebooklet pivot\n",
    "```python\n",
    "IpAddress = entities.IpAddress\n",
    "ip_result = IpAddress.nblt.ip_address_summary(\"157.56.162.53\")\n",
    "```\n",
    "\n",
    "View the TI results\n",
    "```python\n",
    "ip_result.browse_ti_results()\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "# More information:\n",
    "\n",
    "## Notebooklets and Pivots\n",
    "[Notebooklets](https://msticnb.readthedocs.io/en/latest/)\n",
    "\n",
    "[Pivot functions](https://msticpy.readthedocs.io/en/latest/data_analysis/PivotFunctions.html)\n",
    "\n",
    "## Notebook/MSTICPy configuration\n",
    "[Getting Started](https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/A%20Getting%20Started%20Guide%20For%20Azure%20Sentinel%20ML%20Notebooks.ipynb)<br>\n",
    "[MSTICPy Configuration guide](https://msticpy.readthedocs.io/en/latest/getting_started/msticpyconfig.html)\n",
    "\n",
    "[ConfigureNotebookEnvironment notebook](https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/ConfiguringNotebookEnvironment.ipynb)"
   ]
  }
 ],
 "metadata": {
  "celltoolbar": "Tags",
  "file_extension": ".py",
  "hide_input": false,
  "history": [],
  "kernel_info": {
   "name": "python38-azureml"
  },
  "kernelspec": {
   "display_name": "Python 3.8 - AzureML",
   "language": "python",
   "name": "python38-azureml"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.10"
  },
  "latex_envs": {
   "LaTeX_envs_menu_present": true,
   "autoclose": false,
   "autocomplete": true,
   "bibliofile": "biblio.bib",
   "cite_by": "apalike",
   "current_citInitial": 1,
   "eqLabelWithNumbers": true,
   "eqNumInitial": 1,
   "hotkeys": {
    "equation": "Ctrl-E",
    "itemize": "Ctrl-I"
   },
   "labels_anchors": false,
   "latex_user_defs": false,
   "report_style_numbering": false,
   "user_envs_cfg": false
  },
  "microsoft": {
   "host": {
    "AzureML": {
     "notebookHasBeenCompleted": true
    }
   }
  },
  "mimetype": "text/x-python",
  "name": "python",
  "npconvert_exporter": "python",
  "nteract": {
   "version": "nteract-front-end@1.0.0"
  },
  "pygments_lexer": "ipython3",
  "toc": {
   "base_numbering": 1,
   "nav_menu": {},
   "number_sections": true,
   "sideBar": true,
   "skip_h1_title": false,
   "title_cell": "Contents",
   "title_sidebar": "Contents",
   "toc_cell": true,
   "toc_position": {
    "height": "calc(100% - 180px)",
    "left": "10px",
    "top": "150px",
    "width": "323.667px"
   },
   "toc_section_display": true,
   "toc_window_display": true
  },
  "uuid": "752d7f6a-d842-43cc-b46d-4d9e9a2c1160",
  "varInspector": {
   "cols": {
    "lenName": 16,
    "lenType": 16,
    "lenVar": 40
   },
   "kernels_config": {
    "python": {
     "delete_cmd_postfix": "",
     "delete_cmd_prefix": "del ",
     "library": "var_list.py",
     "varRefreshCmd": "print(var_dic_list())"
    },
    "r": {
     "delete_cmd_postfix": ") ",
     "delete_cmd_prefix": "rm(",
     "library": "var_list.r",
     "varRefreshCmd": "cat(var_dic_list()) "
    }
   },
   "position": {
    "height": "649.85px",
    "left": "1596px",
    "right": "20px",
    "top": "120px",
    "width": "350px"
   },
   "types_to_exclude": [
    "module",
    "function",
    "builtin_function_or_method",
    "instance",
    "_Feature"
   ],
   "window_display": false
  },
  "version": 3,
  "vscode": {
   "interpreter": {
    "hash": "739aa94d41434660cad201339437bbf6f0b217d6c8b6dd6d17fce87baec5c88f"
   }
  },
  "widgets": {
   "application/vnd.jupyter.widget-state+json": {
    "state": {},
    "version_major": 2,
    "version_minor": 0
   }
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}