tutorials-and-examples/feature-tutorials/PivotFunctions-Introduction.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# MSTICPy Pivot Functions\n",
    "\n",
    "We recently released a new version of *MSTICPy* with a feature called **Pivot functions**.\n",
    "You must have msticpy installed to run this notebook:\n",
    "```\n",
    "%pip install --upgrade msticpy\n",
    "```\n",
    "\n",
    "MSTICpy versions >= 1.0.0\n",
    "\n",
    "This feature has three main goals:\n",
    "- Making it easy to discover and invoke *MSTICPy* functionality\n",
    "- Creating a standardized way to call pivotable functions\n",
    "- Letting you assemble multiple functions into re-usable pipelines.\n",
    "\n",
    "Here are a couple of examples showing calling different kinds of\n",
    "enrichment functions from the IpAddress entity:\n",
    "\n",
    "```python\n",
    "\n",
    "    >>> from msticpy.datamodel.entities import IpAddress, Host\n",
    "    >>> IpAddress.util.ip_type(ip_str=\"157.53.1.1\"))\n",
    "    ip          result\n",
    "    157.53.1.1  Public\n",
    "\n",
    "    >>> IpAddress.util.whois(\"157.53.1.1\"))\n",
    "    asn  asn_cidr  asn_country_code  asn_date    asn_description  asn_registry  nets .....\n",
    "    NA   NA        US                2015-04-01  NA               arin          [{'cidr': '157.53.0.0/16'...\n",
    "\n",
    "    >>> IpAddress.util.geoloc(value=\"157.53.1.1\"))\n",
    "    CountryCode  CountryName    State   City   Longitude   Latitude   Asn...\n",
    "    US           United States  None    None   -97.822     37.751     None...\n",
    "```\n",
    "\n",
    "This second example shows a pivot function that does a data query for host\n",
    "logon events from a Host entity.\n",
    "\n",
    "```python\n",
    "    >>> Host.AzureSentinel.list_host_logons(host_name=\"VictimPc\")\n",
    "    Account               EventID   TimeGenerated                      Computer                 SubjectUserName   SubjectDomainName\n",
    "    NT AUTHORITY\\SYSTEM   4624      2020-10-01 22:39:36.987000+00:00   VictimPc.Contoso.Azure   VictimPc$         CONTOSO\n",
    "    NT AUTHORITY\\SYSTEM   4624      2020-10-01 22:39:37.220000+00:00   VictimPc.Contoso.Azure   VictimPc$         CONTOSO\n",
    "    NT AUTHORITY\\SYSTEM   4624      2020-10-01 22:39:42.603000+00:00   VictimPc.Contoso.Azure   VictimPc$         CONTOSO\n",
    "```\n",
    "\n",
    "The pivot functionality exposes operations relevant to a particular\n",
    "entity as methods (or functions) of that entity. These operations include:\n",
    "\n",
    "-  Data queries\n",
    "-  Threat intelligence lookups\n",
    "-  Other data lookups such as geo-location or domain resolution\n",
    "-  and other local functionality\n",
    "\n",
    "You can also add other functions from 3rd party Python packages or\n",
    "ones you write yourself as pivot functions.\n",
    "\n",
    "\n",
    "## Terminology\n",
    "Before we get into things let's clear up a few terms.\n",
    "\n",
    "### Entities\n",
    "These are Python classes that represent real-world objects\n",
    "commonly encountered in CyberSec investigations and hunting. E.g. Host,\n",
    "URL, IP Address, Account, etc.\n",
    "\n",
    "### Pivoting\n",
    "This comes from the common practice in CyberSec investigations\n",
    "of navigating from one suspect entity to another. E.g. you might start\n",
    "with an alert identifying a potentially malicious IP Address, from there you\n",
    "'pivot' to see which hosts or accounts were communicating with that \n",
    "address. From there you might pivot again to look at processes running on\n",
    "the host or Office activity for the account."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Background Reading"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "This article is available in Notebook form so that you can try out the examples. [TODO]\n",
    "\n",
    "There is also full documenation of the Pivot functionality on our [ReadtheDocs page](https://msticpy.readthedocs.io/en/latest/data_analysis/PivotFunctions.html)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<hr>\n",
    "\n",
    "## Life before pivot functions\n",
    "\n",
    "Before Pivot functions your ability to use the various bits of\n",
    "functionality in *MSTICPy* was always bounded by you knowledge of\n",
    "where a certain function was (or your enthusiasm for reading the docs).\n",
    "\n",
    "For example, suppose you had an IP address that you wanted to do \n",
    "some simple enrichment on."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [],
   "source": [
    "ip_addr = \"20.72.193.242\""
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "First you'd need to locate and import the functions. There\n",
    "might also be (as in the GeoIPLiteLookup class) some initialization\n",
    "step you'd need to do before using the functionality."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [],
   "source": [
    "from msticpy.sectools.ip_utils import get_ip_type\n",
    "from msticpy.sectools.ip_utils import get_whois_info\n",
    "from msticpy.sectools.geoip import GeoLiteLookup\n",
    "geoip = GeoLiteLookup()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Next you might have to check the help for each function to\n",
    "work it parameters."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Help on function get_ip_type in module msticpy.sectools.ip_utils:\n",
      "\n",
      "get_ip_type(ip: str = None, ip_str: str = None) -> str\n",
      "    Validate value is an IP address and deteremine IPType category.\n",
      "    \n",
      "    (IPAddress category is e.g. Private/Public/Multicast).\n",
      "    \n",
      "    Parameters\n",
      "    ----------\n",
      "    ip : str\n",
      "        The string of the IP Address\n",
      "    ip_str : str\n",
      "        The string of the IP Address - alias for `ip`\n",
      "    \n",
      "    Returns\n",
      "    -------\n",
      "    str\n",
      "        Returns ip type string using ip address module\n",
      "\n"
     ]
    }
   ],
   "source": [
    "help(get_ip_type)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Then finally run the functions"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'Public'"
      ]
     },
     "execution_count": 5,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "get_ip_type(ip_addr)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "('MICROSOFT-CORP-MSN-AS-BLOCK, US',\n",
       " {'nir': None,\n",
       "  'asn_registry': 'arin',\n",
       "  'asn': '8075',\n",
       "  'asn_cidr': '20.64.0.0/10',\n",
       "  'asn_country_code': 'US',\n",
       "  'asn_date': '2017-10-18',\n",
       "  'asn_description': 'MICROSOFT-CORP-MSN-AS-BLOCK, US',\n",
       "  'query': '20.72.193.242',\n",
       "  'nets': [{'cidr': '20.34.0.0/15, 20.48.0.0/12, 20.36.0.0/14, 20.40.0.0/13, 20.33.0.0/16, 20.128.0.0/16, 20.64.0.0/10',\n",
       "    'name': 'MSFT',\n",
       "    'handle': 'NET-20-33-0-0-1',\n",
       "    'range': '20.33.0.0 - 20.128.255.255',\n",
       "    'description': 'Microsoft Corporation',\n",
       "    'country': 'US',\n",
       "    'state': 'WA',\n",
       "    'city': 'Redmond',\n",
       "    'address': 'One Microsoft Way',\n",
       "    'postal_code': '98052',\n",
       "    'emails': ['msndcc@microsoft.com',\n",
       "     'IOC@microsoft.com',\n",
       "     'abuse@microsoft.com'],\n",
       "    'created': '2017-10-18',\n",
       "    'updated': '2017-10-18'}],\n",
       "  'raw': None,\n",
       "  'referral': None,\n",
       "  'raw_referral': None})"
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "get_whois_info(ip_addr)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "([{'continent': {'code': 'NA',\n",
       "    'geoname_id': 6255149,\n",
       "    'names': {'de': 'Nordamerika',\n",
       "     'en': 'North America',\n",
       "     'es': 'Norteamérica',\n",
       "     'fr': 'Amérique du Nord',\n",
       "     'ja': '北アメリカ',\n",
       "     'pt-BR': 'América do Norte',\n",
       "     'ru': 'Северная Америка',\n",
       "     'zh-CN': '北美洲'}},\n",
       "   'country': {'geoname_id': 6252001,\n",
       "    'iso_code': 'US',\n",
       "    'names': {'de': 'USA',\n",
       "     'en': 'United States',\n",
       "     'es': 'Estados Unidos',\n",
       "     'fr': 'États-Unis',\n",
       "     'ja': 'アメリカ合衆国',\n",
       "     'pt-BR': 'Estados Unidos',\n",
       "     'ru': 'США',\n",
       "     'zh-CN': '美国'}},\n",
       "   'location': {'accuracy_radius': 1000,\n",
       "    'latitude': 47.6032,\n",
       "    'longitude': -122.3412,\n",
       "    'time_zone': 'America/Los_Angeles'},\n",
       "   'registered_country': {'geoname_id': 6252001,\n",
       "    'iso_code': 'US',\n",
       "    'names': {'de': 'USA',\n",
       "     'en': 'United States',\n",
       "     'es': 'Estados Unidos',\n",
       "     'fr': 'États-Unis',\n",
       "     'ja': 'アメリカ合衆国',\n",
       "     'pt-BR': 'Estados Unidos',\n",
       "     'ru': 'США',\n",
       "     'zh-CN': '美国'}},\n",
       "   'subdivisions': [{'geoname_id': 5815135,\n",
       "     'iso_code': 'WA',\n",
       "     'names': {'en': 'Washington',\n",
       "      'es': 'Washington',\n",
       "      'fr': 'Washington',\n",
       "      'ja': 'ワシントン州',\n",
       "      'ru': 'Вашингтон',\n",
       "      'zh-CN': '华盛顿州'}}],\n",
       "   'traits': {'ip_address': '20.72.193.242', 'prefix_len': 18}}],\n",
       " [IpAddress(Address=20.72.193.242, Location={ 'AdditionalData': {},\n",
       "    'CountryCode': 'US',\n",
       "   ...)])"
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "geoip.lookup_ip(ip_addr)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "At which point you'd discover that the output from each\n",
    "function was somewhat raw and it would take a bit more\n",
    "work if you wanted to combine it in any way (say in a single table).\n",
    "\n",
    "We'll see how pivot functions address these problems in the remainder\n",
    "of the notebook."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Getting Started with Pivot functions\n",
    "Typically we use *MSTICPy*'s `init_notebook` function that handles\n",
    "checking versions and importing some commonly-used packages and modules\n",
    "(both *MSTICPy* and 3rd party packages like *pandas*"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "msticpy version installed: 1.0.0rc4 latest published: 0.9.0\n",
      "Latest version is installed.\n",
      "Processing imports....\n",
      "Checking configuration....\n",
      "No errors found.\n",
      "No warnings found.\n",
      "Setting notebook options....\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<h3>Notebook setup complete</h3>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "from msticpy.nbtools.nbinit import init_notebook\n",
    "init_notebook(namespace=globals());"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "There are some preliminary steps needed before you can use\n",
    "pivot functions. The main one is loading the `Pivot` class.\n",
    "Pivot functions are added to the entities dynamically. The Pivot\n",
    "class will try to discover relevant functions from queries, \n",
    "Threat Intel providers and various utility functions.\n",
    "\n",
    "In some cases, notably data queries, the data query functions\n",
    "are themselves created dynamically, so these need to be loaded\n",
    "before you create the Pivot class. (You can always create a new instance\n",
    "of this class, which forces re-discovery, so don't worry if mess up\n",
    "the order of things).\n",
    "\n",
    "> Note in most cases we don't need to connect/authenticate to\n",
    "> a data provider prior to loading *Pivot*\n",
    "\n",
    "Let's load our data query provider for AzureSentinel"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Please wait. Loading Kqlmagic extension...\n"
     ]
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.reconnect();} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "az_provider = QueryProvider(\"AzureSentinel\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Now we can load and instantiate the Pivot class.\n",
    "\n",
    "Why do we need to pass `namespace=globals()`?\n",
    "Pivot searches through the current objects defined in the Python/notebook\n",
    "namespace. This is most relevant for QueryProviders. In most other cases\n",
    "(like GeoIP and ThreatIntel providers, it will create new ones if it\n",
    "can't find existing ones)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Using Open PageRank. See https://www.domcop.com/openpagerank/what-is-openpagerank\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "\n",
       "This library uses services provided by ipstack.\n",
       "<a href=\"https://ipstack.com\">https://ipstack.com</a>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "from msticpy.datamodel.pivot import Pivot\n",
    "pivot = Pivot(namespace=globals())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Easy discovery of functionality"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Find the entity name you need\n",
    "\n",
    "The simplest way to do this is simply enumerate (`dir`) the\n",
    "contents of the *MSTPCPy* entities sub-package. This should\n",
    "have already been imported by the `init_notebook` function that\n",
    "we ran earlier.\n",
    "\n",
    "The items at the beginning of the list with proper capitalization are\n",
    "the entities."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "['Account',\n",
       " 'Alert',\n",
       " 'Algorithm',\n",
       " 'AzureResource',\n",
       " 'CloudApplication',\n",
       " 'Dns',\n",
       " 'ElevationToken',\n",
       " 'Entity',\n",
       " 'File',\n",
       " 'FileHash',\n",
       " 'GeoLocation',\n",
       " 'Host',\n",
       " 'HostLogonSession',\n",
       " 'IpAddress',\n",
       " 'Malware',\n",
       " 'NetworkConnection',\n",
       " 'OSFamily',\n",
       " 'Process',\n",
       " 'RegistryHive',\n",
       " 'RegistryKey',\n",
       " 'RegistryValue',\n",
       " 'SecurityGroup',\n",
       " 'Threatintelligence',\n",
       " 'UnknownEntity',\n",
       " 'Url',\n",
       " '__builtins__',\n",
       " '__cached__',\n",
       " '__doc__',\n",
       " '__file__',\n",
       " '__loader__',\n",
       " '__name__',\n",
       " '__package__',\n",
       " '__path__',\n",
       " '__spec__',\n",
       " 'account',\n",
       " 'alert',\n",
       " 'azure_resource',\n",
       " 'cloud_application',\n",
       " 'difflib',\n",
       " 'dns',\n",
       " 'entity',\n",
       " 'entity_enums',\n",
       " 'entity_graph',\n",
       " 'file',\n",
       " 'file_hash',\n",
       " 'find_entity',\n",
       " 'geo_location',\n",
       " 'host',\n",
       " 'host_logon_session',\n",
       " 'ip_address',\n",
       " 'malware',\n",
       " 'network_connection',\n",
       " 'process',\n",
       " 'registry_key',\n",
       " 'registry_value',\n",
       " 'security_group',\n",
       " 'threat_intelligence',\n",
       " 'unknown_entity',\n",
       " 'url']"
      ]
     },
     "execution_count": 10,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "dir(entities)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We're going to make this a little easier in a forthcoming\n",
    "update with this helper function.\n",
    "> <p style=\"color:red\"><b>Warning:</b> post-0.9.0 functionality</p>\n",
    "> This will throw and error in v0.9.0 of MSTICPy"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Match found 'IpAddress'\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "msticpy.datamodel.entities.ip_address.IpAddress"
      ]
     },
     "execution_count": 11,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "entities.find_entity(\"ip\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "No exact match found for 'azure'. \n",
      "Closest matches are 'AzureResource', 'Url', 'Malware'\n"
     ]
    }
   ],
   "source": [
    "entities.find_entity(\"azure\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Listing pivot functions available for an entity\n",
    "\n",
    "Note you can always address an entity using its qualified\n",
    "path, e.g. `entities.IpAddress` but if you are going\n",
    "to use one or two entities a lot it will save a bit of typing\n",
    "if you import them explicitly.\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [],
   "source": [
    "from msticpy.datamodel.entities import IpAddress, Host"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Once you have the entity you can use the `get_pivot_list()`\n",
    "function to see which pivot functions are available for it."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "['AzureSentinel.SecurityAlert_list_alerts_for_ip',\n",
       " 'AzureSentinel.SigninLogs_list_aad_signins_for_ip',\n",
       " 'AzureSentinel.AzureActivity_list_azure_activity_for_ip',\n",
       " 'AzureSentinel.AzureNetworkAnalytics_CL_list_azure_network_flows_by_ip',\n",
       " 'AzureSentinel.OfficeActivity_list_activity_for_ip',\n",
       " 'AzureSentinel.AzureNetworkAnalytics_CL_get_host_for_ip',\n",
       " 'AzureSentinel.Heartbeat_get_heartbeat_for_ip',\n",
       " 'AzureSentinel.Heartbeat_get_info_by_ipaddress',\n",
       " 'AzureSentinel.Syslog_list_logons_for_source_ip',\n",
       " 'AzureSentinel.ThreatIntelligenceIndicator_list_indicators',\n",
       " 'AzureSentinel.ThreatIntelligenceIndicator_list_indicators_by_ip',\n",
       " 'AzureSentinel.ThreatIntelligenceIndicator_list_indicators_by_hash',\n",
       " 'AzureSentinel.ThreatIntelligenceIndicator_list_indicators_by_filepath',\n",
       " 'AzureSentinel.ThreatIntelligenceIndicator_list_indicators_by_domain',\n",
       " 'AzureSentinel.ThreatIntelligenceIndicator_list_indicators_by_email',\n",
       " 'AzureSentinel.ThreatIntelligenceIndicator_list_indicators_by_url',\n",
       " 'ti.lookup_ip',\n",
       " 'ti.lookup_ipv4',\n",
       " 'ti.lookup_ipv4_OTX',\n",
       " 'ti.lookup_ipv4_Tor',\n",
       " 'ti.lookup_ipv4_VirusTotal',\n",
       " 'ti.lookup_ipv4_XForce',\n",
       " 'ti.lookup_ipv6',\n",
       " 'ti.lookup_ipv6_OTX',\n",
       " 'util.whois',\n",
       " 'util.ip_type',\n",
       " 'util.ip_rev_resolve',\n",
       " 'util.geoloc',\n",
       " 'util.geoloc_ips']"
      ]
     },
     "execution_count": 14,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "IpAddress.get_pivot_list()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Some of the function names are a little unweildy but, in \n",
    "many cases, this is necessary to avoid name collisions.\n",
    "You might notice from the list that the functions are\n",
    "grouped into containers \"AzureSentinel\", \"ti\" and \"util\" in \n",
    "the above example.\n",
    "\n",
    "Although this makes the function name even longer we thought\n",
    "that this helped to keep related functionality together - so\n",
    "you don't get a TI lookup, when you thought you were running\n",
    "a query.\n",
    "\n",
    "Fortunately Jupyter notebooks/IPython support tab completion\n",
    "so you should not normally have to remember these names.\n"
   ]
  },
  {
   "attachments": {
    "64c1580e-21f7-4ed3-af12-4f59ced1d67b.png": {
     "image/png": "iVBORw0KGgoAAAANSUhEUgAAArkAAAEhCAYAAAB7g7gHAAAgAElEQVR4nOyd/V9UZf7/9/H4/Bvf5OJA3Hm3muJNELop2p1GmWK1tmolLe1H8+unb3cuFlu5H3PXbFfZLLW0VEo3NFgyyxtKpURASUDEO/CmAQYQBhiEeX1/GK/DmZkz98MwM7yej8frUY+Za85c58x4zpNr3ue6fgNCCCGEEEIijN8MdQcIIYQQQggJNJRcQgghhBAScVByCSGEEEJIxEHJJYQQQgghEQcllxBCCCGERByUXEIIIYQQEnFQcgkhhBBCSMRBySWEEEIIIREHJZcQQgghhEQclFxCCCGEEBJxUHIJIYQQQkjEQcklhBBCCCERByWXEEIIIYREHJRcQgghhBAScVByCSGEEEJIxEHJJYQQQgghEQcllxBCCCGERByUXEIIIYQQEnFQcgkhhBBCSMRBySWEEEIIIREHJZcQQgghhEQclFxCCCGEEBJxUHIJIYQQQkjEQcklhBBCCCERByWXEEIIIYREHJRcQgghhBAScVByCSGEEEJIxEHJJYQQQgghEQcllxBCCCGERByUXAAPrDUyDMMwDMMwERRKLqyS29TcjOZhmAsXLuDYBTPDMAzDMExEhZILSu6Fpj6GYRiGYZiICiUXlNxWk4VhGIZhGCaiQskFJdd8GwzDMAzDMBEVSi4ouf0WMAzDMAzDRFQouaDkWgCGYRiGYZiICiUXlFxCCCGEkEiDkgtKLiGEEEJIpEHJBSWXkOHAf/3Xf+E3v/kNfvMbnvYIIWQ4wLM9KLmEDAcouYQQMrzg2R6UXEKGA5RcQggZXvBsD0ouIcMBSi4hhAwveLYHJZeQYGGxWIYsWskdyn4wDMO4CgkclFxQcgnxl6G+KHgSSi7DMJEU4h6PJXfGymI1T68tCWgnnl5bYrP9YH92lFxCvMOXE/L15k6My9yFpDnbseNgXdAvCJRchmEiOcQRryQ3GFByKbn+sHDhQgghUF5e7lH7zMxMCCFQUVExyD0LbwJxAt5aVIu4B7Yi7oGteOyVYqftJi3KV9vJfFxU6/f7U3IZhhlOIZRcAOEhufX19cjPz8fGjRuxYcOGoEpuRUUFhBAu46lUumPLli3qNp977jmvX0/JDSyuTqCzl3+NkY9+4vEJ19ORXEouwzBM4DKcoeQitCW3uroa27dvx4YNG2wSqZL76KOPIiEhAePGjcOYMWO8fj0l1388PXFKAR3Mk/Oqf56g5DIMwwQow42wlty2zl7Mef07zFhZjJUfnvL5PUNZcjdv3owNGzZg06ZNKCsrGxLJtUeKbaAxGo1QFAXPPfccVqxYASEEjh496tU2KLn+4c3JcrAkt7+/X82qfx5H3Oyt+Liw2uZxX6KVXH+3xTAM40uGWnKHm+iGteTuO95gc8Oar4Sy5B44cACFhYW4efMmmpubw0JyP/vsMwgh8Oabb6K2thbp6elQFAVCCEydOhU1NTW6r5OlCjt37sTRo0chhMCKFSucvk9xcTFSU1PVbcfHxyM2Ntap5Lpqby+5QghkZmYCAN59910kJiaqr1m9erXDts1mM1avXo34+HgIIRAbG4v09HSn+2oymfDCCy+o21UUBampqSgu1v8ee9veG+If2KYrqz/XNCH+ga2YtCgf/f22Yusqkxbl22xn0jP5iJu91SZbPZRWSi7DMMM1lF3/CWvJHQ4jufYJJ8mdN2+eKpTaJCUlwWAwOLwuIyMDiqKgp6cHAJCYmOi0ZGH16tVelU+4a68nuRMnTkR6erpu+/fee09tazabkZKSottOURSUlZXZbNtsNmPs2LFO+2KP2WzGmDFjnLb352TlakTWV8lN/n2+zYl60iJKLsMwTCBC2fWOsJbcQEHJ9Q5PJVeOaH700Ucwm81obW1VZdB+NNRoNCImJgYPP/yw+o9uyZIluiULhYWF6rYLCgpgNpsBAI2NjZg+fbqD5Grb79+/36b9tGnTnEquzKpVq9Da2goA+Nvf/gYhBGbMmKH2c9WqVRBC4Omnn1bbmUwmvPvuuxBCIC0tzeZEov0jQMq+2WzG4cOHMX36dKfHc968eWhqanJo78tJypOyAz3JdXjd7K1enaCltFJyGYZhAhPKrnMouaDkeounkpuUlITa2lqb52QZglYSgYFShU2bNjlsx75kQdbRFhQUOLy3Xk2uq/bOanLlKOzx48d193/y5Mlq/xMSEjB79mzdY/HEE09ACIErV66oj23atEmVVk9OLNr2gUBXVr2QXHlilaOy3pyM3UluX1+fTVb94zjiZn+MjwrPOTznbbSS6++2GIZhfE0oC2+kQckFJddbPJVcWdOq9/oxY8bY/IN69NFHIYTA1atX1cfMZjMURXEoWZA/3euhJ7mu2ruS3MmTJzvdR4knM0/Y98doNGLkyJEQQuC3v/0t3n33XXWEVg+j0YikpCSP27tC76TmieT29TmeTD2VXO3JXUrrxx5KKyWXYZjhnKEQ3kiCkgtKrrcEQnK1taRyVoUZM2Y4tH344YcdShZcCaie5LpqPxSSCwAGgwELFiywqVn+7W9/6/RGMm/b6+HshOZKcuNmW2tsvZFcVydsSi7DMIzvCZbsRgphLbm88Sz8JNdsNjv83K9dAMJZtCULiqJAURTd95blAVqpdNV+3rx5AZFcZ0LvDpPJhK+//trmBrf8/Hyv2u/Zs8ft+7g6melJbn9/P36qNngkud6coH2V3C1fn0Nvb69f0Uquv9tiGIZxl1CT3uEoumEtucNhCrFIk1xZX5qZman+I5Kjr64ybtw4dRvy5jV7MdXe8KaVXE/a+yq5UtoTEhLUG9p85ZNPPvFKmD1t7+5EJlcYa27vtjkhZrzyH6eS29fXh7jZHyNu9scwdZs9Ohn39vZi5Qc/Im72R/jIQ2mV7Sm5DMMMpwym8A4n0Q1ryeVIbmhL7rRp09DY2AjAKoMfffSR+nO7LD8wm82IiYlxqNHVMnnyZAgh1JvA5GwGM2bMgNFohMlkcpgiTCu52vatra267X2VXGCgnjg5ORknT5502/6dd97B6tWrce7cOfUxk8mkztxgv5yxt+0lBoMB48aNgxAC2dnZTk9iacv+jbgHtmLFxh/R1dOL5rZuPLKqUB2p1Uqu9oQ65Q/5iJv9MZ7/61E0tXY5CK1eBlNyd+7ciZiYGMTExGDfvn0Oz1NyGYYJ5wRSdoeL6Ia15AaKUJbc3bt3Oyzpa5+amppBlVxvl/XVjpDqRTt9mGz73HPPOf3HJIV01apVAKzypjf/bkpKCl599VWH/hgMBsTExLhs74/kGgwG9cYwvWhHrbX7oxdFURz64q69s9Xd3nrrLZu2zk5guZ+cdpjHNm72Vjy4olCV3Nu9jifSt7afUkdzrfkIcbM/QvLvd6sn5dJzN9XHHTLLmpUf/ACz2Qyz2YyTv9xQH3eWlR/8gJ477bVJSUlBVFQUoqKisGDBAofntZJr/xzDMMxQZjCEl6JLyQVAyXVHICTX2Qpd8savwsJCp+9//Phxh5KF2tpaTJ06FUJY57994YUXYDabVSG0Fz937f2RXMAqutoVyVxJrhxJHj16tNomPj4eCxYsUEe+tXjbHrCWKNy8edPtSK52aq+Rcz9B3OytGDn3E6z+6Gf09/cj/oGPkbxoj67k9vX14YO9ZzHm8U9t5FUruZ5KqzzR+yO52pHcvXv3OjxPyWUYJhzjr/AGSnbDEa8kV+bptSUB7cTTa0tstk/JDV58KVdwh7vZFcjg4ukJy9Npv/Rqa53F05N2T09P0KOV3KF4f4ZhGFcJhPT6KruRKroeS24kQ8kNLJTcocObn5+8FVxfxDZQJ//u7m6/o5XcQGyPYRjGVYIhv97K7nArXaDkgpIbaCi5Q4O/ghsouQ2GsPoSSi7DMKEeX4U3ELIbiaJLyQUlN9BQcoeGYAmuN2Lr6Ym9q6tr0KOV3GC8H8MwjKv4K76eyu5giG64QMkFJZeEP8EQXH/FdqgvKJRchmHCJf4KL0XXCiUXlFwS/gRScD2VW3cCazKZ3KazszNo0UpuMN+XYRjGVTw5V7oTYX9k11fRDQcouaDkkvAmkDeZuRJcvVFab8TW0xN+R0cHwzBMRCYQ4utu1Ndedt2Jrj83o4U6lFxQckl4M9iC64vcBlpi29vbGYZhwiqBlmB/ZHewRDfUoeSCkkvCl8ESXGc1tu5Gbb0R2qG+ADEMw4RKvBFfd6O7zmp4h6PoUnJBybUATBim32Jxm77+fofc7uuzif2Jr7unR01Xd7caU1eXmk6TCR2dnWpudXSo0TuBt7a1OY2xtZVhGGZYxtW5Ue9cqj3Xas/BnSaTzTlae+7WntPtz/f21wO9a4Yn15qhvh46CyUXlNx+C5gwTF+/xWVu9/U7pLe3zyE95l70mHvR3WNGV3ePGlNXt5pOUxc6TV24dasT7e0dalrb2tUYW9ts0mJsVdPcYkRTc4vLGJqaGYZhhkXcnQ+bW4w251D786v23Ks9J9+61amer7XncO25vbvHrJ739a4JetcOd9ebob4eOgslF5Rc820wYZieXovLdJv7HdLVc9smnd296Ogyo6PLjFumHjXtnd1o7+xG260utN3qQmu7CS2tt9Q0GdvRZGyHoaUNvza3qrnZZLTJjV9bHHL9ZrNXuXajiWEYJizj7flO75xpf17VnnMNLW3q+Vh7jm5tN6nnb3k+157j5Xm/s7vX4bqgd+1wd70Z6uuhs1ByQcltNVmYMIuxs89tWjpu26T5Vq9NDO1mGNrN+LWtBzdbu9XcMHZZ09KJ600duGa4haKiIoZhGCaMcs1wC9ebOnCjpVM9r2vP9b+29ajXAfvrg/31w5NrzlBfF/VCyQUl90JTHxNmqTPcdpnzv/Y6pPaGeSDXu1F9rQvV17pwrtGk5peGTvzS0Imqhg6cudJuzeU2FBUVYcm2doZhGMaPAIDRaBz0FBUV4czlNvU8XtXQoZ7fted8eR2ovd5tc43Qu4a4u+4M9XVRL5RcWCV3+8ku/LuiB99Um3H4vBlHL5hxjGFCNEfP97jMkdpu29R02eRwtQnfV3fi++pOfHfuljW/tOO7X9rxbVUbvjljxDdnjCiuaMZ/KpoouQzDMAEIEDzJ/U9FE4ormtXz+bdVbep5Xp735XXgcLXJ4Tphfx1xd90Z6uuiXii5sEouw4RLZr/b4ibNjnmnSc2sdwyY9fZNa/5yQ5PrSM+9hvTcRqS/1YCZb17FzDVXMHPNZRRSchmGYfwOEDzJnbnmsvUc/uZVpL/VYD23517DrL9ctz33y+vBOwaba4XutcTN9Weor4/2oeQSEmZ4Ozeu3py42uV55Vy4cu5bOb9tW1sbjEYjmpubOZLLMAwTgADBk9zm5mYYjUa0tbWp8+3KOXXt59CVC0a4mzs33ObMpeQSEmZ4u/iDnuBqJVe7yIMU3Pb2drS2tqKlpQUGg4GSyzAME4AAwZNcg8GAlpYWtLa2qgtOdHZ22iwaoZVcPdH1dnGIUIOSS0gY4e8orr3g9vT02KxgZi+4TU1NuH79OiWXYRgmAAGCJ7nXr19HU1OTg+hqV0izH801m80RNZpLySUkjPBHcuUJzN0obltbG1pbW9HU1ISbN2/i2rVrlFyGYZgABAie5F67dg03b95EU1MTWltbbcoWXI3m2osuJZcQEhT8KVXQk1xngtvc3AyDwYDr16+joaGBksswDBOAAMGT3IaGBly/fh0GgwHNzc1ORddbyQ2nkgVKLiFhRCBLFZyN4hqNRjQ1NeHGjRtobGzE5UuXAiK5r3/VgdwiE1bmdwz5hYZhGGYoAgRPci9fuoTGxkbcuHEDTU1NDjehuRrN9adkIZSg5BISRvgquXo3nGkFt7OzUx3F1dbiXr16FfX19X5J7sr8Dpy93mezH3tO9+CPn90a8gsOwzBMMAMET3Lr6+tx9epVh9rctrY29bzvbDTX3Q1olFxCSMAJZD2uq1IFOYp75coV1NXV+SS5f/zsFvac7lH7fvh8L/5SZFKF99eOPqz/tmvILzoMwzDBCuC95BYXF/skuXV1dbhy5Yo6mhvIkgVKLiEk4PgrufalCvKveTmjgtFoVCW3oaEBly9dwvnz572W3PXfduHXDqvMXmzpw1+KTDbPbz7WBZPZejI8e72PJQwMwwyLAN5JbnFxsRpvJff8+fO4fOkSGhoaVMk1Go3qTAva0Vx3JQuUXELIoBLIelz7UgX7eXFlqcLFixdRW1vrseRqSxNMZgu2n3Q+UvvHz27hwFmzun8sYQi9/HixF/0W4OatviHvC8PY518lXTD3A+Z+YNPR8PhVCPBccrWC663oFhUVoba2FhcvXlRLFuznzXVXshAJdbmUXELChMGqx5Vz4xqNRrS0tODmzZu4fv06rly5gvr6etTU1HgkufalCZ4K6+tfdURcCYPeKT5cLsLaGE2WsO7/cExukQkXmvpg7rf9/hWcMQ953wKdE5d71f07cbl3yPvjSQDPJFdPcL0R3aKiItTU1KC+vh5XrlzB9evXcfPmTbS0tMBoNOouDhGJdbmUXELChMGqx21vb0dbWxtaWlp063HPnTvnVnL/UmSCBfqlCZ5GljB09liQHeYjupEiuRzJDa+s3t+B7l59wQh1yf13ZQ/aui1eyWqkjuTqSa23oltUVIRz587p1uW2tLSgra1NHc2N5LpcSi4hYUKg6nH1ShWk5NpPHVZXV4eqqiq3kqudPeH7WrPXZQfaG9IA+CzKoZgLTdb9CpeLMBO+OXzeOrLZ3NmP98LsFxE5KhsuI7K+BnAtua5k1hvRLSoqQlVVFerq6hymErOXXE9LFii5hJBBw99FIDyVXLkAxOVLl1BbW+uV5Mr/dvZYPKqxXZnfge9rB+py5espuQzjfWoM1u9aqI/a6oWS69mNZt5Kbm1trXrzmXYqsUBIrivRDRUouYSECYMhubIeV3vT2bVr19DQ0KDedHbmzBmPJXfJNjmzgrUgsLPHoit39jedlV7uxcr8DvylyATAN8k9VGNWZ2zQw/7C/8GRLjR1DBQumswWHLvg/AJ7qMaM9p6B7bf3WHCoxr1MeCq53m7/3WLb2su+fuBCUx/eLfbvD4SCMwOfi8Rosjhtb4F15HBF/i2cuTbQH3M/cOCsfv/1+n7jVh8+OMI/BPxJXZN7yZWf74UmxxIUPdGU7U9c7sWG77tw49bALy5NHf3Y8L3+Z7Yi/xaOXei1+TfZ1NGPz37uUdsc19TUusJ+f/Rw9e8rt8hk893st1i/b1t+dHyNrENfsq0dRy/02nyfAyHggGeS62+boqIinDlzRr35rKGhAdeuXXO4+cxdXS4llxASFAZjZgU5iqtdylcruTU1NV5LrszmYwOyK28ok3PndvYMTB+mFVpfJVeOYLlCe6HUEzmJ/cV/Rf4tXGt3vn09WdDGneT6sv09p3vQ7+Q64q4/7uKL5LZ1W9Dc2e/YGTgKyvpvu9Cn39Tl+zCO2XS0y+n3xtlx9VVyrxj7dL9z3b0WvJRv+4tNbpHJ5g82e2S7YEjuv0q6nNYp621bSu4Vo/6/ycPn/RNdwL3kenpjmieSW1NT4yC52vly3dXl+jrDQqhAyQVw4cIFhgn51NXV6eb8+fM2qa2tVVNTU6Omuroa1dXVqKqqQlVVFc6cOYOKigpUVFTg9OnTOHXqFEpLS3H8+HGUlJTg6NGjOHjwIAoLC32S3CXbBhaEkKM5Um5/7ejXnUXBF8mVF/ruXmuJxJJtVnEs/MWMfoujOK3e34F+i237JdusUi5FTfu4rHPs7rXgwzsjP9rt27e3jzvJ9Xb7q/d3qKNLtYY+tfby5b0d+KqyBxXXAnuTmAXuJVdSY+jDGwUdWJF/Cz/dERj710qRKmuwttX23V9BH24JpuQC1hFQ+V1879sBedxdZvv9lyPK7T0WfFI68L3/8McuNLTpf8a+livUufn3JUeerxj78Gah9bzyRkEHau/8YWzuh42ka2cUuWJ0/D7f8PMmTCB4K54VFhbi4MGDOHr0KEpKSnD8+HGUlpbi1KlTOH36tHr+P3PmjHpdkNcJ7bVDe02xv944uy4N9fVShpILq+Q2NzcPy1y4cEGtyWFCOx0dHbppb2+3SVtbmxq5wIPRaJ0eTNbdNjU1qVOFXb9+XZ1NQS7+UFNTg7Nnz+L06dM4efKkz5Ir88fPbqH0zkXClRD6IrnyIlzW4HjxkRcs7QVQSuWO0m6H9v8qsUpD1fWBbd3qcdyGzDfVzoVBxp3ktnu5/aMXrP2vbw6OEHoqud9UO/5ELv+4+es3A59neaP1ePwU4bWXQ5HBLFfotwD/KrH9jkrx045urv/W+m/I3A/kevHveDAk9+Pj1r44+/5eNjoeL3nO0PtFR+6XP58REDzJPXnyJE6fPo2zZ8+ipqZGXRxCzrYgz/83b95UrwvyOiG3I0d8ZeyvN86uS0N9vZSh5IKSO9RfQsazBFJyDQaDW8k9c+ZMwCR3ybaBeXRdCWygR3IBx4uSvCi6PCfcucD99Rtrf5o7+3Xfe/X+DgCuJdCV5HqyfXvJlBdmVwttBDKeSq6rfdf2ddPRLnWEuqWzH4W/mNURXca/DKbketpe/mFW3ujdH2GDIbnyD9ofL+pvU/ZV+556fxjLSPz5jIDgS64sW3AluQaDgZIbqVByh/6LyLhPICS3ubnZpeRevHjRRnLLyspCXnKXbGvHxRbn4mp/gfNGcqVAuxqpBXyXXE+2by+ZLSZrrcKK/ODMJRwIybWXLvsbmACr8PLGM/8SCpIrH3N206GzDIbkym06Ox7am+rkY5EmuWVlZTaSe/HiRZeS29zcTMmNNCi5Q/9FZFzH2YnEU8mVf51Lyb1586YqudeuXXMquadOnQp5yV29vwNdvdYbn7Q3u9jfye3JRdE+G49YJXSwRnI92b69ZF6/FdwpyfyR3Ppm1319o6ADhb+Y0XKnFrrfwqnW/EkoSK4cPfVWVgdDcn+8yJHcU6dOOZXca9euqZIrSxak5ErR9VVyQ0V0Kbmg5A71l5Bxn2BJbn19PWpra1FdXa1K7vHjx0NacuVF1b5e0FlkbbCr6cK0kTd56d0oJ99bW8NrH3c1uT1ebl8e62DVtPoqublFJvRbrOLqyajzTz5KDjMQTyRX/npwxWj7nc0tMqk3kvkjubvLrP/OjSaLV782yG15+712JbmyL7926P8RKf9g1N44F0mSe/z4cVVyq6urUVtbqy7zS8kdRlByh/6LyLhOqEvu5mPWC6er1c7cSe7rX3WoAvd/8z2v0ZQXx/LGPvzvwS639Z3yZpR+i/Xi7K591fWBO8WdzX7gavTRneSe9XL7sv+A9WY7ecf4UM+u8OGPXarUbD7WpY6q29dmVlzrw7ELvXjnPwPfgzcKOnDmmvU4+DtF03COJ5Ir68D7LQO10nJJbYk/krtk28DNlNfa+9Tv9JJtrmdX2FdhPT9oZxnxZp/1/n2tyL+linutQX92BfvvNiWXkhtxUHKH/ovIuM5gSO6NGzcCJrlLtrXbrHamd1OUM8m1Xxhi8zHvfq6WozV6yEUG7CeslxdnZ2gvcLlFJpeLTNj/FOpqDl6JVkK83b67/vs7DdcFD2qWte1dzYgpF4nwdPvdvRas3s+b0HyNJ5K7ZFu7Qz20RM4N66/k/quky+k8zvbfHxmtkNrj6RzXzto760tfv+MvQMNRcm/cuEHJjWQouUP/RWRcJ9iSe+7cOa8ld8k229XO6pttF3rQk9zNx7psFoZY6cUIrkxukUm9MJnMFnV7WvTk6cvyHjR19OteAO0vcC/vtY40yotwv8V5za+3F2Fvty/z2c+2/TcHaMWzQEiuXD1O7+fqd4tNNvsqP58z1/rw8l4Krj/xVHJzi0w2izu0dPZjR2m37o1Yvkiu/Jy1q9p58p1+t9jaL/vFQvyR3CXbrKsb3rg1sF1X/1YiVXLPnTtHyR2uUHKH/ovIuM5gS25DQ0NAJHfJtoEFICSyhEErudrSBGcLQ3gaOSqldzf3e98O/Az72U+O8+Iy/sfVjWcMw9gGCA3JlSugUXKHAZRc518QuQoKM7Q5e/as05w5cwZnzpwJuORWVlb6JLkyK/M7bEoY5J328jHAujCEsxpeby4aAHCoxna+1TcKrDWqcrRKuyABE7hQchnG8wDBl9zKykpK7nCGkkvJDfWEo+TKaEsYJL6WJujF1Ry5kuF4x767umOH86CPtbyUXIbxPAAll5IbZCi5lNxQTzhL7pJt1hKG7Se7sOd0j1+lCXpZkX8Lh2rMaOu22NTXmvutN9JsPTE8512l5DJM6AWg5FJygwwll5Ib6gl3yWUYhmEouZTcIYCSS8kN9VByGYZhwj8AJTeokltYWOhU/vr7+3Hs2DHk5+dj9+7d2Lt3L2pra10Koy+vKSwsxO7du9UEG0ouJTfU46nkak9G/kpuRUUFJZdhGCaAAYIvuRUVFQGTXHvRDXnJdSZ+/f39+Prrr3Hu3Dn09Vlv7DCbzTh69CjKysoC9hp7KLmUXH8yZ84cCCGwd+9er9rv27dvyPvui+RKwfVGcg0GAyWXYRhmCAKEruQaDAavJdeV6A614LqU3NraWpSUlDg83t/fj4KCAnR2dgbkNfZQcvVTX1+P/Px8bNy4ERs2bAiq5O7btw9CCJfxVCrd5e2331a3mZmZSckNouRevnSJksswDDOIAYZeci9fukTJdTX6evjwYdTX1wfkNfZQcm1TXV2N7du3Y8OGDTaJVMmdNWsW4uLiMGbMGIwcOZKSS8llGIaJmACU3JCQ3JMnT+LkyZO6z+3btw9Xr14NyGvs8UZye3p6sG/fPuzevRtHjx71+HX2hLLkbt68GRs2bMCmTZtQVlY2JJJrHym2gRa5EydOQFEUZGZmYvHixRBCYMeOHZRcSi7DMExEBKDkhoTktre3Iz8/H42NjTaPnzt3Dl9//XXAXmOPN5JbX18fkBvWQllyDxw4gMLCQty8eRPNzbe74jUAACAASURBVM1hIbnvvfcehBBYvnw5ioqKkJaWBkVRIITAxIkTUVhYqPs6Warw3nvvYceOHRBCYPHixU7fZ8uWLZg8ebK67bi4OMTExDiVXFft7SVXCIE5c+agqqoKq1atQkJCgvqaF1980WHbFRUVePHFFxEXFwchBGJiYpCWloaioiLdvp86dQpPPfWUul1FUTB58mRs2bJFt/3PP/+s2/7DDz90Krmtra0eSW7szE2InfkPB8ndtf8YotPexuhH1qGQksswDON3gPCTXF9nWBhqwXUpuQDQ1taGgoIC7Nu3D3v37kVhYSEOHTqk3lQWqNdo4Uiu64ST5D700EOqUGqTmJiIkpISh9fNnj0biqKgvLwcVVVViI+Pd1qy8OKLL3pVPuGuvZ7kjh8/HmlpabrtX3nlFRvBTU5O1m2nKAq+/PJLByEeNWqU077oCfTIkSOdtq+srBw8yb1vQHIJIYT4TzAl9+eff6bkOuPHH39EZ6ftzWK1tbU4c+ZMQF+jhTW5kSO5ckTz7bffRkVFBU6cOKHKoP1o6IkTJxATE4MZM2bg7NmzqKqqwrx583RLFvLy8tRtb9q0CRUVFaiqqsLhw4cxdepUB8n1pL2e5Mo8++yzOHHiBKqqqvDaa69BCIHU1FS1n88++yyEEMjIyFDbnTp1CqtWrYIQAlOnTlXb2v8R8MMPP6gi+8knn+Dee+91+UdDSUkJzp49i/Lycmzfvh1Tp06l5BJCSBhByQ0Bya2trXVaX1tQUID29vaAvMYeSm7kSG5iYqLDz/WyDEEridpShTVr1jhsx75kQdbR/vOf/3R4b72aXE/a60muoijYtWuX7v5PmDBB7X9cXBymT5+ueyweeughCCHw7bffqo+tWbNGlVbtMXAW+/ae1uRScgkhJPSg5IaA5B45cgR1dXVOn6upqQnIa+yh5EaO5MqaVr3Xjxw50kbwZs2aBSEEDh06ZPMzvaIoDiUL8qd7vW3rSa4n7fUkd8KECW4F1JOZJ+z7c+LECSQmJkIIgTFjxmDVqlXqiK5e9NrLEV1KLiGEhBeU3BCRXGdTfh0/fly3/MCX19hDyR0ekiuEUCVXzqqQmprq0HbGjBkOJQuuBFRPcj1pH0zJraqqQklJCR555BGbmuUxY8Y4vfHs2LFjuu0H/cYzSi4hhAQUSm4ISG5lZSUqKyt1n/vmm2/Q0tISkNfYwxvPIltyKyoqHH7u1y4A4SzakgVFUaAoiu57y/IArVR60t5fyXUm9O5y6tQp5OXl2dzgtmHDBod2sjzh559/xubNm23a//3vf6fkEkJImEDJDQHJ7e/vR2FhIWpra9WZEbq7u90u6+vta+zhFGKRLbmyvnTOnDmq5MrRVFcZM2aMug1585q9mGpveNNKriftfZVcKe1xcXHqDW2+5q9//avT46Y3R+7atWshhMAjjzzil+Tek7kNsTP/gYqq8zaSO/O5jyAouYQQElAouSEguQDQ19eHY8eOIT8/H7t378bevXtRW1vr8sPz5TVaOJIbOZI7depUHD58WJXBt99+W/25XZYfVFRUICYmxqFGV5sJEyZACKHeBCZnM0hNTVXnAbSfIkwrudr2J06c0G3vq+RWVQ3UE48fPx67d+922/7/rlyJF198EQcOHLAZ0ZUzN9gvZyzb79+/32ZE99VXX4UQAgsWLNCV3Lq6OowdOxYjRozA0qVLnUruvX/YidiZ/8BzuQdQXVuHn8urcP+zWxE97a+UXEIICTCU3BCR3KGANbm22b17t8OSvvapqakZVMn1dllf7QipXrTTh8m29mKnjRTSZ599FlVV1npWvfl3k5OTkZWV5dCfkpISddEHZ+39kdySkhL1xjC9aEettfujF0VRHPrirv2XX36pK7lvvPEGRowYocaZ5P6/D75H7Mx/IHbGRsTc/z5ifvc3KNPfQ9ofPqTkEkJIgKHkUnKDCiV38CXX2YpeslQhLy/PqUTu2rXLoWShqKgIEydOhBDW+W+feuopddUxvRu93LX3R3Kl6GpXJHMluXIkOSkpSW0TFxeHRx55RB351sZV+0OHDjm98czTkdxr167hhbVFSHjwn4i5/33Ez34f2e/8GxUVFTYrnhFCCPEfSm4QJbewsHCoP28UFhYGpLbWV0JZcgc7vpQruIu72RUY76NXkxuoKcSuXbuGhoYGhxvPKioq8PPPP+P48eMo8kNys7KykJWVherqagDWObOzsrKwbt26QP0TJoSQsIGSO4xHcocCSi4lN9QTzpKbmpqKlJQUdaGYzZs3IyUlBcuWLQvUP2FCCAkbKLmU3KBCyaXkhnrCSXLb29tRUFCAvLw85OXlISUlBSkpKVizZg3y8vKQlZWFlJQUZGRkqG2+++67QfwXTgghoQMll5IbVCi5lNxQT7hIbnt7O9LT01Wx9SZr1qwZ5H/pwcGCL/BYbLRtbXbUZPzjdP9Qd40QEgJQcim5QYWSG1jJZYav5BYUFCAlJQXp6elYtmyZx5GiGwlQcgkhrqDkUnKDCiWXkhvqCRfJ1dbbWiwWj/8NRpLk2rNl0d2IpuQSQu5AyaXkBhVKLiU31EPJDV8ouYQQLZRcSm5QoeQO/ReRcR1nJxH7k81QSa625MBecuXsCvbRzq5g/5ycicFzDDi86VmkjImH4mQu5+Wf3rZ5hfHcdjw1fSRihICIUpA46j489/ZBtOi6uQGHN/0Jv5uYYN1+lIKke2bif97/EUY3Lu+Z5Drb/nGn2zddO4g1T03HqPg7C6PEJCJ9/js4drXHdYdcUJKbhugRmfim5zTeevS3UISCSQ/8HectBny+PA1xikDcqKdRdMOi7lti8hv4xfA1lqbEQUTFYHb2frT1liP38XsQIwRGp76Jc753iZCIg5IbvFByQckd6i8h4z6UXFe0YtvS37pdsEQrufVfLEJitH67KfN32Ihlf2853np4tNPtTpm/Ey0u/NWd5Lrf/g4H0b1UmI1xMfrtJ8zfCS8G0W2wSm4Gliwdo6knHoPnVzyJOM17pCw5AIvFum/xExfh9+l3q89Fj3gEK15KsenTk3+95FuHCIlAKLnBCyUXlNyh/hIy7hPqkltdXY3S0lLk5OQ4ldydO3c6tJFIuS0tLUVpaSna29s9/vfbVZWLZEUgJnEW1n1Vj24Alt42HN++BONiBBKS30CdRvput23Hg3fbtgd68WvlF1icFgsRFY9X9nWr7SvefxCKEIhJnIvtJ3512L6Iiscre01O++dOcivef8jJ9pcObH9fN+Qu3G77Ao+NjIaIUjDt6fdxvL4TANBvakLJF/8PT7y4xy/JtYptEpbvuIG6vEdVUZ2R9Q1ayv+Me6IFkqauQX2/dd+EEIiOTsHG0lv494oJd16vYMnfr+D6509BCIFJT+3xrUOERCCU3OCFkgtK7lB/CRn3CXXJlejV5HqyGIQ/NbltXz4DIQRmr/zB5nELzmJVquIws8HZjQ9BRI3Bm8VdDtsyVeTgnmjrSKV1Gz8hO9lxG5K6j+dBEQIT5+9Ar5P+uZJcC37Ci5Os2/+grE9n+4/f2f5OmO+Ia/l7s6zi+Ng2t6US3iIld9xDm2C0DBzbmLhMFBn61ZkjEpLfwPm+AclN/9P3MFsGXi//sOiqysXEaOvoMiHECiU3eKHkgpI71F9Cxn1CXXLl4g9yoQc9ybVfDEJPcuXiEI2NjR7/+3U+krsIY4VAzN3P4rjGL7c8E+e2tEFKmblxI9IU68jlRR2hvN32MWYpjqPFWlxJrrlxI6YpAyOjetuffWc0+nwfALRi/eN3Q0SNwTvfBf5GNimp2VutfwBIyZ3xp+9hsUBXcqOjkvH30n6b1z/7jyYAlFxC9KDkBi+UXFByh/pLyLhPqEvu0NbkGrAxM0lfWKMUPJZTZtPaG8l1J2kWfIEMnZIIm/dzIblS0J3V0dpLpQVnseq+GESPmIei7gAP42JAUpfvsI4qS8md+/ppWHT6Y79v9q+n5BLiCCU3eKHkgpI71F9Cxn1CXXLXrVuHZcuWISMjw0Fys7KydBeAWLdunfp6rfguW7YM1dXVHv/7vd32bywYo2D0vQ9qZieIwdj7FuCDoqsOZQRbnolzWh5gT3fNu5gcPXgjud0172KKVyO5DXjrwdhBW1yCkkvI4EPJDV4ouaDkDvWXkHGfUJdcyVDMk3t244M2P5m74/CfUyGEwPy/1Lpta8E3+P2oaIioafj4vOP25U1jKUv2O92G65rcb7BolGLdfq2jdMub3uRsBgCwJ9s688EjL//ktA7YVyi5hAw+lNzghZILq+QyTCinrq5ON+fPn7dJbW2tmpqaGjXV1dWorq7GuXPn1EUkKisrUVFRgfLycpSVlaG0tBQnT57EDz/8gKNHj+LQoUMoLi7GgQMHQlpyS3LTIKIUPPzfX6Hm8hXcaDW7bN/58+sYKwSEMhpPvlGAi0ZX7Xux54/W6cnix/8eu3VnV3A9Kux6doVe7Ml2tv2l6va1r1X7H5WEeSt3ofLXwM+uQMklZPAIluQeOHAAxcXFOHToEI4ePYoffvgBJ0+eRGlpKcrKylBeXo6KigpUVlbizJkzOHv2LM6dO6deL7TXEO21xf664+z6NNTXzQsXLlByCQkHLBaLbvr7+23S19enpre3F729vTCbzejp6UFPTw+6u7thMpnU0eH29na0traipaUFBoMBN27cUEd1z58/j6qqKpSXl3ssuYcOHdKtv/Uk6enpPh2bloPZTue8FTGJuHfGC/h3tXY1gl4cyf2d00Uj7KWytykfC34b46RtDObl2I6oSjF0OWfvjj4vtl9qN2Lruv/+zpNLySVkcAmW5JaXl6Oqqgrnz59XR29v3LgBg8GAlpYWtLa2qiOxnZ2dMJlM6O7uVq8XZrNZvY5ory321x1n16dQgJJLSBgQLpILQJ0H11vBLSgo8OnY9DYdxrOpMRBRChJGj8XYsUnWVcw0iU14Gt80aUdSe1H51ZuYN30M4hTXkgsA/V3n8M8/zcbEpFhrGyUe4+5bgA+KrjiUDHgruQPbf0Bn+441xbL/F779X5v+x8SPDsiKZ5RcQgYXSm7woOQSEgaEk+Ta48k8ub5zCW89cDdEVDyyt95weLbt8i5kjo+GiErCmqLbOq8nhJDgQskNHpRcQsIASq6T43JnCi8RlYSlG07Y1ON2t11HyRfZmBIrIEbcj08uup9NgRBCBhtKbvCg5BISBoSz5Nov1dvY2IjS0lKvpglzTiv+uTDBdXlAlIJHXw/8TAShjrpEr4dhSQEhwYGSGzwouYSEAeEsuYONpfcaDm36E+6fPNqmvjYmfjTuf2QltpU0DDvBBSi5hIQqlNzgQcklJAyg5BJCSGRAyQ0elFxCwgBKLiGERAaU3OBBySUkDKDkEkJIZEDJDR6UXELCAEouIYREBpTc4EHJJSQMoOQSQkhkQMkNHpRcQsIASi4hhEQGlNzgQcklJAyg5BJCSGRAyQ0elNwIYfHixRBC4Pnnnw+ZL9dwITc3F4qiYMaMGYP2HpRcQgiJDCi5wYOSO4jISdaD+V5CiJD4chkMBmRmZiI+Pt6mb7t27RrqrgWcKVOmqPtXWVk5KO9BySWEkMiAkhs8KLmDSDAlN5RGco1GI5KSknRXVQp1yf3v//5vJCYmeiWrHMklhBDiKZTc4EHJHUSCKbmhxPr16yGEQGpqKi5evDjU3fEKOSo7WCOyvkLJJYSQyICSGzwouYPIcJXcRYsWhcWorR6UXEouIYQMJpTc4EHJ9RA5MumKJ598EkIIVFRUqK8RQsBsNiMnJ0etT01MTMSnn36qu43a2lpkZmYiNjYWQgjExsYiMzMTtbW1Dm1zcnIcygEWLlzo8stVXFyMtLQ0KIqi9iU7Oxsmk8mLo+GahQsXupVc2fecnByH5+Rx/Pzzzx3a79q1C4cOHcK9994LIQQURcGjjz6Kmzdv6r6P2WzG2rVrMXr0aPUYpaWlobi4WG2jral1Fe1x3bVrl8PzU6ZMcXlcDAYDsrOz1e+BoihIT0/HyZMnHdrK7ZnNZmRnZ6vfh8TERGzfvp2SSwghYQolN3hQcj0kOTkZY8eOddkmNTXVRoaEEBg1ahRmz56tK0324rB//37ExMTotlUUBWVlZTbtvZXc999/36nA6cmmp1RWVnokiVoJ9FVyMzIydLc9c+ZMh+0YDAZMnDjRaX8kwZDcsrIyp3XK9vsKWL87Y8eOVb9T9iksLKTkEkJIGELJDR6UXA+ZM2eO29KDqVOnIjk52UZyZRYtWgSTyQSTyaSOdGpvEjObzaoEvbRiBYxGIwDg4sWLqiRPnz7d6RdHiqYryZ06dSqEEPjuu+9gNpsBAE1NTcjJycG7777r03HRvncwJFcIgaSkJJSXlwMASkpK1FHpq1ev2mxHHucJEybg8OHD6uOlpaV4+OGHdffF13IFd5Kbnp6uSnpTUxMAoLW1Fc888wyEEEhISFA/E7k9mZdWrEBnZyc6Ozttvjv2JxpKLiGEhD6U3OBByfWQ559/3kZ+ioqKIIRAXl6e2kYIgTlz5jhI7muvvWazrbKyMnX0UbbdsmWLKqn2mM1m3HPPPRBioBTCHk8kd+zYsRBC4NSpU94fAC8YzHKFpKQkGAwGm/ZPPPGEw8h4fX29Ko/27V0xGJJ74sQJ9Xm9z0b+AaU9XvYj7PKkcerUKfW7Q8klhJDwg5IbPCi5HpKbmwshBI4ePQoAeGnFCnVkzmKxwGg0OozO2v8sLpFCqpWeZcuWQQiB/Px83fdfuXKl7s/a9tt0JblyHxRFQWZmJo4cOWIzehgoBlNy9drrvV9eXp46CuoNgyG5craJ3Nxc3edlX7X7Zv/dkSeNiooK9b0ouYQQEn5QcoMHJddDvvjiCxuRGj9+PObMmQNFUdDS0qJKplZkvJFc+5vW7JGS54/kAsCnn36KcePGqX1TFAWLFy8OmxvPPJVc2f6TTz7xqu+DIbnam+b0kPW9lFxCCIl8KLnBg5LrIVIic3Jy1P+vqKiAoij48MMP1fIFvZ+cnW1LK7myNnMwR3K11NXV2cz44G7mCG8IBcmVo6fe3lA3GJIrR9CH60huVlYWsrKyUF1dDQAoKChAVlYW1q1b5/M2CSEkXKHkBg9KrhfIcoT169er9bRz5sxBRkaGOhqnlSNvJFdK2dKlSx3am81mjBw5EkIIXLlyRbdv3kqudtuBnhvWE8mVx+ulFSts+ltWVqbOMOGP5Mo/OuQ0XJ4ij4X9TBbucCW5si/ObhycOXOmQ01xJEluamoqUlJS1KnSNm/ejJSUFCxbtsznbRJCSLhCyQ0elFwvSE5Oxpw5czB9+nSsXbsWgHUUTlEUvPjiixBC6N4hb4+e5NbX16uzBOTk5KC1tRWA7ewKrgTWE8m9//778fXXX6vbBqwjulLs7Gcn8BVPJFeKX1JSEurr6wEABw4cUOeD9VdyAWtJiRACs2fPRmlpqfq4q9kV5EIWGRkZXt2w5kpytX+kLFq0SHd2BfvXhrPktre3o6CgAHl5ecjLy0NKSgpSUlKwZs0a5OXlISsrCykpKcjIyFDbfPfddx5v3xW9TflYOOFuRMeMwyu7mwKyTUIICSSU3OBByfUCeRe8dtRT3nAmhHCYR9cbyQUGftbWy5gxYxyky938rs7ESS+LFi0K1GHySHK14qeNoijqcfZXcrWjwnrRQ8q3XrSflXxPV9Gya9cu9Y8Y+8TGxjrMeBGuktve3o709HRVbL3JmjVrPHoPV7R9+Yx67CbM3+n39kh4YcFZrLrP8d/88h19CI1LLiGU3GBCyfUCOY2YvTzOnTsXQjguSOCt5ALOVyTr7Ox02I63kvvjjz8iPT3dZrR00qRJ2Lp1q6+HRBdPJBewru6Wlpam9iU9PR21tbW6N9n5IrkA0NjYiMzMTJtVxuxXPLOnuLgYkyZNCqjkAkBVVZXN8Y+Pj0dmZiYaGxsd2oar5BYUFCAlJQXp6elYtmyZx5Gi6y8cyR3eUHJJOEDJDR6UXELCAGcnkVCTXG29rTcnuUBJLiFaSnLTKLkk5KDkBg9KLiFhACWXEO+h5JJQhJIbPCi5hIQBoS652pIDe8mVsyvYRzu7gv1zciYGj46Ni5+o9Wj78g8QQuCxnDPoqPsMz86eiDhFQEQpGD3lD9j7S7fH763fny/wWGw0JszfCYvFgAPrnsK9SdYSlZj4e/D0GwdhdDj/96Lu27fw0MQEKEJARMVgdPJMvLqtGr2aVnv+OBpCCMx66Qfd9768fQEUIXDvM/tsXucNsq55+Y4+9DYdxpqnpiMh1np8ku6Zi799c8PhNf1d5/DBc/db2wmBmPjRSJ//Do7f1L/Qma4dxJqnpmNU/J069ZhE3DvjBeRX3tJt31H3FV55crq6fRGTiPQFq/Gf6h6X++JKcs2NG5GmCESLufh3k2M/LfgJL05SIKKm4eNa2++S8dx2PDV9JGKE9bgkjroPz72t97kS4gglN3hQcgkJAyi5Lo6Nj5J737yFmBzjWEsdk5iJohu+n6Cl5MZNnIc/PDjKsV47SsGTfz2veUUvjuT+ziq3Om0ffb1UFdbOn1/Db6MF4sauxNl++3duxYb58RBR8Xhlr++Lu0jJvW/ec7h/lGOfoqNn4JPzA2/e25SPx0ZH69al6x3Lnsv/xIw4/Tr2hOQ3UGd36C8VZmOczudk7UsKNpZ2Od0X1yO5rdjwRDxElILn8xzrt+WxHnnfO2jQHOv6LxYhMdrJfRDzd1J0iVsoucGDkktIGBDqkltdXY3S0lLk5OQ4ldydO3c6tJFIuS0tLUVpaSna29t9PlZasdFDSq4QAtExk7Diw1NoNwPdbT9ixTTriOvc10/7/P5Scq2SmoR5K3fhlxYzABNObnwMcUJg1O/WQQ5ydv78OsYKgfjxv8eeMuMdoTWh5th7eGiUsI4kqlJ5CavTYyGixuF/f7C13Ntt2/HQ3VYBPtPn+wVGO0NFTOIsvPm59fj0d53DXzKsM6I8+ddLd6RRinUSFrzxFRo6rY92t1Vga/a0O6PK/7YZVZafz0MrD+F6i3XKxX5TE0q+eBMLF7xtI7n9t7/B78dEQ0QpePi/v8Ilo7V92+VCvPywdVR75H3voNHJ7rorV2guykKcEBj/yL/Qbtfg4KuTVQGWT91u244H77Yel3Vf1cM65t+LXyu/wOK0WOsfGPv8+yWARD6U3OBBySUkDAh1yZXo1eR6shhEIGtyPZXcmMS52H3O9ufujh9exuhoWwn1Fim50dEpWF9yy+G5jBjbEcs92WMQPeIB7L7uMDQLw66n7KQSOLvxId2Shcvb50O5I+j+XF6k5I6c+goqOyy6z8n3MDduxDRF4HdZB2G2e1MLyrF8qoKYu5/Fcc2uHfifCRBC4JGXf3JbUiHLLybP3+kgof29JViWHA0RNRn/OO147AD3kmvBN/j9qGiHkgULfkJ2sgJFZOJg98DjZzc+BBE1Bm8WO44emypycE+0QMqSA272igx3KLnBg5JLSBgQ6pIrF3+QCz3oSa79YhB6kisXh9CbVs1TPJXcCfN3OB7nO4J696jlcOJNbpHbSEh+A+f1u6Bpq19qYR+tuMrRRNuSBfnTu3bU1ze0IutpW1eJHpGJQ5rj0FX1LqbcqfEdNWUB3vn4e3WE1p492WMgohSs2qV/IKUwO5NYT2480xuxlaPr9rXNW56Jc7u/nJ+ZuIOSGzwouYSEAaEuuUNZk2tPICTXXsy8YbAlF+jFZ8tG25QsSPEdPyfPYcTTWwZbcgFYb/ibNd5645YYuOlvj92NZ1ueifNrpNYTye25vB4p0daShbY7b3PwtcnW41ti23FKLgkElNzgQcklJAwIdcldt24dli1bhoyMDAfJzcrK0l0AYt26derrteK7bNkyVFdX+3ys/JHc/tufY26s/g1QnuKL5EaPyMTB256PwN46mI04ITDjT98DkKUKCp7f7PlS1M7wRXJ9LZHobruAb7avweMp1lkloqNTsEkjtNuWJg76SC7QgLceiEH0iEfwpaFfnVVBr7ZZSvcHZT7+BUQIKLnBhJLrI7m5uVAUBTNmzAiZD5NEJosXL4YQAs8//3zISq4kFObJ9Udy6z5+HIoQmDh/p89TcHkjuUAvNj0V5/WMCLJm1FpWYcSGJ+IRE7cYR7v8K1UAvJNcWYdqPwOB9/Ti8J/vcxBmWX9sf/MaoLkpbcT9+PSS/nfN03lyZT3z0g8M6qwK8/9y3uE1h/+cCiEE5v+l1sf9JISSG0wouT6iXVK3oqJiqLsz7KitrXVYojhSPwvt/lFy3eOp5I68Lwflja3oBWDpbcPx7UutU1VFjcM73/l+h7x3kjtwc1V0zCSs2HISzY4reOtSvn6Wta+HdyPjbusNT4G4rngjuQNzySpIfnA1DtUa3f5x8MnKmVj57n712APWEd1dK1IdbrLrufw+0mLFndkbCnRnV5g8f4fTEg1PJbf/diGeHBmN8XPyUPjWfYiO0hdnWasrlNF48o0CXHRSS0yIKyi5wYOS6yOhNJI7d+5cxMfHD2kfgkllZSUURdGthwt1yV2+fDkSExO96mc4jeQeOnRIt/7Wk6Snp/t0TLuqcpGseF7Tqp1CzCF289L6greSCxiwZdFYr2pagYFa0qkpKVDu1OcG4kzkjeQCQFtFru58w9pjr2XLorudto1NeBrfNmv3ohdH3p05ULtrl7hRT6NQMyuFZ9+FMp29sNY5R0en4N4p0S5qm13MaSyEy/phQiSU3OBByY0A5Al2uPD8889DCIGMjAwYjcah7o5XTJ061ScZD/WaXC1yHlxvBbegoMDbwwkgQJKrxGPcfQvwQdFVvwQX8EVyAcCAw5v+hPsnJzkInfOb4O7MqCBczxXrLd5KLjCwIpm6gpkLyTVdO4H3/jQbE5MGfoW5O3ESHs36COdv6e1ELy58+7+YN32MdWU6Tfu6Ttv2vkvuMt3EDgAAIABJREFUwOIP7ktHelH51Zs2/aHkEm+g5AYPSm4EMNwkNzXV+rNmZWXlUHfFa4aD5NrjyTy5wcRVTS4hhAw2lNzgQcn1gl27djmMCkyZMsXphymEQGpqKsxmM7KzsxEfbx11iY+Px6effupXX1yNVGj7BgBXr16FEAKKojgd+Rw/fjyEEKivr7fZ19zcXLX+VZYI3HvvvaipqdHdTlVVFdLS0tQ+jB49GmvXrvVrX+2R9dCuJDcnJwdCCOTk5Dg8t3DhQgghsGvXLodtAsDatWttPiu9bUgaGxuRmZmpto+NjUVmZiYaGhoctu0uev3XZuHChS4lt7q6GgsWLFDrlGNiYjB//nxUVVU5SK4QAsnJyWhqasJzzz0HRVEwYsQIxMXFYcOGDZRcQggZJCi5wYOS6wW+SG5ycrI68mgfrWR5izeSCwAZGRkQQmDLli0O2zp69Kj687/9vj7xxBO69a9JSUkwGGynK9I7PvaC5guutuvsPXyVXHmc7LN+/XqH7ezfv99pbfDChQsdtj2YkltQUICYGNv5VqOiohAVFYXo6GicOHHCQXJHjx6NqVOnYsSIEWruuusu3HXXXdi2bVvAJNd+qd7GxkaUlpb6NU2YP3gquV1VuZgY7f5zk/F2GrDBRt505Wk4vyshwYGSGzwouX7gieTKLF68GK2trTCbzXjttdfcvtbbfthLkj379++HEAJz5sxxeM+XVqyAEAL79+9XH9OKZWxsLD766COYzWa0traq0q4VSKPRCEVRkJSUhAMHBpa1LC8vV9v7WnMZTMmVomv/Wc2cOdPmuBmNRiQmJkIIgUWLFuHixYsAAJPJhD179mD58uW6++JLuUJlZaVLye3u7kZSUhKEEFixYgWam5vR19eH8+fPY9asWYiKikJaWpqD5EZFRWHEiBH44x//iMbGRly5cgWPPfYY7rrrLjz55JMBk9xQg5JLySVkKKHkBg9Krh94Krl5eXkOz40da72b+sqVKwHphzvJBYB77rlH9z0TEhIwfvx4m8ekWCYlJaG21nZOSDnyqxW/9evXQwiBb7/91uF9y8rKIIR1doBAMJjlCvYjzmazGUIIJCQk2Dy+du1aCGEd6faGwZDcDz/8EEIIZGZmOtTkmkwmjBs3DlFRUTh16pSD5L766qs2NbkHDx7EXXfdhdTU1IiVXEIIGUooucGDkusHnkquHlK0jhw5EpB+eCK5Uvy0NbJFRUUOjwEDkqv92d3+PceOHavu+5NPPunRSGsgGEzJ1dum7L/2c54zZw6EEDh69KhXfR8MyZWzTezZs0f3xrPly5cjKioKO3bscJDctrY2G8n97rvvcNddd+Gee+6h5BJCyCBAyQ0elFw/CITkfv755wHphyeSW19fDyEEpk+frj62dOlS3RvSPJFcrfgNN8mV7c1m7yaDHwzJlftz+vRpXcl94403KLmEEBIiUHKDByXXD/yR3CeeeMJr2XHVD08kFxi4Aa2yshJmsxkJCQlYunSpQztXkit/wtfuu5TcYCzGEAqSO3PmTLd90GMwJHfRokUcySWEkDCBkhs8KLl+4KvkGgwGKIoCRVHQ09MTkH54Oqoob0DLyclR///EiRMO7VxJbl5enkP9qrxBK9DThenhieTK/r+0YoXN42VlZeqMCP5IriwReO2117zqu5TcU6dOefwad5L73nvvQQiBJUuW6NbkJiYmIioqChcuXKDkEkLIEEPJDR6UXD/wVHJLS0tVAS0vL8eECRNUAQvEF0HOXvDSihVobW112z4xMREJCQl44oknbEoXtEhJnD59Oq5duwbAOoK7detWVRK19agnTpyAENa5eHNycjzqh694Irmy1jgpKUmd+eDAgQPqHLL+Sq7cXyEEVq1ahaamJgDuZ1d45hnralIZGRnqa9zhTnLr6urUz2T16tW6syssWLBAd3YFSi4hhAQXSm7woOR6gfyZ21W0uGonF4kIBHJmA/to58nV8vLLL6tt9GZ+ANxP26VXBqA3t6s2gSpl8ERyzWazOq2WNoqiqDeN+SO57vbXWf2xlG933x13c+tOmTLF5iTz1ltvObSR8+SOHj0aDQ0NlFxCCAkBKLnBg5LrBYGQXLkCWKAEV7J161aMHj3aI8mVN6C5WgFNT3IVRUFaWhqKi4ud9mPv3r1IS0vTXSQhmJILALW1tZg2bZr6/unp6aitrVXl1F/JBYDi4mKb/Y2Pj3dY8UzvNZMnTw6o5Pb39+M///kP7rvvPrUviYmJeOGFF9Da2qq74hkllxBCgg8lN3hQcgcRPXkJBaTArlq1ym2bQM2IQPzD2UnE/mSjd+OZ2Wx2kNzOzk50dHSgvb3dRnJv3LiBhoaGgC7rSwghZABKbvCg5A4ioSa5JpNJralNSkpCS0uL07aU3NCCkksIIZEBJTd4UHIHEU8l15MyCHf1sK6wLz1QFMXtIgaU3NCCkksIIZEBJTd4UHIHkVCTXEVRkJ6ejrNnz3r8GkpuaEDJJYSQyICSGzwouYSEAZRcQgiJDCi5wYOSS0gYQMklhJDIgJIbPCi5hIQBlFxCCIkMKLnBg5JLSBhAySWEkMiAkhs8KLmEhAGUXEIIiQwoucGDkusjubm5UBQFM2bMCJkPk0QulFxCCIkMKLnBg5LrI9plVwO1XC0JH/SWPXa2jHIgGGzJzcnJQWJiIu666y7cdddd+D//5//gkUcewdmzZ/2W3KysLGRlZaG6uhoAUFBQgKysLKxbty5Qh4cQQsIGSm7woOT6CEdyhzeRJLmZmZkYMWIERowYMSiSm5qaipSUFJw8eRIAsHnzZqSkpGDZsmWBOjyEEBI2UHKDByWXkAAQrpJ77tw5jBgxAkII7Ny5MyDlCu3t7SgoKEBeXh7y8vKQkpKClJQUrFmzBnl5ecjKykJKSgoyMjLUNt99911AjlNvUz4WTrgb0THj8MrupoBskxBCAgklN3hQcgkJAOEquTt27MCIESPw+OOPB6Qmt729Henp6arYepM1a9b4fZzavnxGHVmfMH+n39sjhJBAQ8kNHpRcL3D2E7WzD1MIgdTUVJjNZmRnZyM+Ph5CCMTHx+PTTz/1uz85OTkQQqCyshK1tbVIT0+HoigQQiAtLQ01NTUOr6mqqsK0adPU/o8ePRpr1661aXP16lV1GeCWlhbd977nnnsghMCFCxd87r9cNthisWDt2rVITExUj4+zpYuLi4sxYcIEtf+TJk1yeSy3bt2KSZMmOeyv2Wx2aGswGGw+J7kM8okTJzzaF2eS+/zzz0MIgVWrVul+V7Zs2QIhBJYuXWrzuMlkwuLFixEbG6sel8zMTNy4cSNgkrtt2za3krt27VqPJbegoAApKSlIT0/HsmXLPI4UXX8JpZHc6r0vYcbkJDz++mmExumeEBIKUHKDByXXC3yR3OTkZKSmpjq8TgiBXbt2+dUfKblLly5V5VabpKQkG5nT67/MwoULbbadkZEBIQQ+/PBDh/c9ceIEhBCYPn26X19keXxmz56t26f169fr7q9e9KQ4OzvbaXv7Y19WVoaRI0d63F5vX5xJrjxe48eP1z1e8ljv379ffcxgMCApKUm3L0lJSbh586bPkjtp0iRERUUhKipKrcXVq8k9cOCA15Krrbf15rsRKMkNJUpy0yCEwFxKLiFEAyU3eFBy/cATyZVZvHgxWltbYTab8dprr7l9rSdopW/ChAk4cuQIAKCxsVGd/UHKidFoRExMDJKSkmxkqry8XJVw7eP79++HEAIZGRkO77tq1SoIIbBlyxaf+w7YHp9Vq1bBaDQCAP72t79BCIGZM2eqbaUoTpgwAeXl5erjR44cUWWwvr5efdxsNkNRFCQkJODcuXPq43V1dcjOzsYXX3xh05eZM2eq+2swGAAAra2tWLRoEYQQSEhIQE9Pj8t9cVWu8Lvf/Q5CCBw/ftzmcaPRCEVRMH78eJvHpfjm5OTAZDLBYrHAaDQiKytL/cPG/kRDyQ0tKLmEED0oucGDkusHnkpuXl6ew3Njx46FEAJXrlzx+f2l5C5cuNDh53f5nByBXL9+PYQQOHTokMN2ysrKIITA888/b/N4QkICFEVR5VMyfvx4KIqi+5O/N8iSAHvxk89ppVH+5C8FVMunn37qMPJrNBpVOdV7jRYp0M4kde7cuRBC4PPPP3e5L64kVx7/VatW2TwuSxW0I9GyXOTFF19UH9OeOCZNmoSEhASfJXcwyhW0JQf2kitnV7CPdnYF++fkTAyeYMFZrLovxmHEe/mOPt32bV/+AUIIPJZzBh11n+HZ2RMRpwiIKAWjp/wBe3/p9vi97ZFi6y6yb7cOZiM+WiBu7Eqc6XM8j9xu246H7haIiVuMo1396r4q4ml832/AgXVP4d4kazlLdMw4PP3GNzDqnI4svdew763HMT7hzi8+MYm4d8YL2OfHvhJCfIOSGzwouX7gqeTqsXDhQggh1NFXX7AXWVfI93MV+5IFvRFbKYT29aO+4M1otnZeYk9LFuQobGxsLLKzs1FaWqq7bSmgubm5us/n5eU5LYmw3xdnOBuxfeyxxyCEbW2zq7ISbSi5VnyV3PvmLcTkGMfjGpOYiaIbvp2gvZVcC37Ci5MUiKhx+N8Sx/5e+vhxCCEw66UfYLEM7Gv0iAew8MnRjtuOUvDo6z+hV7ON/t5y/M/0u3X7ER2dgo0/UXQJCSaU3OBByfWDQEiuq9FBdwy25NbX16s/4ct9fPnll3V/dveFwZZcAFi7dq16I5kU3pycHJtRaHkcnX0WUjr9kVwAWLp0KYQQ6o1ssoREe3y17xdOkltdXY3S0lLk5OQ4ldydO3c6tJFIuS0tLUVpaSna29tdvp8rpGi6k1zr6OckrPjwFNrNQHfbj1gxzToqOvf10z6/v30/3JUrlL83C0IIzPiT/TRqrVj/WCxE1DR8fL4fgJ3QRylIfnA1vqvvBGDC2U8WIVEIKCIT33T1q1s5+OpkiCgF057agl9arN/7/q5LKHpvHhKFwMj73kFjaFyPCBkWUHKDByXXD/yR3CeeeAJC+Ldami+SW1lZ6dV7pKenQwihzrJwzz33OL2Bylt8kVxfKS0tRXZ2tjpTwaJFi9TncnNzB30kFwCKiooghMBLK1bAYrGopQr2tc16Uj1YU4gFenYFvZpcTxaDCGRNrqeSG5M4F7vP2dZZd/zwMkZHC4z63Trc9PMr7qnk3m7bjgfvFoi5+1kcH3BTmBs3Ik0RGD8nD+13NqBKbpSCh/900K40oRXrH78bIioerxfcvtP+G/x+VDTGzHpfp4yhF5ueioMYcT8+vRQaFyRChgOU3OBByfUDXyXXYDBAURQoiuLyZiZ3eCO58mY3++nC3CFFbPPmzWqpgrfbcIY3kiv/KNDeHOcLBoMBCQkJNp+LlM/p06frvkaKfmFhodPteiK5gPWPhLFjx8JisSAjIwMJCQkOtc2yRlrbn6GU3Pz8fLeSKxd/kAs96Emu/WIQepIrF4dobGx0eyyd4ankTpi/w+E5C77AY7HRuHvUcpzu13mxD/1wf+NZL7YsioeIiscr+7rVtmc3PmR9bK9J0z8puZPxD50Oyvdc+oG1Dr2rKhcTo938KuBkW4SQwYGSGzwouX7gqeSWlpaqIlNeXq7O8ypH9HzFG8mVgqooCnJyctDa2urRe5jNZiQkJCAjI0N9v6tXr/rcZy3eSK6U7djYWGzduhUmk8ll+8rKSmRmZuLIkSM2bUtLS5GQkICEhAT1MbPZrM7QsGjRIt3ZFdz101PJXbt2LYSw1mIriuJws59k/PjxEELg4YcfRl1d3ZBK7n/+85+Qrsm1JxCSGz0iE4f0X+51PzyZXaG5KAvx0QL3PvNvmC0AcAmr02MdbkjzVHLnvl4GgJJLSChCyQ0elFwv8KSuVYurdnKRCH/wRnK17Z3FWSmDnId3ypQpulOK+Yo3kgu4P/5aKisrXba1L03YtWsXYmIcb16SYl1WVuZVX5yVVsg6Zzltm7Pa5rKyMt25j2X+/Oc/B01yPVnxbN26dVi2bBkyMjIcJDcrK0t3AYh169apr9eK77Jly1BdXe3y/Vzhj+T23/4cc2MFEpLfQF2QyhWAgRvQZD1tz+X1SFUE5v/lvM1r3Unu4T9bv1fLP7WWK0jJ1dtXQsjQQMkNHpRcLwiE5LpacctbvJVcANi7dy/S0tJ0BcqZ5MpRYCEECgoK/O63xFvJBYAPPvjAZgUzV1K5Z88em31VFAVpaWkoLi7W3XZVVRXS09MdVhhraGhwaOur5AIDc+C6W0yjtrYWmZmZNjfOharkSkJhnlx/JLfu48ehCIGJ83fazFDgTz8eevknj+bJLX9vFkSUguWfmlC+fhYUMRf/brJ9pSvJ7e8tQVayAhE1GR+UWfe9//bnmBNjnYLsWHdoXHQIGe5QcoMHJXcQcSc7hHjKYJUrtLe3o7W1FS0tLcNOckfel4Pyxlb0ArD0tuH49qUYFyMgosbhne/8n1ar7aulUIT1Brftx2/C3RbljWaJaUvw9L0K7n1mn4NoD0juGLz0SRVaOu+81+VCvPyQdUqxcQ9tQovqv63Y8IT1j6Sk5Gewy4N+EEIGF0pu8KDkDiKUXBIowkVyDx06pFt/60nS09N9OjZdVblIVlyPqmtLBrRTiDnWpyp49PVSv0dxAaD/9jdYNFa/5ERfwAeEVESNwduHbju0cDYn8P9v7/zfmjzzfP+HzCXcBpQQq2wrpeJAWdaBtTOu33Z0sJ3BtXoJM3SmtuvObt2eoR26U/ZYr2ta2jOeccZtnR6xWnpqbJEqLFhQSTFAgA2G8MUAAhsgyJGgscr7/EDv2+d58jzJ80CIBD+v6/r8YLiT3HkSP3lx87k/Nw+1Hr/3Rk/j79cs17xP6s6PI/BqCYLQC0lu9CDJXUD0Sq6eP31LI1Qrq0eBkbkzNr+2aY8rsSK5AEQfXKOCO9dSmIhIrikJTz77E5RV9kdEcDn+mxfwz9vTYU7UI7kPN6BpnYCmJbkrkp/B1sI/oev/qX+xfDv6Dd755UY8/d3paCS5BPHoIMmNHiS5CwhJLklupIglyVWip09uNAlVk/touYe6kr+BiZmw/+ioah1vuI1nBEEsfkhyowdJLkHEACS5kWMxSu6dW9345M2/g5kxrFr/hmZnB5Jcgoh9SHKjB0kuQcQAsSy5yqN6BwcHYbPZ5tUmbD7olVxdPWYlsTwuDxe+NSaefJPcw5raLTjdpd2glySXIGIfktzoQZJLEDFALEvuYmNRSm5CMnJ3/g5f94c+AZEklyBiH5Lc6EGSSxAxAEkuQRDE0oAkN3qQ5BJEDECSSxAEsTQgyY0eJLkEEQMspOS+8MILiIuLQ35+PoaGhkhyCYIgFhCS3OhBkhvD8GN9pbFr165F8+GKZU6cOBF0fHB6evojm89CSm5cXJwIklyCIIiFhSQ3epDkxjAkuQtDSUmJ6saiWJDczZs3IykpiVZyCYIgFikkudGDJHeJ4HA4SHIjRHJyMhhjKCsrQyAQeNTTAaBfcrmQU00uQRDE4oQkN3qQ5C4RSHIjg9PpFKu2i+k6kuQSBEEsDUhyowdJrkFcLhe2bt2KxMTgM+DV5Mjv92PPnj1ifFJSEvLy8uD1ejUfPy8vT4xPTExEXl4eXC5XyHnpldyKigpkZT1sQJ+cnIzi4uKQK5bHjx+X1aempqbi+PHjYa5U+LmePHkSR44cgclkwpo1a9Da2gqr1Qqz2QyTyYSTJ0/KxpeXl8vGOxwOWK1WJCUlwWQyoby8fM5zUs4tnOSmp6eDMQaHwxH0M7XjnNevXw/GGGZmZlBaWoqkpCTxeQh1THNHRwdyc3Nln5+ioiJMTU0JydXq2xofHy9i3bp1Msk9dOgQ4uPjZfW427dvp3IFgiCIBYYkN3qQ5BrA4XDAZDKFbAgvlSOv1wuLxaI6zmKxBImu1WpFQkKC6niTyQS73R5ybuEkt6CgQHPemZmZQaIbCATw3HPPad5HTfD0XkfGGPbu3St7vH379sFsNot/m81mw+Pn8h9r165dupr9c+kG5i6527ZtU33sI0eOBD3OkSNHNOfym9/8hiSXIAgiBiHJjR4kuQbgMpSfn4+JiQkAQG9vrxBBqQQBwPbt28EYQ3FxMfx+PwBgYmIChYWFQtr4ByEQCAghfuXAAfh8PvH4GzduBGMM2dnZmh+ccJJbWVkpZNlqtQqhPXfunHje0tJS2X34xjaLxYJTp06J+7jdbuzZs2feksvnOzIyIv791FNPYWpqCmlpaWCMwel0Bo33er2y8X6/X6w0d3R0GJ5PNCWXi67P50MgEMChQ4fAGENOTo7mNTp48CB8Ph9mZmbg8/nw3nvv4Xe/+13EyhUaGhoQHx+vKbnvv/8+SS5BEESEIMmNHiS5BuBiMzU1Jbu9vLxcCBinv78fjDG89NJLqo+VlpYmW3k8duxY0GNwAoEA1q5dC8YYWltbVR8vnOTyFUS1P+lfunRJrEJLn5OvkoZaQZ4LfK4mk0msZnM54/Pj4ulwOEKO5+L5/PPPh7w+Rue2UOUKyvc3EAjIVq05fNX60KFDABa2Jjec5G7YsIEklyAIIkKQ5EYPklwDaK3k5ubmBv3JmYtvuOAfBF5KcPr0adXnfvXVV1VXiznhJJfXuWqRkpIiEzMuvps3bw5/YQzC57pjxw5xG2MMKSkp4t9qkqs2nr/WWJFctfmpjefvB1/Rf5SSazKZ8OWXX87lchIEQRAKSHKjB0muAa5evaopqxaLBePj42KsUckNJ2m8dGCukqtcqVXCpU05f76SGEmkc9Wan5rkqo1fqpLLGENaWpr496OSXKfTie9973skuQRBEBEimpLrdDpJcgl98EMCtmzZErTbndfccrgkhto5L2X37t0LupJrMpkMreTyGl618on5QpIbfjwvFeHMRXK56M5XcpctW0aSSxAEESFiTXKlgkuSu4Qxm83YsWOHrjfPbreDsdnNYnrgO+n37t0b9LNAIIBVq1aBMQaPx6N6/3CSm5OTA8YYrFZr0M+40Eo3P/GaYrPZrNnubK4sBcnl87t06ZLsdukpdFKMSi5/v06cOAHAuOROT09HTHLT09NJcgmCICIESW70IMk1AC9LaGxs1JRNKXyz2KZNm+B2u0OO7enpEe3JiouLZTW/vLtCqPZg4SSXS7TFYtHsrqDclMY3q6WmpqK2tjbi3RViWXL3798v5uT3++H3+3Hw4EFZKYoUo5LLNyKaTCaUlZXB59PXXSEjIwOMMRw4cABjY2MRkdyDBw/SxjOCIIgIQZIbPUhyDcBX19Ri9erVQS247HZ7yL66ylIGXg6hFmvWrAlaUeV/MtcKZbeE7OxszbH5+flBr9fr9YoVZLV4nCWXr34rIzMzM6j0AzAuuUDo1mbSPrnSOHz4sGycVp/cdevWBfXJjYuLw7Jly7Bs2TKsXbtWSG5TUxNJLkEQRIR41JI7OjpKkksEU1ZWBsZmTyFLSUkRp1ZJo6SkRHYffoKZ2li1et2qqipkZWUJOU5OThYnXCkxIrnArOiWlpZi9erVYswzzzwT8vQyv9+PoqIiJCcn675POJaC5ALAiRMnxHVJTExEUVERAoFA0CY+YG6SCwSfNif9PKiVLNy/fx/Hjh3DE088oSm509PThiSXDoMgCIKIHItVcqenpw1LrpbgkuTGGHzlLj09HXfv3pX9LBAI4M033wRjDBs3blw0by6xdAiVSJS/VUuTkVq5wvT0tKxcYWJiAuPj4xgdHcXw8LAoV3C73RGR3MLCQhQWFqKzsxMAcPbsWRQWFuLw4cORujwEQRAxQ7Ql1+12R0xy9a7iLhYPIsnVCd9QlJmZGXSqltPpFPWr+/fvXzRvLrF0iGXJzczMREZGBhobGwEAf/jDH5CRkYGCgoJIXR6CIIiYgSQ3epDk6uTq1ash62v5pq5IdyKIBUJdE7WYb0nB40gsSe7k5CTOnj2Lo0eP4ujRo8jIyEBGRgbeeOMNHD16FIWFhcjIyMC2bdvEmJqamgW8eo+Oyda3kWVOQOLKDfjfzQ8e9XQIglgEkORGD5JcA3R0dCAvL09Wn8prVIuLi4N65T4ukOQuPLEiuZOTk8jNzRViayTeeOONBb6Ks9z69B/AGEPqzr8s+HPVl2SJz/2Wf21e8OcjCGLxQ5IbPUhyCSIGiBXJPXv2LDIyMpCbm4uCggLdwUU3GkRTcmkllyAIJSS50YMklyBigFiRXGm9rZEkt1QllyAIQglJbvQgySWIGGChJdfn85HkEgRBRIHFILk+n48klyCIxUG0Jdfj8RiSXGnJgVJyeXcFZUi7Kyh/xjsxhKO+JAss3oR/PPmt5pjpjhI8vfyh1Eol13/zAv7579Ow0sTA4hOQ8uw/oOK/7qg8ihe1/+uX+JunzTAxBhZvgmVtDv7p3cvwKXL5DM5ge+JyeS16/Dq8H7JcwY9vPvwVNqyzIOG7x09+4lns+7dKjNwNcTeCIGKORyG5Ho+HJJcgiMXJQkju1NRUzEuut/ynYIxhb5l2V5Nbn++DiTFs+Vf77L+55D6Xhw1PBG+MTDTvw+U7DxP0g3st+O2m1ZobKdN3foxxib8al9x7+OTltbPyrBIvn9AWeIIgYo/FJrn8+4AklyAWALvdjqSkJCQlJc35qOClzmKX3M7OTthsNhQXF2tK7scffxw0hsPl1mazwWazYXJyUtd1ud3wazwhEVg1uNQW/dkv+zdjDGz5Wvzqjw7cAXDrxkfYvno5WHwSXrfeF/dvffeHMDGGhOQt+PDqf+MOgJl7t3DlwxfxZAIDi0/Cv1Rod1Y5lr8Cy0NI7oNvz2DbCoaElT9GebsXs+vI9zDafQnv/DIHxadIcgliKUGSGz1IcmMYfkCFNHbt2rVoPlx6kb4OtaOOY4ETJ07Ijt/VezSwXqIpuYODgzLJbW1tnVdNrp7DIOZakxsYfA9ZJml97QBHMuifAAATX0lEQVR++1wCVjzxMrhTzpY0rMG/Vc/KIpfc5cszcKThtuzxan+TAcYYnv/3vtnrjm9QlGbSXIl1//nHMDGGp3f+Bfc05hhOcr+99Wf8rWlWcs8Nx9b/XYIgjBMtyW1tbZVJ7uDgIEkuETssFcmN9ZXckpIS9T9jR1ByAW3R1SO5XHSVkrtp0yasWLFC1l1BKrmdnZ26JJcf/sAPelCTXOVhEGqSyw+HGBwc1HdN8H+xcyVDyo8+wOTMQ2Fk8U/ifzbMSuUXv34aLG4DPuqdXZ0NtfGM97XlPW25RFvWv4FelbeSP5857XW4Nd7qcJILTOA/XkyZFe+EJ7Hl56X4qvG/oVYZTBBE7BNNye3s7NSU3Fu3bmlKLv/emKvkLhZIcpcIDocjZiU31jGbzWCMoaysDIFAYMGeJxKSe/fuXZnkxsfHIy4uTkjuyMjInCT3UdXkzqAT/5KdICTzxoc7sXL13+GH65fjb19pAAAc270SJvZT1Hw7K5lGJPfhprWPNZ7/DLYlzFdyAcCLc4dfwDPmh6cqLk94Ej99nTaeEcRS41FK7sjISEjJla7ikuQSiwaS3EeD0+kUq7YLTSQl1+/3h5Xc7u5u3ZJ7+PBhFBQUYNu2bUGSW1hYqHoAxOHDh8X9peJbUFCAzs5O3dflWP4KmOLycPFBAMfyk5Dx4jlceG0dVqa8ivaZAfz2h4kwp72Oru/KbI1I7p3rb2Pd8oVeyZXix2DTlyh5aSNSEmdl9/svnMIk/ZcmiCVDKDmtqqrSJbHhxkklt7u7O6zk+v1+klwCcLlc2Lp1KxITE3X9idrv92PPnj1ifFJSEvLy8uD1qu8Gd7lcyMvLE+MTExORl5cHl8sVcl56JbeiogJZWQ+PGk1OTkZxcXHIFcjjx4/L6k1TU1Nx/PjxMFcqPGrXT6tcgZdmnDlzBtXV1bLXsHXrVoyMjOia++rVq1FaWhqxFVd+3cNJ7vr16zWPNOZzU96Wnp6OQCCAoqIi8XlITk7Ghx9+qCm5bW1tyM3NFeNXrlyJn//855iYmBDJKz4+XkRcXJwsli1bhmXLlmHt2rWGJJfzKPrk1pdkYXn8Bnx44zx+tsqM1633v9uQ9iT+/XIrDj6bgNSdH4NPx4jkzuAr/OyJ5WDxf40/dwVLauu7P4KJMWS8aNWcnzHJfci90f+DLRaG5XF5qL4ffjxBELFBOHkNJ7B6xoSS3LGxMZJcIhiHwwGTyaQqZ2qS6/V6YbFYVMdZLJYg0bVarUhISFAdbzKZYLdr7yDXI7kFBQWa887MzAwSv0AggOeee07zPvOtn52L5O7atUv3/IuKijTnXl5ePud5P//88yE/A2rPMRfJTUlJQWZmpupjf/nll0GS+84776iOjY+Px+uvv25IclNTU2NGcr3lL4DFr8GvXtuH5JV78PWdGcygAQVPLceGlw9gcwLDj379DfhsjEgucA+f/OKvZn9BfepnOKXaXWEdyuzaFhpOcqc7DmPXT/4HTv7nf2F8it/qx+C1d7HRwpCwYh+u0InABLFk0COwWhIb7udaktvf3z8nyZUKLknuEocLVn5+PiYmJgAAvb29QgRPnjwpG799+3YwNtsxwO+fbTE0MTGBwsJCMMawd+9e8WEIBAJCiF85cAA+n088/saNG8EYQ3Z2tuaHJ5zkVlZWClm2Wq1CCM+dOyeet7S0VHYfLpYWiwWnTp0S93G73dizZ09EN4nxaxtOchljWLNmDc6dOwdg9vrw+UulMhAIwGQywWw2w+l0itvdbjeKiopw5syZOc81WpLL45UDB0R5Ab9O+/fvFwnmwYMHaGlpEeMPHjyIsbEx3L9/H2NjY/j973+Pt956S7VcgTEmyhXGxsZEuUJ/f7+QXIfDoVtyq6urVetv9URubu6c3o/bDb/G6uWzr/3pnR+LLgfn/ilVXJN974/OUXKBe6On8ZO/Uv/lk8Un4MfF38g6K9z6dHfYz8bLf3koxbzuV/3xTdherP3LLUEQsYdeyVWKbKifqUmuw+EIK7n8IAg9kqsUXJLcJUZ6ejoYY5iampLdXl5eLgST09/fD8YYXnrpJdXHSktLg9lsFh+GY8eOBT0GJxAIYO3atZqSBISX3G3btmmuYF66dAmMyf/kHggExIaqUCvIkUKv5GZmZgatgB89elSIH3/tPp8PjDGYzWbN0pBIsJDlCvwXJM7MzAyuXbsGxhhycnJkkvviiy+CMYbXXnstqC43VE0ul1yfzyck9+bNm3OWXACiD65RwT179qzu55ASGHwPf22aFcKX/zItbuc9dHnf27lKLgA8mHbig19uxNOW78qUTEl48tmfoKzSE9Q6zKjkAn5cO/Mmfpy9ZvbkNdnj92u2JiMIIjbRU2+rlFkjgqsluTdv3hSSOzExQZJLyNFayc3NzQVjDEeOHBFjufiGC/5h4KUEp0+fVn3uV199VXW1mBNOcs1mM0wmk+ZrS0lJkYkWF9/NmzeHvzARQK/kqvXR5a998+bNsteen58PxmbrmouKimCz2SI+74WWXCkzMzNobW0VzydNMPz9Gxsbi6jkXr9+3bDkKtHTJ5cgCOJxQe/GMq3Q213B4XDg+vXrCya5i71HLkCSa4irV69qyqrFYsH4+LgYa1Ry+Z/AtVZqueTNVXLDiRhfpVbO/9ChQ7quzXyJhOSq9aUtLS1FUlKSuN6JiYlhN9oZYbFILmMMaWlpqh0WeLKS9sr1+/3w+/1Bkuv1eoXk9vT0kOQSBEFEGD2SqiW6eu8rldyenh4huV6vN0hy+feBskcuSe5jBm/6v2XLFlm3hKKiIlFzy+GSqPcEr927dy/oSq7JZDK0kstreNXKJxaC+Uiu3W4P+doBwGazyboU5OfnR2Tei0VyeWnJQkhuW1vbvCRXeVTv4OAgbDaboTZhBEEQSwW9ompko5ma5La1tYWU3MnJSZJc4iFmsxk7duzQ9QZy8crOztb12EeOHAFjs5vRlAQCAaxatQqMMXg8HtX7h5PcnJwcMMZgtQa3OuJCm5OTI27jNcULXdPKmY/kvnLggO5fKLxerxDCSKBXcvlKfV1dnex26YY6KUYl9wc/+AEYY/joo490nXqmlNyRkRGMj4/LJLe3txcul2vekksQBEE8xIisctE1eh8uuS6XC729vTLJHR8f1yW5sX6kL0CSawheltDY2Kgpm1L4ZrFNmzbB7XaHHNvT0yPakxUXF8tqfnl3hVArleEkl0u0xWLR7K6g3JTGN6ulpqaitrZ2UXRX2L17N0ZHRwHM9iDmt5tMJpmMOxwO5OXloa6uTrbKbrPZYDabYTabIzJvvZLLa6537dolEsrBgwdlpStS1G4DoCm5f/zjH8V1eO+99zA+Pi66K7z77rt46623go729fv9+P73v4+4uDj84he/QG9vL7xeL4aGhkhyCYIgFgijwjqXUJPcoaEhTckNd6RvLAouQJJrCL4aqhb8kAEpdrs9ZF9d5cojL4dQizVr1gStqPI6Wq1QdkvIzs7WHKv253uv1ytWkNViPpKrp2ZZWpohXfEMNxZ4KJ9aUVJSMue5qz1POMnlq+XKyMzMDCoVAYxL7szMjGYPYd4nlycuqeS+/fbbqr1yU1NTcaOvDy6XCxUVFSS5BEEQESJaktve3g6Xy4UbfX1CckdHRzE+Pq7aI/fOnTuyUgWS3MeMsrIyMDa7eSklJUW2oUlLnvgJZmpj1f68XlVVhaysLCHHycnJKCoqCmpbBhiTXGBWdEtLS7F69Wox5plnngl5epnf70dRURGSk5N130cPkZDcxMRE5ObmoqOjQ/U5PvnkE9m1NJlMyMrKQlVV1bzmLkWv5ALAiRMnxHXkHR/u3r0btOkPmJvkPnjwAH/6059kJ7wlJyeLE8/UJHdqagoffPABVq1aRZJLEAQRBR6F5A4MDJDkEtrwlbj09HTcvXtX9rNAIIA333wTjDFs3Lhx0b3JS4FQNbmPE6ESizIJSWtypXW5XHKnp6cxNTWF27dv49atW/D5fBgdHcXw8DAGBgbg8XjQ1dWF9vZ2klyCIIgIEU3J7erqgsfjwcDAAIaHhzE6OgqfT34QBP8+kEou/94gyX1MkB5GoFw5dDqdon5VeiABETlIcmcxIrlcdJWSy3vlqknu2NgYhoeHMTg4CI/HA7fbDafTSZJLEAQRIaIluU6nE263Gx6PB4ODgxgeHlY97Yx/HyjrcbnkGjkEYrH5D0muTq5evRqyvpax2U1d0ehEsNgIV3agDK1ewKEgyZ0lVGLRWs1Vk1y+mssld3JyEj6fD+Pj4+JACI/Hg+7ubpJcgiCICBJNye3u7obH4xEHQYyPj8Pn84lNZ1xy1TadaUluuO+hxQRJrgE6OjqQl5cnq0/lNarFxcVBvXIfF0hyo8d8JJeLrrLDQjjJ7ezsJMklCIKIENGSXH6kbyjJVeusIP3OIMklCCKqGC1ZUJNc6fG+XHInJiZkvXI9Ho84EIIklyAIIjJES3L5QRBcckO1D5Me5yv9zojlUgWAJJcgYg6jq7nShHXv3r0gyZ2ampJJrnTzGe+VW1lZSUFBQUERQ8F75Eo3nUklV9pZgX8vKL8vYnkVFyDJJYiYY74lCzyZ8ZPPpqamMDU1hYmJCfh8sx0WRkZGMDAwgBt9fWLzmcPhgM1mw5UrV1BXV4fq6mpUVVWhsrISX3zxBaxWKz7//HN8/vnn+Oyzz/DZZ5+hoqICn376aVCcOXMmZJw+fZqCgoJiSUW4vKeWKysqKkQ+5fnVarXiiy++QGVlJaqqqlBdXY26ujpcuXIFNpsNDodDbDrj7cNGRkZEZ4WJiQmR96UnnSklN9ZLFQCSXIKISYyIrp663KmpKVmHBWVdrsvlQnt7O1paWtDY2IjLly+jrq4ONTU1uHjxIqqqqnD+/HlUVlbi3LlzIqxWq2qcPXs2KHgCp6CgoFjqoZYDtfKlNKdWVlbi/PnzqKqqwsWLF1FTU4O6ujpcvnwZjY2NaGlpEf1xlfW40s4Kyv64eupxY01wAZJcgohJjEqusssCl1zpau7t27dlJQtDQ0Oy1dzOzk60t7ejubkZjY2NuHLlCurr61FXV4fa2lrU1NTgwoUL+Oqrr/DVV1+hqqoqZJw/f16IMQUFBcXjGDwPhsuXPK9euHABNTU1qK2tRV1dHerr63HlyhU0NjaiubkZ7e3t6OzslK3iSg+BmJiYEF0V+CqumuSq9cclySUIIiqESzZS0Q11KISylZiyX650AxovW2hra0NLSwuampqE7DY0NKC+vh6XLl3CpUuXUFtbK6KmpkYzqqur5xQXL16koKCgWFQx13wWKkdKcynPr/X19WhoaBBy29TUhJaWFrS1tYkyBemGs1D9cfn3QLhDIPR85yxGSHIJIkYxKrmhTj/jXRZu3bqluprLRberq0us6DocDrS0tMBut6OpqUnU60rj8uXLuHz5MhoaGkTU19cbiq+//pqCgoIiJsNovpPmSp4/lXnVZrOhqakJdrsdLS0tcDgcYgW3q6tLCK7aKi6XXLWjfJWCa0RyFyskuQQRo8y3ZEF5+plSdPkGNKno9vb2wu12w+VyCdlta2sTwtvS0oLm5mbY7XZcu3YNTU1NImw2mywaGxtlcfXqVQoKCorHIpT5T5kfpbnz2rVrsNvtaG5uFnnW4XCgra1NyK3L5YLb7UZvb69McPmGMzXBDXXK2VIoVQBIcgkiZplLyQIXXbXTz5TtxKSdFqSie6OvT5QvdHV14fr163A6nXA6nejo6BDSKw2emNWiubmZgoKC4rGMULlRmUfb2trQ0dEh8u3169fR1dUlyhNu9PWpCi7vqKBsG6Z2ytlcVnFJcgmCWBDmIrn379+XSa60Z6600wIXXa/XKxPd/v5+3OjrQ29vL3p6etDT04Pu7m6Z9PLgyVgtOjo6KCgoKCg6OkLmSmlO5VLb3d0t8m9vby9u9PWhv79fJrher1cIrrSjgtoBEIFAIOh7ItZXcQGSXIKIefSIrjJ5KUVXuZrLOy3wo375ii7fjMZll6/s9vb2qkqvWnR1dcHlchkKaZKnoKCgiIUwmue4wKqFUmq52Ho8HiG3fJMZX8HlR/gqOyqoreKqfUfEuuACJLkEEfPoLVtQJjDlMb+8nZhUdHm3hfHxcYyNjcHr9WJ4eBjDw8MYGhrC4OAgBgYGRCkDjxt9fUHBE3S46O7upqCgoFiSoTcPquVQaY7leXdwcBBDQ0MiL3u9XoyNjQnBlXZT4PldeviDWpmCXsElySUIIiroSUZakqsmuvw0HGXHhbGxMYyOjooSBp5Yb968KWJwcFAWPBmrRX9/PwUFBcVjHaFypDKfSnMtz7+8NGF0dFQIrnSjmdbpZlq1uPfv318SgguQ5BLEkiCSq7nS3rlcdPlmNKnser1eIbtS4R0aGsLQ0JAsGavJLwUFBQWFeijzJ8+rUrHlcitdveV5enJyUia40p64j8sqLkCSSxBLhrluQjMiutLOC7yMgdfs8uBJVyrA0uBJWho8gVNQUFA8LqGWC9VypjSnSnMtz788H3O5na/gLoVaXA5JLkEsEebTUkyv6CplVyq80tpdaUiTslKCKSgoKCgehjJfKvOpVGq52CrlVq/gLsWWYUr+P+tphoL+jdhlAAAAAElFTkSuQmCC"
    }
   },
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "![image.png](attachment:64c1580e-21f7-4ed3-af12-4f59ced1d67b.png)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The containers (\"AzureSentinel\", \"util\", etc.) are also callable\n",
    "functions - they just return the list of functions they contain."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "whois function\n",
      "ip_type function\n",
      "ip_rev_resolve function\n",
      "geoloc function\n",
      "geoloc_ips function\n"
     ]
    }
   ],
   "source": [
    "IpAddress.util()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Now we're ready to run any of the functions for this entity"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>ip</th>\n",
       "      <th>result</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>20.72.193.242</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "              ip  result\n",
       "0  20.72.193.242  Public"
      ]
     },
     "execution_count": 16,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "IpAddress.util.ip_type(ip_addr)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>asn</th>\n",
       "      <th>asn_cidr</th>\n",
       "      <th>asn_country_code</th>\n",
       "      <th>asn_date</th>\n",
       "      <th>asn_description</th>\n",
       "      <th>asn_registry</th>\n",
       "      <th>nets</th>\n",
       "      <th>nir</th>\n",
       "      <th>query</th>\n",
       "      <th>raw</th>\n",
       "      <th>raw_referral</th>\n",
       "      <th>referral</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>8075</td>\n",
       "      <td>20.64.0.0/10</td>\n",
       "      <td>US</td>\n",
       "      <td>2017-10-18</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>arin</td>\n",
       "      <td>[{'cidr': '20.40.0.0/13, 20.48.0.0/12, 20.34.0.0/15, 20.64.0.0/10, 20.128.0.0/16, 20.36.0.0/14, ...</td>\n",
       "      <td>None</td>\n",
       "      <td>20.72.193.242</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "    asn      asn_cidr asn_country_code    asn_date  \\\n",
       "0  8075  20.64.0.0/10               US  2017-10-18   \n",
       "\n",
       "                   asn_description asn_registry  \\\n",
       "0  MICROSOFT-CORP-MSN-AS-BLOCK, US         arin   \n",
       "\n",
       "                                                                                                  nets  \\\n",
       "0  [{'cidr': '20.40.0.0/13, 20.48.0.0/12, 20.34.0.0/15, 20.64.0.0/10, 20.128.0.0/16, 20.36.0.0/14, ...   \n",
       "\n",
       "    nir          query   raw raw_referral referral  \n",
       "0  None  20.72.193.242  None         None     None  "
      ]
     },
     "execution_count": 17,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "entities.IpAddress.util.whois(ip_addr)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>qname</th>\n",
       "      <th>rdtype</th>\n",
       "      <th>response</th>\n",
       "      <th>ip_address</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>20.72.193.242</td>\n",
       "      <td>PTR</td>\n",
       "      <td>None of DNS query names exist: 20.72.193.242., 20.72.193.242.corp.microsoft.com.</td>\n",
       "      <td>20.72.193.242</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "           qname rdtype  \\\n",
       "0  20.72.193.242    PTR   \n",
       "\n",
       "                                                                           response  \\\n",
       "0  None of DNS query names exist: 20.72.193.242., 20.72.193.242.corp.microsoft.com.   \n",
       "\n",
       "      ip_address  \n",
       "0  20.72.193.242  "
      ]
     },
     "execution_count": 18,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "entities.IpAddress.util.ip_rev_resolve(ip_addr)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>CountryCode</th>\n",
       "      <th>CountryName</th>\n",
       "      <th>State</th>\n",
       "      <th>City</th>\n",
       "      <th>Longitude</th>\n",
       "      <th>Latitude</th>\n",
       "      <th>Asn</th>\n",
       "      <th>edges</th>\n",
       "      <th>Type</th>\n",
       "      <th>AdditionalData</th>\n",
       "      <th>IpAddress</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>US</td>\n",
       "      <td>United States</td>\n",
       "      <td>Washington</td>\n",
       "      <td>None</td>\n",
       "      <td>-122.3412</td>\n",
       "      <td>47.6032</td>\n",
       "      <td>None</td>\n",
       "      <td>{}</td>\n",
       "      <td>geolocation</td>\n",
       "      <td>{}</td>\n",
       "      <td>20.72.193.242</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "  CountryCode    CountryName       State  City  Longitude  Latitude   Asn  \\\n",
       "0          US  United States  Washington  None  -122.3412   47.6032  None   \n",
       "\n",
       "  edges         Type AdditionalData      IpAddress  \n",
       "0    {}  geolocation             {}  20.72.193.242  "
      ]
     },
     "execution_count": 19,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "entities.IpAddress.util.geoloc(ip_addr)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Ioc</th>\n",
       "      <th>IocType</th>\n",
       "      <th>SafeIoc</th>\n",
       "      <th>QuerySubtype</th>\n",
       "      <th>Provider</th>\n",
       "      <th>Result</th>\n",
       "      <th>Severity</th>\n",
       "      <th>Details</th>\n",
       "      <th>RawResult</th>\n",
       "      <th>Reference</th>\n",
       "      <th>Status</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>20.72.193.242</td>\n",
       "      <td>ipv4</td>\n",
       "      <td>20.72.193.242</td>\n",
       "      <td>None</td>\n",
       "      <td>Tor</td>\n",
       "      <td>True</td>\n",
       "      <td>information</td>\n",
       "      <td>Not found.</td>\n",
       "      <td>None</td>\n",
       "      <td>https://check.torproject.org/exit-addresses</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>20.72.193.242</td>\n",
       "      <td>ipv4</td>\n",
       "      <td>20.72.193.242</td>\n",
       "      <td>None</td>\n",
       "      <td>VirusTotal</td>\n",
       "      <td>True</td>\n",
       "      <td>unknown</td>\n",
       "      <td>{'verbose_msg': 'Missing IP address', 'response_code': 0}</td>\n",
       "      <td>{'response_code': 0, 'verbose_msg': 'Missing IP address'}</td>\n",
       "      <td>https://www.virustotal.com/vtapi/v2/ip-address/report</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>20.72.193.242</td>\n",
       "      <td>ipv4</td>\n",
       "      <td>20.72.193.242</td>\n",
       "      <td>None</td>\n",
       "      <td>XForce</td>\n",
       "      <td>True</td>\n",
       "      <td>warning</td>\n",
       "      <td>{'score': 1, 'cats': {}, 'categoryDescriptions': {}, 'reason': 'Regional Internet Registry', 're...</td>\n",
       "      <td>{'ip': '20.72.193.242', 'history': [{'created': '2012-03-22T07:26:00.000Z', 'reason': 'Regional ...</td>\n",
       "      <td>https://api.xforce.ibmcloud.com/ipr/20.72.193.242</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "             Ioc IocType        SafeIoc QuerySubtype    Provider  Result  \\\n",
       "0  20.72.193.242    ipv4  20.72.193.242         None         Tor    True   \n",
       "0  20.72.193.242    ipv4  20.72.193.242         None  VirusTotal    True   \n",
       "0  20.72.193.242    ipv4  20.72.193.242         None      XForce    True   \n",
       "\n",
       "      Severity  \\\n",
       "0  information   \n",
       "0      unknown   \n",
       "0      warning   \n",
       "\n",
       "                                                                                               Details  \\\n",
       "0                                                                                           Not found.   \n",
       "0                                            {'verbose_msg': 'Missing IP address', 'response_code': 0}   \n",
       "0  {'score': 1, 'cats': {}, 'categoryDescriptions': {}, 'reason': 'Regional Internet Registry', 're...   \n",
       "\n",
       "                                                                                             RawResult  \\\n",
       "0                                                                                                 None   \n",
       "0                                            {'response_code': 0, 'verbose_msg': 'Missing IP address'}   \n",
       "0  {'ip': '20.72.193.242', 'history': [{'created': '2012-03-22T07:26:00.000Z', 'reason': 'Regional ...   \n",
       "\n",
       "                                               Reference  Status  \n",
       "0            https://check.torproject.org/exit-addresses       0  \n",
       "0  https://www.virustotal.com/vtapi/v2/ip-address/report       0  \n",
       "0      https://api.xforce.ibmcloud.com/ipr/20.72.193.242       0  "
      ]
     },
     "execution_count": 20,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "entities.IpAddress.ti.lookup_ip(ip_addr)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Notice that we didn't need to worry about either the parameter\n",
    "name or format (more on this in the next section). Also, \n",
    "whatever the function, the output is always returned\n",
    "as a pandas DataFrame."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### For Data query functions you *do* need to worry about the parameter name\n",
    "Data query functions are a little more complex than most other functions\n",
    "and specifically often support many parameters. Rather than try\n",
    "to guess which parameter you meant, we require you to be explicit.\n",
    "\n",
    "To use a data query, we need to authenticate to the provider."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<!DOCTYPE html>\n",
       "                            <html><body>\n",
       "\n",
       "                            <!-- h1 id=\"user_code_p\"><b>RW8L2FJCE</b><br></h1-->\n",
       "\n",
       "                            <input  id=\"kql_MagicCodeAuthInput\" type=\"text\" readonly style=\"font-weight: bold; border: none;\" size='9' value='RW8L2FJCE'>\n",
       "\n",
       "                            <button id='kql_MagicCodeAuth_button', onclick=\"this.style.visibility='hidden';kql_MagicCodeAuthFunction()\">Copy code to clipboard and authenticate</button>\n",
       "\n",
       "                            <script>\n",
       "                            var kql_MagicUserCodeAuthWindow = null;\n",
       "                            function kql_MagicCodeAuthFunction() {\n",
       "                                /* Get the text field */\n",
       "                                var copyText = document.getElementById(\"kql_MagicCodeAuthInput\");\n",
       "\n",
       "                                /* Select the text field */\n",
       "                                copyText.select();\n",
       "\n",
       "                                /* Copy the text inside the text field */\n",
       "                                document.execCommand(\"copy\");\n",
       "\n",
       "                                /* Alert the copied text */\n",
       "                                // alert(\"Copied the text: \" + copyText.value);\n",
       "\n",
       "                                var w = screen.width / 2;\n",
       "                                var h = screen.height / 2;\n",
       "                                params = 'width='+w+',height='+h\n",
       "                                kql_MagicUserCodeAuthWindow = window.open('https://microsoft.com/devicelogin', 'kql_MagicUserCodeAuthWindow', params);\n",
       "\n",
       "                                // TODO: save selected cell index, so that the clear will be done on the lince cell\n",
       "                            }\n",
       "                            </script>\n",
       "\n",
       "                            </body></html>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<!DOCTYPE html>\n",
       "                            <html><body><script>\n",
       "\n",
       "                                // close authentication window\n",
       "                                if (kql_MagicUserCodeAuthWindow && kql_MagicUserCodeAuthWindow.opener != null && !kql_MagicUserCodeAuthWindow.closed) {\n",
       "                                    kql_MagicUserCodeAuthWindow.close()\n",
       "                                }\n",
       "                                // TODO: make sure, you clear the right cell. BTW, not sure it is a must to do any clearing\n",
       "\n",
       "                                // clear output cell\n",
       "                                Jupyter.notebook.clear_output(Jupyter.notebook.get_selected_index())\n",
       "\n",
       "                                // TODO: if in run all mode, move to last cell, otherwise move to next cell\n",
       "                                // move to next cell\n",
       "\n",
       "                            </script></body></html>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<!DOCTYPE html>\n",
       "            <html><body>\n",
       "            <div style=''>\n",
       "            \n",
       "            <button onclick=\"this.style.visibility='visible';\n",
       "            kql_MagicLaunchWindowFunction('kqlmagic/temp_files/1a4a75be-860e-432e-a3ac-d1245c05c3a6/_8ecf8077-cf51-4820-aadd-14040956f35d_at_loganalytics_schema.html', 'fullscreen=no,directories=no,location=no,menubar=no,resizable=yes,scrollbars=yes,status=no,titlebar=no,toolbar=no,', '_8ecf8077_cf51_4820_aadd_14040956f35d_at_loganalytics_schema', '');\n",
       "            kql_MagicCloseWindow(kql_Magic__8ecf8077_cf51_4820_aadd_14040956f35d_at_loganalytics_schema, -1, -1);\">\n",
       "            popup schema 8ecf8077-cf51-4820-aadd-14040956f35d@loganalytics</button>\n",
       "            </div>\n",
       "\n",
       "            <script>\n",
       "            var kql_Magic__8ecf8077_cf51_4820_aadd_14040956f35d_at_loganalytics_schema = null;\n",
       "\n",
       "\n",
       "            function kql_MagicCloseWindow(window_obj, obj_secs, itself_secs) {\n",
       "                if (obj_secs >= 0) {\n",
       "                    _timeout = setTimeout(function(){\n",
       "                        window_obj.close();\n",
       "                        if (itself_secs >= 0) {\n",
       "                            __timeout = setTimeout(function(){window.close();}, itself_secs * 1000);\n",
       "                        }\n",
       "                    }, obj_secs * 1000);\n",
       "                } else if (itself_secs >= 0) {\n",
       "                    _timeout = setTimeout(function(){window.close();}, itself_secs * 1000);\n",
       "                }\n",
       "            }\n",
       "\n",
       "            function kql_MagicLaunchWindowFunction(file_path_or_data, window_params, window_name, host_or_text) {\n",
       "                var url;\n",
       "                const baseURI = String(window.location);\n",
       "                if (host_or_text == 'text' || host_or_text == 'body') {\n",
       "                    url = ''\n",
       "                } else if (file_path_or_data.startsWith('http')) {\n",
       "                    url = file_path_or_data;\n",
       "                } else if (host_or_text.endsWith('.azureml.ms') || host_or_text.endsWith('.azureml.net')) {\n",
       "                    let azuremlBaseURI = String(window.document.baseURI);\n",
       "                    let start = azuremlBaseURI.search('activeFilePath=');\n",
       "                    if (start > 0) {\n",
       "                        start += 'activeFilePath='.length;\n",
       "                        let end = azuremlBaseURI.substring(start).search('&');\n",
       "                        if (end < 0) {\n",
       "                            end = undefined;\n",
       "                        }\n",
       "                        let parts = azuremlBaseURI.substring(start, end).split('/');\n",
       "                        parts.pop();\n",
       "                        url = host_or_text + '/tree/' + parts.join('/') + '/' + file_path_or_data;\n",
       "                    } else {\n",
       "                        var parts = baseURI.split('/');\n",
       "                        parts.pop();\n",
       "                        url = parts.join('/') + '/' + file_path_or_data;\n",
       "                    }\n",
       "                } else {\n",
       "                    var base_url = '';\n",
       "\n",
       "                    // check if azure notebook\n",
       "                    var azure_host = (host_or_text == null || host_or_text.length == 0) ? 'https://notebooks.azure.com' : host_or_text;\n",
       "                    var start = azure_host.search('//');\n",
       "                    var azure_host_suffix = '.' + azure_host.substring(start+2);\n",
       "\n",
       "                    var end = baseURI.search(azure_host_suffix);\n",
       "                    start = baseURI.search('//');\n",
       "                    if (start > 0 && end > 0) {\n",
       "                        // # azure notebook environment, assume template: https://library-user.notebooks.azure.com\n",
       "                        var parts = baseURI.substring(start+2, end).split('-');\n",
       "                        if (parts.length == 2) {\n",
       "                            var library = parts[0];\n",
       "                            var user = parts[1];\n",
       "                            base_url = azure_host + '/api/user/' +user+ '/library/' +library+ '/html/';\n",
       "                        }\n",
       "                    }\n",
       "\n",
       "                    // check if local jupyter lab\n",
       "                    if (base_url.length == 0) {\n",
       "                        var configDataScipt  = document.getElementById('jupyter-config-data');\n",
       "                        if (configDataScipt != null) {\n",
       "                            var jupyterConfigData = JSON.parse(configDataScipt.textContent);\n",
       "                            if (jupyterConfigData['appName'] == 'JupyterLab' && jupyterConfigData['serverRoot'] != null &&  jupyterConfigData['treeUrl'] != null) {\n",
       "                                var basePath = 'e:/src/microsoft/msticpy/docs/notebooks' + '/';\n",
       "                                if (basePath.startsWith(jupyterConfigData['serverRoot'])) {\n",
       "                                    base_url = '/files/' + basePath.substring(jupyterConfigData['serverRoot'].length+1);\n",
       "                                }\n",
       "                            }\n",
       "                        }\n",
       "                    }\n",
       "\n",
       "                    // works for local jupyter notebook\n",
       "                    if (base_url.length == 0) {\n",
       "\n",
       "                        var parts = baseURI.split('/');\n",
       "                        parts.pop(); // remove notebook name segment\n",
       "                        base_url = parts.join('/') + '/';\n",
       "                    }\n",
       "                    url = base_url + file_path_or_data;\n",
       "                }\n",
       "\n",
       "                window.focus();\n",
       "                var w = screen.width / 2;\n",
       "                var h = screen.height / 2;\n",
       "                params = 'width='+w+',height='+h;\n",
       "                // kql_Magic + window_name should be a global variable \n",
       "                window_obj = window.open(url, window_name, window_params + params);\n",
       "                if (url == '') {\n",
       "                    let decodedData = atob(file_path_or_data);\n",
       "                    if (host_or_text == 'text') {\n",
       "                        var el = window_obj.document.createElement('p');\n",
       "                        window_obj.document.body.overflow = 'auto';\n",
       "                        el.style.top = 0;\n",
       "                        el.style.left = 0;\n",
       "                        el.innerHTML = decodedData;\n",
       "                        window_obj.document.body.appendChild(el);\n",
       "                    } else {\n",
       "                        window_obj.document.body.innerHTML = decodedData;\n",
       "                    }\n",
       "                }\n",
       "                kql_Magic__8ecf8077_cf51_4820_aadd_14040956f35d_at_loganalytics_schema = window_obj;\n",
       "            }\n",
       "            </script>\n",
       "\n",
       "            </body></html>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "az_provider.connect(WorkspaceConfig(workspace=\"CyberSecuritySoc\").code_connect_str)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "If you are not sure of the parameters required by the query\n",
    "you can use the built-in help"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "\u001b[1;31mSignature:\u001b[0m \u001b[0mHost\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mAzureSentinel\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mSecurityAlert_list_related_alerts\u001b[0m\u001b[1;33m(\u001b[0m\u001b[1;33m*\u001b[0m\u001b[0margs\u001b[0m\u001b[1;33m,\u001b[0m \u001b[1;33m**\u001b[0m\u001b[0mkwargs\u001b[0m\u001b[1;33m)\u001b[0m \u001b[1;33m->\u001b[0m \u001b[0mUnion\u001b[0m\u001b[1;33m[\u001b[0m\u001b[0mpandas\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mcore\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mframe\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mDataFrame\u001b[0m\u001b[1;33m,\u001b[0m \u001b[0mAny\u001b[0m\u001b[1;33m]\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n",
       "\u001b[1;31mDocstring:\u001b[0m\n",
       "Retrieves list of alerts with a common host, account or process\n",
       "\n",
       "Parameters\n",
       "----------\n",
       "account_name: str (optional)\n",
       "    The account name to find\n",
       "add_query_items: str (optional)\n",
       "    Additional query clauses\n",
       "end: datetime (optional)\n",
       "    Query end time\n",
       "host_name: str (optional)\n",
       "    The hostname to find\n",
       "path_separator: str (optional)\n",
       "    Path separator\n",
       "    (default value is: \\\\)\n",
       "process_name: str (optional)\n",
       "    The process name to find\n",
       "query_project: str (optional)\n",
       "    Column project statement\n",
       "    (default value is:  | project-rename StartTimeUtc = StartTime, EndTim...)\n",
       "start: datetime (optional)\n",
       "    Query start time\n",
       "    (default value is: -30)\n",
       "subscription_filter: str (optional)\n",
       "    Optional subscription/tenant filter expression\n",
       "    (default value is: true)\n",
       "table: str (optional)\n",
       "    Table name\n",
       "    (default value is: SecurityAlert)\n",
       "\u001b[1;31mFile:\u001b[0m      c:\\users\\ian\\anaconda3\\envs\\condadev\\lib\\functools.py\n",
       "\u001b[1;31mType:\u001b[0m      function\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "Host.AzureSentinel.SecurityAlert_list_related_alerts?"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>TenantId</th>\n",
       "      <th>TimeGenerated</th>\n",
       "      <th>AlertDisplayName</th>\n",
       "      <th>AlertName</th>\n",
       "      <th>Severity</th>\n",
       "      <th>Description</th>\n",
       "      <th>ProviderName</th>\n",
       "      <th>VendorName</th>\n",
       "      <th>VendorOriginalId</th>\n",
       "      <th>SystemAlertId</th>\n",
       "      <th>ResourceId</th>\n",
       "      <th>SourceComputerId</th>\n",
       "      <th>AlertType</th>\n",
       "      <th>ConfidenceLevel</th>\n",
       "      <th>ConfidenceScore</th>\n",
       "      <th>IsIncident</th>\n",
       "      <th>StartTimeUtc</th>\n",
       "      <th>EndTimeUtc</th>\n",
       "      <th>ProcessingEndTime</th>\n",
       "      <th>RemediationSteps</th>\n",
       "      <th>ExtendedProperties</th>\n",
       "      <th>Entities</th>\n",
       "      <th>SourceSystem</th>\n",
       "      <th>WorkspaceSubscriptionId</th>\n",
       "      <th>WorkspaceResourceGroup</th>\n",
       "      <th>ExtendedLinks</th>\n",
       "      <th>ProductName</th>\n",
       "      <th>ProductComponentName</th>\n",
       "      <th>AlertLink</th>\n",
       "      <th>Status</th>\n",
       "      <th>CompromisedEntity</th>\n",
       "      <th>Tactics</th>\n",
       "      <th>Type</th>\n",
       "      <th>Computer</th>\n",
       "      <th>src_hostname</th>\n",
       "      <th>src_accountname</th>\n",
       "      <th>src_procname</th>\n",
       "      <th>host_match</th>\n",
       "      <th>acct_match</th>\n",
       "      <th>proc_match</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
       "      <td>2021-03-11 12:05:14.355000+00:00</td>\n",
       "      <td>Suspected credential theft activity</td>\n",
       "      <td>Suspected credential theft activity</td>\n",
       "      <td>Medium</td>\n",
       "      <td>This program exhibits suspect characteristics potentially associated with credential theft.  Onc...</td>\n",
       "      <td>MDATP</td>\n",
       "      <td>Microsoft</td>\n",
       "      <td>da637509097413415122_-841817867</td>\n",
       "      <td>bf226b1b-8bda-31f7-c848-1f8bbb5f5922</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>WindowsDefenderAtp</td>\n",
       "      <td></td>\n",
       "      <td>NaN</td>\n",
       "      <td>False</td>\n",
       "      <td>2021-03-09 17:56:55.275000+00:00</td>\n",
       "      <td>2021-03-09 17:56:55.275000+00:00</td>\n",
       "      <td>2021-03-11 12:05:13.759000+00:00</td>\n",
       "      <td>[\\r\\n  \"1. Make sure the machine is completely updated and all your software has the latest patc...</td>\n",
       "      <td>{\\r\\n  \"MicrosoftDefenderAtp.Category\": \"CredentialAccess\",\\r\\n  \"MicrosoftDefenderAtp.Investiga...</td>\n",
       "      <td>[\\r\\n  {\\r\\n    \"$id\": \"4\",\\r\\n    \"DnsDomain\": \"na.contosohotels.com\",\\r\\n    \"HostName\": \"vict...</td>\n",
       "      <td>Detection</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>Microsoft Defender Advanced Threat Protection</td>\n",
       "      <td></td>\n",
       "      <td>https://securitycenter.microsoft.com/alert/da637509097413415122_-841817867?tid=4b2462a4-bbee-495...</td>\n",
       "      <td>New</td>\n",
       "      <td>victim00.na.contosohotels.com</td>\n",
       "      <td>CredentialAccess</td>\n",
       "      <td>SecurityAlert</td>\n",
       "      <td>victim00</td>\n",
       "      <td>victim00</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>True</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
       "      <td>2021-03-11 13:24:53.495000+00:00</td>\n",
       "      <td>'Mimikatz' hacktool was detected</td>\n",
       "      <td>'Mimikatz' hacktool was detected</td>\n",
       "      <td>Low</td>\n",
       "      <td>Readily available tools, such as hacking programs, can be used by unauthorized individuals to sp...</td>\n",
       "      <td>MDATP</td>\n",
       "      <td>Microsoft</td>\n",
       "      <td>da637510393722104539_-1180405651</td>\n",
       "      <td>ef04126b-2683-0a98-d01c-77ee6b1115ac</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>WindowsDefenderAv</td>\n",
       "      <td></td>\n",
       "      <td>NaN</td>\n",
       "      <td>False</td>\n",
       "      <td>2021-03-11 06:00:14.083000+00:00</td>\n",
       "      <td>2021-03-11 06:00:14.083000+00:00</td>\n",
       "      <td>2021-03-11 13:24:53.379000+00:00</td>\n",
       "      <td>[\\r\\n  \"1. Make sure the machine is completely updated and all your software has the latest patc...</td>\n",
       "      <td>{\\r\\n  \"MicrosoftDefenderAtp.Category\": \"Malware\",\\r\\n  \"MicrosoftDefenderAtp.InvestigationId\": ...</td>\n",
       "      <td>[\\r\\n  {\\r\\n    \"$id\": \"4\",\\r\\n    \"DnsDomain\": \"na.contosohotels.com\",\\r\\n    \"HostName\": \"vict...</td>\n",
       "      <td>Detection</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>Microsoft Defender Advanced Threat Protection</td>\n",
       "      <td></td>\n",
       "      <td>https://securitycenter.microsoft.com/alert/da637510393722104539_-1180405651?tid=4b2462a4-bbee-49...</td>\n",
       "      <td>New</td>\n",
       "      <td>victim00.na.contosohotels.com</td>\n",
       "      <td>Unknown</td>\n",
       "      <td>SecurityAlert</td>\n",
       "      <td>victim00</td>\n",
       "      <td>victim00</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>True</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
       "      <td>2021-03-11 13:24:53.490000+00:00</td>\n",
       "      <td>Suspected credential theft activity</td>\n",
       "      <td>Suspected credential theft activity</td>\n",
       "      <td>Medium</td>\n",
       "      <td>This program exhibits suspect characteristics potentially associated with credential theft.  Onc...</td>\n",
       "      <td>MDATP</td>\n",
       "      <td>Microsoft</td>\n",
       "      <td>da637509097413415122_-841817867</td>\n",
       "      <td>bf226b1b-8bda-31f7-c848-1f8bbb5f5922</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>WindowsDefenderAtp</td>\n",
       "      <td></td>\n",
       "      <td>NaN</td>\n",
       "      <td>False</td>\n",
       "      <td>2021-03-09 17:56:55.275000+00:00</td>\n",
       "      <td>2021-03-09 17:56:55.275000+00:00</td>\n",
       "      <td>2021-03-11 13:24:53.363000+00:00</td>\n",
       "      <td>[\\r\\n  \"1. Make sure the machine is completely updated and all your software has the latest patc...</td>\n",
       "      <td>{\\r\\n  \"MicrosoftDefenderAtp.Category\": \"CredentialAccess\",\\r\\n  \"MicrosoftDefenderAtp.Investiga...</td>\n",
       "      <td>[\\r\\n  {\\r\\n    \"$id\": \"4\",\\r\\n    \"DnsDomain\": \"na.contosohotels.com\",\\r\\n    \"HostName\": \"vict...</td>\n",
       "      <td>Detection</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>Microsoft Defender Advanced Threat Protection</td>\n",
       "      <td></td>\n",
       "      <td>https://securitycenter.microsoft.com/alert/da637509097413415122_-841817867?tid=4b2462a4-bbee-495...</td>\n",
       "      <td>New</td>\n",
       "      <td>victim00.na.contosohotels.com</td>\n",
       "      <td>CredentialAccess</td>\n",
       "      <td>SecurityAlert</td>\n",
       "      <td>victim00</td>\n",
       "      <td>victim00</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>True</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
       "      <td>2021-03-11 13:19:42.521000+00:00</td>\n",
       "      <td>Malicious credential theft tool execution detected</td>\n",
       "      <td>Malicious credential theft tool execution detected</td>\n",
       "      <td>High</td>\n",
       "      <td>A known credential theft tool execution command line was detected.\\nEither the process itself or...</td>\n",
       "      <td>MDATP</td>\n",
       "      <td>Microsoft</td>\n",
       "      <td>da637508847019595161_-562481393</td>\n",
       "      <td>753680a5-4d20-2726-61b4-9c36e620ea26</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>WindowsDefenderAtp</td>\n",
       "      <td></td>\n",
       "      <td>NaN</td>\n",
       "      <td>False</td>\n",
       "      <td>2021-03-09 10:56:58.134000+00:00</td>\n",
       "      <td>2021-03-09 10:56:58.134000+00:00</td>\n",
       "      <td>2021-03-11 13:19:42.289000+00:00</td>\n",
       "      <td>[\\r\\n  \"1. Make sure the machine is completely updated and all your software has the latest patc...</td>\n",
       "      <td>{\\r\\n  \"MicrosoftDefenderAtp.Category\": \"CredentialAccess\",\\r\\n  \"MicrosoftDefenderAtp.Investiga...</td>\n",
       "      <td>[\\r\\n  {\\r\\n    \"$id\": \"4\",\\r\\n    \"DnsDomain\": \"na.contosohotels.com\",\\r\\n    \"HostName\": \"vict...</td>\n",
       "      <td>Detection</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>Microsoft Defender Advanced Threat Protection</td>\n",
       "      <td></td>\n",
       "      <td>https://securitycenter.microsoft.com/alert/da637508847019595161_-562481393?tid=4b2462a4-bbee-495...</td>\n",
       "      <td>New</td>\n",
       "      <td>victim00.na.contosohotels.com</td>\n",
       "      <td>CredentialAccess</td>\n",
       "      <td>SecurityAlert</td>\n",
       "      <td>victim00</td>\n",
       "      <td>victim00</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>True</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
       "      <td>2021-03-11 14:30:14.730000+00:00</td>\n",
       "      <td>'Mimikatz' hacktool was detected</td>\n",
       "      <td>'Mimikatz' hacktool was detected</td>\n",
       "      <td>Low</td>\n",
       "      <td>Readily available tools, such as hacking programs, can be used by unauthorized individuals to sp...</td>\n",
       "      <td>MDATP</td>\n",
       "      <td>Microsoft</td>\n",
       "      <td>da637510393722104539_-1180405651</td>\n",
       "      <td>ef04126b-2683-0a98-d01c-77ee6b1115ac</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>WindowsDefenderAv</td>\n",
       "      <td></td>\n",
       "      <td>NaN</td>\n",
       "      <td>False</td>\n",
       "      <td>2021-03-11 06:00:14.083000+00:00</td>\n",
       "      <td>2021-03-11 06:00:14.083000+00:00</td>\n",
       "      <td>2021-03-11 14:30:14.450000+00:00</td>\n",
       "      <td>[\\r\\n  \"1. Make sure the machine is completely updated and all your software has the latest patc...</td>\n",
       "      <td>{\\r\\n  \"MicrosoftDefenderAtp.Category\": \"Malware\",\\r\\n  \"MicrosoftDefenderAtp.InvestigationId\": ...</td>\n",
       "      <td>[\\r\\n  {\\r\\n    \"$id\": \"4\",\\r\\n    \"DnsDomain\": \"na.contosohotels.com\",\\r\\n    \"HostName\": \"vict...</td>\n",
       "      <td>Detection</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>Microsoft Defender Advanced Threat Protection</td>\n",
       "      <td></td>\n",
       "      <td>https://securitycenter.microsoft.com/alert/da637510393722104539_-1180405651?tid=4b2462a4-bbee-49...</td>\n",
       "      <td>New</td>\n",
       "      <td>victim00.na.contosohotels.com</td>\n",
       "      <td>Unknown</td>\n",
       "      <td>SecurityAlert</td>\n",
       "      <td>victim00</td>\n",
       "      <td>victim00</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>True</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                               TenantId                    TimeGenerated  \\\n",
       "0  8ecf8077-cf51-4820-aadd-14040956f35d 2021-03-11 12:05:14.355000+00:00   \n",
       "1  8ecf8077-cf51-4820-aadd-14040956f35d 2021-03-11 13:24:53.495000+00:00   \n",
       "2  8ecf8077-cf51-4820-aadd-14040956f35d 2021-03-11 13:24:53.490000+00:00   \n",
       "3  8ecf8077-cf51-4820-aadd-14040956f35d 2021-03-11 13:19:42.521000+00:00   \n",
       "4  8ecf8077-cf51-4820-aadd-14040956f35d 2021-03-11 14:30:14.730000+00:00   \n",
       "\n",
       "                                     AlertDisplayName  \\\n",
       "0                 Suspected credential theft activity   \n",
       "1                    'Mimikatz' hacktool was detected   \n",
       "2                 Suspected credential theft activity   \n",
       "3  Malicious credential theft tool execution detected   \n",
       "4                    'Mimikatz' hacktool was detected   \n",
       "\n",
       "                                            AlertName Severity  \\\n",
       "0                 Suspected credential theft activity   Medium   \n",
       "1                    'Mimikatz' hacktool was detected      Low   \n",
       "2                 Suspected credential theft activity   Medium   \n",
       "3  Malicious credential theft tool execution detected     High   \n",
       "4                    'Mimikatz' hacktool was detected      Low   \n",
       "\n",
       "                                                                                           Description  \\\n",
       "0  This program exhibits suspect characteristics potentially associated with credential theft.  Onc...   \n",
       "1  Readily available tools, such as hacking programs, can be used by unauthorized individuals to sp...   \n",
       "2  This program exhibits suspect characteristics potentially associated with credential theft.  Onc...   \n",
       "3  A known credential theft tool execution command line was detected.\\nEither the process itself or...   \n",
       "4  Readily available tools, such as hacking programs, can be used by unauthorized individuals to sp...   \n",
       "\n",
       "  ProviderName VendorName                  VendorOriginalId  \\\n",
       "0        MDATP  Microsoft   da637509097413415122_-841817867   \n",
       "1        MDATP  Microsoft  da637510393722104539_-1180405651   \n",
       "2        MDATP  Microsoft   da637509097413415122_-841817867   \n",
       "3        MDATP  Microsoft   da637508847019595161_-562481393   \n",
       "4        MDATP  Microsoft  da637510393722104539_-1180405651   \n",
       "\n",
       "                          SystemAlertId ResourceId SourceComputerId  \\\n",
       "0  bf226b1b-8bda-31f7-c848-1f8bbb5f5922                               \n",
       "1  ef04126b-2683-0a98-d01c-77ee6b1115ac                               \n",
       "2  bf226b1b-8bda-31f7-c848-1f8bbb5f5922                               \n",
       "3  753680a5-4d20-2726-61b4-9c36e620ea26                               \n",
       "4  ef04126b-2683-0a98-d01c-77ee6b1115ac                               \n",
       "\n",
       "            AlertType ConfidenceLevel  ConfidenceScore  IsIncident  \\\n",
       "0  WindowsDefenderAtp                              NaN       False   \n",
       "1   WindowsDefenderAv                              NaN       False   \n",
       "2  WindowsDefenderAtp                              NaN       False   \n",
       "3  WindowsDefenderAtp                              NaN       False   \n",
       "4   WindowsDefenderAv                              NaN       False   \n",
       "\n",
       "                      StartTimeUtc                       EndTimeUtc  \\\n",
       "0 2021-03-09 17:56:55.275000+00:00 2021-03-09 17:56:55.275000+00:00   \n",
       "1 2021-03-11 06:00:14.083000+00:00 2021-03-11 06:00:14.083000+00:00   \n",
       "2 2021-03-09 17:56:55.275000+00:00 2021-03-09 17:56:55.275000+00:00   \n",
       "3 2021-03-09 10:56:58.134000+00:00 2021-03-09 10:56:58.134000+00:00   \n",
       "4 2021-03-11 06:00:14.083000+00:00 2021-03-11 06:00:14.083000+00:00   \n",
       "\n",
       "                 ProcessingEndTime  \\\n",
       "0 2021-03-11 12:05:13.759000+00:00   \n",
       "1 2021-03-11 13:24:53.379000+00:00   \n",
       "2 2021-03-11 13:24:53.363000+00:00   \n",
       "3 2021-03-11 13:19:42.289000+00:00   \n",
       "4 2021-03-11 14:30:14.450000+00:00   \n",
       "\n",
       "                                                                                      RemediationSteps  \\\n",
       "0  [\\r\\n  \"1. Make sure the machine is completely updated and all your software has the latest patc...   \n",
       "1  [\\r\\n  \"1. Make sure the machine is completely updated and all your software has the latest patc...   \n",
       "2  [\\r\\n  \"1. Make sure the machine is completely updated and all your software has the latest patc...   \n",
       "3  [\\r\\n  \"1. Make sure the machine is completely updated and all your software has the latest patc...   \n",
       "4  [\\r\\n  \"1. Make sure the machine is completely updated and all your software has the latest patc...   \n",
       "\n",
       "                                                                                    ExtendedProperties  \\\n",
       "0  {\\r\\n  \"MicrosoftDefenderAtp.Category\": \"CredentialAccess\",\\r\\n  \"MicrosoftDefenderAtp.Investiga...   \n",
       "1  {\\r\\n  \"MicrosoftDefenderAtp.Category\": \"Malware\",\\r\\n  \"MicrosoftDefenderAtp.InvestigationId\": ...   \n",
       "2  {\\r\\n  \"MicrosoftDefenderAtp.Category\": \"CredentialAccess\",\\r\\n  \"MicrosoftDefenderAtp.Investiga...   \n",
       "3  {\\r\\n  \"MicrosoftDefenderAtp.Category\": \"CredentialAccess\",\\r\\n  \"MicrosoftDefenderAtp.Investiga...   \n",
       "4  {\\r\\n  \"MicrosoftDefenderAtp.Category\": \"Malware\",\\r\\n  \"MicrosoftDefenderAtp.InvestigationId\": ...   \n",
       "\n",
       "                                                                                              Entities  \\\n",
       "0  [\\r\\n  {\\r\\n    \"$id\": \"4\",\\r\\n    \"DnsDomain\": \"na.contosohotels.com\",\\r\\n    \"HostName\": \"vict...   \n",
       "1  [\\r\\n  {\\r\\n    \"$id\": \"4\",\\r\\n    \"DnsDomain\": \"na.contosohotels.com\",\\r\\n    \"HostName\": \"vict...   \n",
       "2  [\\r\\n  {\\r\\n    \"$id\": \"4\",\\r\\n    \"DnsDomain\": \"na.contosohotels.com\",\\r\\n    \"HostName\": \"vict...   \n",
       "3  [\\r\\n  {\\r\\n    \"$id\": \"4\",\\r\\n    \"DnsDomain\": \"na.contosohotels.com\",\\r\\n    \"HostName\": \"vict...   \n",
       "4  [\\r\\n  {\\r\\n    \"$id\": \"4\",\\r\\n    \"DnsDomain\": \"na.contosohotels.com\",\\r\\n    \"HostName\": \"vict...   \n",
       "\n",
       "  SourceSystem WorkspaceSubscriptionId WorkspaceResourceGroup ExtendedLinks  \\\n",
       "0    Detection                                                                \n",
       "1    Detection                                                                \n",
       "2    Detection                                                                \n",
       "3    Detection                                                                \n",
       "4    Detection                                                                \n",
       "\n",
       "                                     ProductName ProductComponentName  \\\n",
       "0  Microsoft Defender Advanced Threat Protection                        \n",
       "1  Microsoft Defender Advanced Threat Protection                        \n",
       "2  Microsoft Defender Advanced Threat Protection                        \n",
       "3  Microsoft Defender Advanced Threat Protection                        \n",
       "4  Microsoft Defender Advanced Threat Protection                        \n",
       "\n",
       "                                                                                             AlertLink  \\\n",
       "0  https://securitycenter.microsoft.com/alert/da637509097413415122_-841817867?tid=4b2462a4-bbee-495...   \n",
       "1  https://securitycenter.microsoft.com/alert/da637510393722104539_-1180405651?tid=4b2462a4-bbee-49...   \n",
       "2  https://securitycenter.microsoft.com/alert/da637509097413415122_-841817867?tid=4b2462a4-bbee-495...   \n",
       "3  https://securitycenter.microsoft.com/alert/da637508847019595161_-562481393?tid=4b2462a4-bbee-495...   \n",
       "4  https://securitycenter.microsoft.com/alert/da637510393722104539_-1180405651?tid=4b2462a4-bbee-49...   \n",
       "\n",
       "  Status              CompromisedEntity           Tactics           Type  \\\n",
       "0    New  victim00.na.contosohotels.com  CredentialAccess  SecurityAlert   \n",
       "1    New  victim00.na.contosohotels.com           Unknown  SecurityAlert   \n",
       "2    New  victim00.na.contosohotels.com  CredentialAccess  SecurityAlert   \n",
       "3    New  victim00.na.contosohotels.com  CredentialAccess  SecurityAlert   \n",
       "4    New  victim00.na.contosohotels.com           Unknown  SecurityAlert   \n",
       "\n",
       "   Computer src_hostname src_accountname src_procname  host_match  acct_match  \\\n",
       "0  victim00     victim00                                     True       False   \n",
       "1  victim00     victim00                                     True       False   \n",
       "2  victim00     victim00                                     True       False   \n",
       "3  victim00     victim00                                     True       False   \n",
       "4  victim00     victim00                                     True       False   \n",
       "\n",
       "   proc_match  \n",
       "0       False  \n",
       "1       False  \n",
       "2       False  \n",
       "3       False  \n",
       "4       False  "
      ]
     },
     "execution_count": 23,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "Host.AzureSentinel.SecurityAlert_list_related_alerts(host_name=\"victim00\").head(5)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We also have a preview of a notebook tool that lets you\n",
    "browser around entities and their pivot functions, search\n",
    "for a function by keyword and view the help for that function.\n",
    "This is going to be released shortly.\n",
    "\n",
    "> <p style=\"color:red\"><b>Warning:</b> post-0.9.0 functionality</p>\n",
    "> This will throw and error in v0.9.0 of MSTICPy"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "78396986891647eebd7f6f2d183cfa71",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "VBox(children=(HBox(children=(VBox(children=(HTML(value='<b>Entities</b>'), Select(description='entity', layou…"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "Pivot.browse()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Standardized way of calling Pivot functions\n",
    "\n",
    "Due to various factors (historical, underlying data,\n",
    "developer laziness and forgetfullness, etc.) the functionality\n",
    "in *MSTICPy* can be inconsistent in the way it uses input\n",
    "parameters.\n",
    "\n",
    "Also, many functions will only accept inputs as a single\n",
    "value, or a list or a DataFrame or some unpredictable combination\n",
    "of these.\n",
    "\n",
    "Pivot functions allow you to largely forget about this - you\n",
    "can use the same function whether you have:\n",
    "- a single value\n",
    "- a list (or any iterable) of values\n",
    "- a DataFrame with the input value in one of the columns.\n",
    "\n",
    "Let's take an example. \n",
    "\n",
    "Suppose we have a set of IP addresses pasted\n",
    "from somewhere that we want to use as input."
   ]
  },
  {
   "cell_type": "raw",
   "metadata": {},
   "source": [
    "0, 172.217.15.99, Public\n",
    "1, 40.85.232.64, Public\n",
    "2, 20.38.98.100, Public\n",
    "3, 23.96.64.84, Public\n",
    "4, 65.55.44.108, Public\n",
    "5, 131.107.147.209, Public\n",
    "6, 10.0.3.4, Private\n",
    "7, 10.0.3.5, Private\n",
    "8, 13.82.152.48, Public"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We need to convert this into a Python data object of some sort.\n",
    "To do this we can use another Pivot utility `%%txt2df`. This is a\n",
    "Jupyter/IPython magic function so you can just paste you data in\n",
    "a cell.\n",
    "Use `%%txt2df --help` in an empty cell to see the full syntax.\n",
    "\n",
    "The example below we specify a comma separator, that the\n",
    "data has a headers row and to save the converted data as\n",
    "a DataFrame named \"ip_df\".\n",
    "\n",
    "> Warning this will overwrite any existing variable of this\n",
    "name"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>idx</th>\n",
       "      <th>ip</th>\n",
       "      <th>type</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>0</td>\n",
       "      <td>172.217.15.99</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>1</td>\n",
       "      <td>40.85.232.64</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>2</td>\n",
       "      <td>20.38.98.100</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>3</td>\n",
       "      <td>23.96.64.84</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>4</td>\n",
       "      <td>65.55.44.108</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>5</td>\n",
       "      <td>131.107.147.209</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>6</td>\n",
       "      <td>10.0.3.4</td>\n",
       "      <td>Private</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>7</td>\n",
       "      <td>10.0.3.5</td>\n",
       "      <td>Private</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>8</td>\n",
       "      <td>13.82.152.48</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "   idx               ip     type\n",
       "0    0    172.217.15.99   Public\n",
       "1    1     40.85.232.64   Public\n",
       "2    2     20.38.98.100   Public\n",
       "3    3      23.96.64.84   Public\n",
       "4    4     65.55.44.108   Public\n",
       "5    5  131.107.147.209   Public\n",
       "6    6         10.0.3.4  Private\n",
       "7    7         10.0.3.5  Private\n",
       "8    8     13.82.152.48   Public"
      ]
     },
     "execution_count": 25,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "%%txt2df --sep , --headers --name ip_df\n",
    "idx, ip, type\n",
    "0, 172.217.15.99, Public\n",
    "1, 40.85.232.64, Public\n",
    "2, 20.38.98.100, Public\n",
    "3, 23.96.64.84, Public\n",
    "4, 65.55.44.108, Public\n",
    "5, 131.107.147.209, Public\n",
    "6, 10.0.3.4, Private\n",
    "7, 10.0.3.5, Private\n",
    "8, 13.82.152.48, Public\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "For our example we'll also create a standard Python list\n",
    "from the ip column."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "['172.217.15.99', '40.85.232.64', '20.38.98.100', '23.96.64.84', '65.55.44.108', '131.107.147.209', '10.0.3.4', '10.0.3.5', '13.82.152.48']\n"
     ]
    }
   ],
   "source": [
    "ip_list = list(ip_df.ip)\n",
    "print(ip_list)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### How did this work before?\n",
    "\n",
    "If you recall the earlier example of `get_ip_type`, passing it\n",
    "a list or DataFrame doesn't result in anything useful."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 27,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "['172.217.15.99', '40.85.232.64', '20.38.98.100', '23.96.64.84', '65.55.44.108', '131.107.147.209', '10.0.3.4', '10.0.3.5', '13.82.152.48'] does not appear to be an IPv4 or IPv6 address\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "'Unspecified'"
      ]
     },
     "execution_count": 27,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "get_ip_type(ip_list)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Pivot versions are (somewhat) agnostic to input data format"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "However, the pivotized version can accept and correctly process\n",
    "a list"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>ip</th>\n",
       "      <th>result</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>172.217.15.99</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>40.85.232.64</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>20.38.98.100</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>23.96.64.84</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>65.55.44.108</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>131.107.147.209</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>10.0.3.4</td>\n",
       "      <td>Private</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>10.0.3.5</td>\n",
       "      <td>Private</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>13.82.152.48</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                ip   result\n",
       "0    172.217.15.99   Public\n",
       "1     40.85.232.64   Public\n",
       "2     20.38.98.100   Public\n",
       "3      23.96.64.84   Public\n",
       "4     65.55.44.108   Public\n",
       "5  131.107.147.209   Public\n",
       "6         10.0.3.4  Private\n",
       "7         10.0.3.5  Private\n",
       "8     13.82.152.48   Public"
      ]
     },
     "execution_count": 28,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "IpAddress.util.ip_type(ip_list)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "In the case of a DataFrame, things are a little more\n",
    "complicated - we have to tell the function \n",
    "the name of the column that\n",
    "contains the input data."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "metadata": {},
   "outputs": [
    {
     "ename": "KeyError",
     "evalue": "(\"'ip_column' is not in the input dataframe\", 'Please specify the column when calling the function.You can use one of the parameter names for this:', ['column', 'input_column', 'input_col', 'src_column', 'src_col'])",
     "output_type": "error",
     "traceback": [
      "\u001b[1;31m---------------------------------------------------------------------------\u001b[0m",
      "\u001b[1;31mKeyError\u001b[0m                                  Traceback (most recent call last)",
      "\u001b[1;32m<ipython-input-29-786e8d7fe15b>\u001b[0m in \u001b[0;36m<module>\u001b[1;34m\u001b[0m\n\u001b[1;32m----> 1\u001b[1;33m \u001b[0mIpAddress\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mutil\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mwhois\u001b[0m\u001b[1;33m(\u001b[0m\u001b[0mip_df\u001b[0m\u001b[1;33m)\u001b[0m  \u001b[1;31m# won't work!\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0m",
      "\u001b[1;32me:\\src\\microsoft\\msticpy\\msticpy\\datamodel\\pivot_register.py\u001b[0m in \u001b[0;36mpivot_lookup\u001b[1;34m(*args, **kwargs)\u001b[0m\n\u001b[0;32m    172\u001b[0m         \u001b[1;31m# {\"data\": input_df, \"src_column\": input_column}\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0;32m    173\u001b[0m         input_df, input_column, param_dict = _create_input_df(\n\u001b[1;32m--> 174\u001b[1;33m             \u001b[0minput_value\u001b[0m\u001b[1;33m,\u001b[0m \u001b[0mpivot_reg\u001b[0m\u001b[1;33m,\u001b[0m \u001b[0mparent_kwargs\u001b[0m\u001b[1;33m=\u001b[0m\u001b[0mkwargs\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0m\u001b[0;32m    175\u001b[0m         )\n\u001b[0;32m    176\u001b[0m \u001b[1;33m\u001b[0m\u001b[0m\n",
      "\u001b[1;32me:\\src\\microsoft\\msticpy\\msticpy\\datamodel\\pivot_register.py\u001b[0m in \u001b[0;36m_create_input_df\u001b[1;34m(input_value, pivot_reg, parent_kwargs)\u001b[0m\n\u001b[0;32m    326\u001b[0m                 \u001b[1;34m\"Please specify the column when calling the function.\"\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0;32m    327\u001b[0m                 \u001b[1;34m\"You can use one of the parameter names for this:\"\u001b[0m\u001b[1;33m,\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[1;32m--> 328\u001b[1;33m                 \u001b[0m_DF_SRC_COL_PARAM_NAMES\u001b[0m\u001b[1;33m,\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0m\u001b[0;32m    329\u001b[0m             )\n\u001b[0;32m    330\u001b[0m     \u001b[1;31m# we want to get rid of data=xyz parameters from kwargs, since we're adding them\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n",
      "\u001b[1;31mKeyError\u001b[0m: (\"'ip_column' is not in the input dataframe\", 'Please specify the column when calling the function.You can use one of the parameter names for this:', ['column', 'input_column', 'input_col', 'src_column', 'src_col'])"
     ]
    }
   ],
   "source": [
    "IpAddress.util.whois(ip_df)  # won't work!"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 30,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>nir</th>\n",
       "      <th>asn_registry</th>\n",
       "      <th>asn</th>\n",
       "      <th>asn_cidr</th>\n",
       "      <th>asn_country_code</th>\n",
       "      <th>asn_date</th>\n",
       "      <th>asn_description</th>\n",
       "      <th>query</th>\n",
       "      <th>nets</th>\n",
       "      <th>raw</th>\n",
       "      <th>referral</th>\n",
       "      <th>raw_referral</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>15169</td>\n",
       "      <td>172.217.15.0/24</td>\n",
       "      <td>US</td>\n",
       "      <td>2012-04-16</td>\n",
       "      <td>GOOGLE, US</td>\n",
       "      <td>172.217.15.99</td>\n",
       "      <td>[{'cidr': '172.217.0.0/16', 'name': 'GOOGLE', 'handle': 'NET-172-217-0-0-1', 'range': '172.217.0...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>8075</td>\n",
       "      <td>40.80.0.0/12</td>\n",
       "      <td>US</td>\n",
       "      <td>2015-02-23</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>40.85.232.64</td>\n",
       "      <td>[{'cidr': '40.80.0.0/12, 40.124.0.0/16, 40.74.0.0/15, 40.76.0.0/14, 40.120.0.0/14, 40.125.0.0/17...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>8075</td>\n",
       "      <td>20.36.0.0/14</td>\n",
       "      <td>US</td>\n",
       "      <td>2017-10-18</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>20.38.98.100</td>\n",
       "      <td>[{'cidr': '20.128.0.0/16, 20.33.0.0/16, 20.34.0.0/15, 20.36.0.0/14, 20.64.0.0/10, 20.40.0.0/13, ...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>8075</td>\n",
       "      <td>23.96.0.0/14</td>\n",
       "      <td>US</td>\n",
       "      <td>2013-06-18</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>23.96.64.84</td>\n",
       "      <td>[{'cidr': '23.96.0.0/13', 'name': 'MSFT', 'handle': 'NET-23-96-0-0-1', 'range': '23.96.0.0 - 23....</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>8075</td>\n",
       "      <td>65.52.0.0/14</td>\n",
       "      <td>US</td>\n",
       "      <td>2001-02-14</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>65.55.44.108</td>\n",
       "      <td>[{'cidr': '65.52.0.0/14', 'name': 'MICROSOFT-1BLK', 'handle': 'NET-65-52-0-0-1', 'range': '65.52...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>3598</td>\n",
       "      <td>131.107.0.0/16</td>\n",
       "      <td>US</td>\n",
       "      <td>1988-11-11</td>\n",
       "      <td>MICROSOFT-CORP-AS, US</td>\n",
       "      <td>131.107.147.209</td>\n",
       "      <td>[{'cidr': '131.107.0.0/16', 'name': 'MICROSOFT', 'handle': 'NET-131-107-0-0-1', 'range': '131.10...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>8075</td>\n",
       "      <td>13.64.0.0/11</td>\n",
       "      <td>US</td>\n",
       "      <td>2015-03-26</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>13.82.152.48</td>\n",
       "      <td>[{'cidr': '13.64.0.0/11, 13.96.0.0/13, 13.104.0.0/14', 'name': 'MSFT', 'handle': 'NET-13-64-0-0-...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "   nir asn_registry    asn         asn_cidr asn_country_code    asn_date  \\\n",
       "0  NaN         arin  15169  172.217.15.0/24               US  2012-04-16   \n",
       "1  NaN         arin   8075     40.80.0.0/12               US  2015-02-23   \n",
       "2  NaN         arin   8075     20.36.0.0/14               US  2017-10-18   \n",
       "3  NaN         arin   8075     23.96.0.0/14               US  2013-06-18   \n",
       "4  NaN         arin   8075     65.52.0.0/14               US  2001-02-14   \n",
       "5  NaN         arin   3598   131.107.0.0/16               US  1988-11-11   \n",
       "6  NaN          NaN    NaN              NaN              NaN         NaN   \n",
       "7  NaN          NaN    NaN              NaN              NaN         NaN   \n",
       "8  NaN         arin   8075     13.64.0.0/11               US  2015-03-26   \n",
       "\n",
       "                   asn_description            query  \\\n",
       "0                       GOOGLE, US    172.217.15.99   \n",
       "1  MICROSOFT-CORP-MSN-AS-BLOCK, US     40.85.232.64   \n",
       "2  MICROSOFT-CORP-MSN-AS-BLOCK, US     20.38.98.100   \n",
       "3  MICROSOFT-CORP-MSN-AS-BLOCK, US      23.96.64.84   \n",
       "4  MICROSOFT-CORP-MSN-AS-BLOCK, US     65.55.44.108   \n",
       "5            MICROSOFT-CORP-AS, US  131.107.147.209   \n",
       "6                              NaN              NaN   \n",
       "7                              NaN              NaN   \n",
       "8  MICROSOFT-CORP-MSN-AS-BLOCK, US     13.82.152.48   \n",
       "\n",
       "                                                                                                  nets  \\\n",
       "0  [{'cidr': '172.217.0.0/16', 'name': 'GOOGLE', 'handle': 'NET-172-217-0-0-1', 'range': '172.217.0...   \n",
       "1  [{'cidr': '40.80.0.0/12, 40.124.0.0/16, 40.74.0.0/15, 40.76.0.0/14, 40.120.0.0/14, 40.125.0.0/17...   \n",
       "2  [{'cidr': '20.128.0.0/16, 20.33.0.0/16, 20.34.0.0/15, 20.36.0.0/14, 20.64.0.0/10, 20.40.0.0/13, ...   \n",
       "3  [{'cidr': '23.96.0.0/13', 'name': 'MSFT', 'handle': 'NET-23-96-0-0-1', 'range': '23.96.0.0 - 23....   \n",
       "4  [{'cidr': '65.52.0.0/14', 'name': 'MICROSOFT-1BLK', 'handle': 'NET-65-52-0-0-1', 'range': '65.52...   \n",
       "5  [{'cidr': '131.107.0.0/16', 'name': 'MICROSOFT', 'handle': 'NET-131-107-0-0-1', 'range': '131.10...   \n",
       "6                                                                                                  NaN   \n",
       "7                                                                                                  NaN   \n",
       "8  [{'cidr': '13.64.0.0/11, 13.96.0.0/13, 13.104.0.0/14', 'name': 'MSFT', 'handle': 'NET-13-64-0-0-...   \n",
       "\n",
       "   raw  referral  raw_referral  \n",
       "0  NaN       NaN           NaN  \n",
       "1  NaN       NaN           NaN  \n",
       "2  NaN       NaN           NaN  \n",
       "3  NaN       NaN           NaN  \n",
       "4  NaN       NaN           NaN  \n",
       "5  NaN       NaN           NaN  \n",
       "6  NaN       NaN           NaN  \n",
       "7  NaN       NaN           NaN  \n",
       "8  NaN       NaN           NaN  "
      ]
     },
     "execution_count": 30,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "IpAddress.util.whois(ip_df, column=\"ip\")  # correct"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "> Note: for most functions you can ignore the parameter\n",
    "name and just specify it as a positional parameter.\n",
    "You can also use the original parameter name of the underlying\n",
    "function or the placeholder name \"value\".\n",
    "\n",
    "The following are all equivalent:\n",
    "```python\n",
    "IpAddress.util.ip_type(ip_list)\n",
    "IpAddress.util.ip_type(ip_str=ip_list)\n",
    "IpAddress.util.ip_type(value=ip_list)\n",
    "IpAddress.util.ip_type(data=ip_list)\n",
    "```\n",
    "\n",
    "When passing both a DataFrame and column name use:\n",
    "```python\n",
    "IpAddress.util.ip_type(data=ip_df, column=\"col_name\")\n",
    "```\n",
    "You can also pass an entity instance of an entity\n",
    "as a input parameter. The pivot code knows which attribute\n",
    "or attributes of an entity will provider the input value."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 31,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>ip</th>\n",
       "      <th>result</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>40.85.232.64</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "             ip  result\n",
       "0  40.85.232.64  Public"
      ]
     },
     "execution_count": 31,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "ip_entity = IpAddress(Address=\"40.85.232.64\")\n",
    "IpAddress.util.ip_type(ip_entity)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Iterable/DataFrame inputs and single-value functions\n",
    "\n",
    "Many of the underlying functions only accept single values\n",
    "as inputs. Examples of these are the data query functions - typically\n",
    "they expect a single host name, IP address, etc.\n",
    "\n",
    "Pivot knows about the type of parameters that the function accepts.\n",
    "It will adjust the input to match the expectations of the underlying\n",
    "function. If a list or DataFrame is passed as input to a single-value\n",
    "function Pivot will split the input and call the function once for\n",
    "each value. It then combines the output into a single DataFrame\n",
    "before returning the results. \n",
    "\n",
    "You can read a bit more about how this is done in the Appendix TODO"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Data queries - where does the time range come from?\n",
    "\n",
    "The Pivot class has a buit-in time range. This is used by\n",
    "default for all queries. Don't worry - you can change it easily"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 32,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "TimeStamp(start=2021-03-10 18:33:43.314239, end=2021-03-11 18:33:43.314239, period=-1 day, 0:00:00)"
      ]
     },
     "execution_count": 32,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "Pivot.current.timespan"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "You can edit the time range interactively"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 33,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "57a1ffee1b0e4ec7be8277ccb7d17490",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "VBox(children=(HTML(value='<h4>Set time range for pivot functions.</h4>'), HBox(children=(DatePicker(value=dat…"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "Pivot.current.edit_query_time()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Or by setting the timespan property directly"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 34,
   "metadata": {},
   "outputs": [],
   "source": [
    "from msticpy.common.timespan import TimeSpan\n",
    "# TimeSpan accepts datetimes or datestrings\n",
    "timespan = TimeSpan(start=\"02/01/2021\", end=\"02/15/2021\")\n",
    "Pivot.current.timespan = timespan"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "In an upcoming release there is also a convenience function\n",
    "for setting the time directly with Python datetimes or date strings\n",
    "> <b><p style=\"color:red\">Warning:</p></b> post-0.9.0 functionality</br>\n",
    "> This will throw and error in v0.9.0 of MSTICPy"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 35,
   "metadata": {},
   "outputs": [],
   "source": [
    "Pivot.current.set_timespan(start=\"2020-02-06 03:00:00\", end=\"2021-02-15 01:42:42\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "You can also override the built-in time settings by specifying\n",
    "`start` and `end` as parameters."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 36,
   "metadata": {},
   "outputs": [
    {
     "ename": "NameError",
     "evalue": "name 'dt1' is not defined",
     "output_type": "error",
     "traceback": [
      "\u001b[1;31m---------------------------------------------------------------------------\u001b[0m",
      "\u001b[1;31mNameError\u001b[0m                                 Traceback (most recent call last)",
      "\u001b[1;32m<ipython-input-36-a726e25f79ba>\u001b[0m in \u001b[0;36m<module>\u001b[1;34m\u001b[0m\n\u001b[1;32m----> 1\u001b[1;33m \u001b[0mHost\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mAzureSentinel\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mSecurityAlert_list_related_alerts\u001b[0m\u001b[1;33m(\u001b[0m\u001b[0mhost_name\u001b[0m\u001b[1;33m=\u001b[0m\u001b[1;34m\"victim00\"\u001b[0m\u001b[1;33m,\u001b[0m \u001b[0mstart\u001b[0m\u001b[1;33m=\u001b[0m\u001b[0mdt1\u001b[0m\u001b[1;33m,\u001b[0m \u001b[0mend\u001b[0m\u001b[1;33m=\u001b[0m\u001b[0mdt2\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0m",
      "\u001b[1;31mNameError\u001b[0m: name 'dt1' is not defined"
     ]
    }
   ],
   "source": [
    "dt1 = Pivot.current.timespan.start\n",
    "dt2 = Pivot.current.timespan.end\n",
    "Host.AzureSentinel.SecurityAlert_list_related_alerts(host_name=\"victim00\", start=dt1, end=dt2)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Supplying extra parameters\n",
    "\n",
    "The Pivot layer will pass any unused keyword parameters to the\n",
    "underlying function. This *does not* usually apply to positional parameters -\n",
    "if you want parameters to get to the function, you have to name them\n",
    "explicitly.\n",
    "In this example the `add_query_items` parameter is passed to the underlying\n",
    "query function"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 37,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>LogonType</th>\n",
       "      <th>count_</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>5</td>\n",
       "      <td>21650</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>3</td>\n",
       "      <td>6808</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>4</td>\n",
       "      <td>9426</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>2</td>\n",
       "      <td>109</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>10</td>\n",
       "      <td>44</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>0</td>\n",
       "      <td>7</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>9</td>\n",
       "      <td>8</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "   LogonType  count_\n",
       "0          5   21650\n",
       "1          3    6808\n",
       "2          4    9426\n",
       "3          2     109\n",
       "4         10      44\n",
       "5          0       7\n",
       "6          9       8"
      ]
     },
     "execution_count": 37,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "entities.Host.AzureSentinel.SecurityEvent_list_host_logons(\n",
    "    host_name=\"victimPc\",\n",
    "    add_query_items=\"| summarize count() by LogonType\"\n",
    ")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Pivot Pipelines\n",
    "\n",
    "Because all pivot functions accept DataFrames as input\n",
    "and produce DataFrames as output, it means that it is possible\n",
    "to chain pivot functions into a pipeline.\n",
    "\n",
    "### Joining input to output\n",
    "You can join the input to the output. This usually only makes sense\n",
    "when the input is a DataFrame. It\n",
    "lets you keep the previously accumumated results and tag on the\n",
    "additional columns produced by the pivot function you are calling.\n",
    "\n",
    "The `join` parameter supports \"inner\", \"left\", \"right\" and \"outer\"\n",
    "joins (be careful with the latter though!)\n",
    "See [pivot joins documentation](https://msticpy.readthedocs.io/en/latest/data_analysis/PivotFunctions.html#joining-input-to-output-data)\n",
    "\n",
    "Although joining is useful in pipelines you can use it on\n",
    "any function whether in a pipeline or not."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 38,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>idx</th>\n",
       "      <th>ip</th>\n",
       "      <th>type</th>\n",
       "      <th>nir</th>\n",
       "      <th>asn_registry</th>\n",
       "      <th>asn</th>\n",
       "      <th>asn_cidr</th>\n",
       "      <th>asn_country_code</th>\n",
       "      <th>asn_date</th>\n",
       "      <th>asn_description</th>\n",
       "      <th>query</th>\n",
       "      <th>nets</th>\n",
       "      <th>raw</th>\n",
       "      <th>referral</th>\n",
       "      <th>raw_referral</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>0</td>\n",
       "      <td>172.217.15.99</td>\n",
       "      <td>Public</td>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>15169</td>\n",
       "      <td>172.217.15.0/24</td>\n",
       "      <td>US</td>\n",
       "      <td>2012-04-16</td>\n",
       "      <td>GOOGLE, US</td>\n",
       "      <td>172.217.15.99</td>\n",
       "      <td>[{'cidr': '172.217.0.0/16', 'name': 'GOOGLE', 'handle': 'NET-172-217-0-0-1', 'range': '172.217.0...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>1</td>\n",
       "      <td>40.85.232.64</td>\n",
       "      <td>Public</td>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>8075</td>\n",
       "      <td>40.80.0.0/12</td>\n",
       "      <td>US</td>\n",
       "      <td>2015-02-23</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>40.85.232.64</td>\n",
       "      <td>[{'cidr': '40.80.0.0/12, 40.124.0.0/16, 40.74.0.0/15, 40.76.0.0/14, 40.120.0.0/14, 40.125.0.0/17...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>2</td>\n",
       "      <td>20.38.98.100</td>\n",
       "      <td>Public</td>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>8075</td>\n",
       "      <td>20.36.0.0/14</td>\n",
       "      <td>US</td>\n",
       "      <td>2017-10-18</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>20.38.98.100</td>\n",
       "      <td>[{'cidr': '20.128.0.0/16, 20.33.0.0/16, 20.34.0.0/15, 20.36.0.0/14, 20.64.0.0/10, 20.40.0.0/13, ...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>3</td>\n",
       "      <td>23.96.64.84</td>\n",
       "      <td>Public</td>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>8075</td>\n",
       "      <td>23.96.0.0/14</td>\n",
       "      <td>US</td>\n",
       "      <td>2013-06-18</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>23.96.64.84</td>\n",
       "      <td>[{'cidr': '23.96.0.0/13', 'name': 'MSFT', 'handle': 'NET-23-96-0-0-1', 'range': '23.96.0.0 - 23....</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>4</td>\n",
       "      <td>65.55.44.108</td>\n",
       "      <td>Public</td>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>8075</td>\n",
       "      <td>65.52.0.0/14</td>\n",
       "      <td>US</td>\n",
       "      <td>2001-02-14</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>65.55.44.108</td>\n",
       "      <td>[{'cidr': '65.52.0.0/14', 'name': 'MICROSOFT-1BLK', 'handle': 'NET-65-52-0-0-1', 'range': '65.52...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>5</td>\n",
       "      <td>131.107.147.209</td>\n",
       "      <td>Public</td>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>3598</td>\n",
       "      <td>131.107.0.0/16</td>\n",
       "      <td>US</td>\n",
       "      <td>1988-11-11</td>\n",
       "      <td>MICROSOFT-CORP-AS, US</td>\n",
       "      <td>131.107.147.209</td>\n",
       "      <td>[{'cidr': '131.107.0.0/16', 'name': 'MICROSOFT', 'handle': 'NET-131-107-0-0-1', 'range': '131.10...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>8</td>\n",
       "      <td>13.82.152.48</td>\n",
       "      <td>Public</td>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>8075</td>\n",
       "      <td>13.64.0.0/11</td>\n",
       "      <td>US</td>\n",
       "      <td>2015-03-26</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>13.82.152.48</td>\n",
       "      <td>[{'cidr': '13.64.0.0/11, 13.96.0.0/13, 13.104.0.0/14', 'name': 'MSFT', 'handle': 'NET-13-64-0-0-...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "   idx               ip    type  nir asn_registry    asn         asn_cidr  \\\n",
       "0    0    172.217.15.99  Public  NaN         arin  15169  172.217.15.0/24   \n",
       "1    1     40.85.232.64  Public  NaN         arin   8075     40.80.0.0/12   \n",
       "2    2     20.38.98.100  Public  NaN         arin   8075     20.36.0.0/14   \n",
       "3    3      23.96.64.84  Public  NaN         arin   8075     23.96.0.0/14   \n",
       "4    4     65.55.44.108  Public  NaN         arin   8075     65.52.0.0/14   \n",
       "5    5  131.107.147.209  Public  NaN         arin   3598   131.107.0.0/16   \n",
       "6    8     13.82.152.48  Public  NaN         arin   8075     13.64.0.0/11   \n",
       "\n",
       "  asn_country_code    asn_date                  asn_description  \\\n",
       "0               US  2012-04-16                       GOOGLE, US   \n",
       "1               US  2015-02-23  MICROSOFT-CORP-MSN-AS-BLOCK, US   \n",
       "2               US  2017-10-18  MICROSOFT-CORP-MSN-AS-BLOCK, US   \n",
       "3               US  2013-06-18  MICROSOFT-CORP-MSN-AS-BLOCK, US   \n",
       "4               US  2001-02-14  MICROSOFT-CORP-MSN-AS-BLOCK, US   \n",
       "5               US  1988-11-11            MICROSOFT-CORP-AS, US   \n",
       "6               US  2015-03-26  MICROSOFT-CORP-MSN-AS-BLOCK, US   \n",
       "\n",
       "             query  \\\n",
       "0    172.217.15.99   \n",
       "1     40.85.232.64   \n",
       "2     20.38.98.100   \n",
       "3      23.96.64.84   \n",
       "4     65.55.44.108   \n",
       "5  131.107.147.209   \n",
       "6     13.82.152.48   \n",
       "\n",
       "                                                                                                  nets  \\\n",
       "0  [{'cidr': '172.217.0.0/16', 'name': 'GOOGLE', 'handle': 'NET-172-217-0-0-1', 'range': '172.217.0...   \n",
       "1  [{'cidr': '40.80.0.0/12, 40.124.0.0/16, 40.74.0.0/15, 40.76.0.0/14, 40.120.0.0/14, 40.125.0.0/17...   \n",
       "2  [{'cidr': '20.128.0.0/16, 20.33.0.0/16, 20.34.0.0/15, 20.36.0.0/14, 20.64.0.0/10, 20.40.0.0/13, ...   \n",
       "3  [{'cidr': '23.96.0.0/13', 'name': 'MSFT', 'handle': 'NET-23-96-0-0-1', 'range': '23.96.0.0 - 23....   \n",
       "4  [{'cidr': '65.52.0.0/14', 'name': 'MICROSOFT-1BLK', 'handle': 'NET-65-52-0-0-1', 'range': '65.52...   \n",
       "5  [{'cidr': '131.107.0.0/16', 'name': 'MICROSOFT', 'handle': 'NET-131-107-0-0-1', 'range': '131.10...   \n",
       "6  [{'cidr': '13.64.0.0/11, 13.96.0.0/13, 13.104.0.0/14', 'name': 'MSFT', 'handle': 'NET-13-64-0-0-...   \n",
       "\n",
       "   raw  referral  raw_referral  \n",
       "0  NaN       NaN           NaN  \n",
       "1  NaN       NaN           NaN  \n",
       "2  NaN       NaN           NaN  \n",
       "3  NaN       NaN           NaN  \n",
       "4  NaN       NaN           NaN  \n",
       "5  NaN       NaN           NaN  \n",
       "6  NaN       NaN           NaN  "
      ]
     },
     "execution_count": 38,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "entities.IpAddress.util.whois(ip_df, column=\"ip\", join=\"inner\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<hr>\n",
    "\n",
    "### Pipelines \n",
    "\n",
    "Pivot pipelines are implemented pandas customr accessors.\n",
    "Read more about [Extending pandas here](https://pandas.pydata.org/pandas-docs/stable/development/extending.html)\n",
    "\n",
    "When you load Pivot it adds the `mp_pivot` accessor. This\n",
    "appears as an attribute to DataFrames.\n",
    "\n",
    "```python\n",
    ">>> ips_df.mp_pivot\n",
    "<msticpy.datamodel.pivot_pd_accessor.PivotAccessor at 0x275754e2208>\n",
    "```\n",
    "\n",
    "The main pipelining function `run` is a method of `mp_pivot`.\n",
    "`run` requires two parameters - the pivot function to run and\n",
    "the column to use as input. See [mp_pivot.run documentation](https://msticpy.readthedocs.io/en/latest/data_analysis/PivotFunctions.html#mp-pivot-run)\n",
    "\n",
    "Here is an example of using it to call 4 pivot functions, each\n",
    "using the output of the previous function as input and using\n",
    "the `join` parameter to accumulate the results from each\n",
    "stage.\n",
    "\n",
    "Let's step through it line by line.\n",
    "1. The whole thing is surrounded by a pair of parentheses - this is just\n",
    "   to let us split the whole expression over multiple lines without\n",
    "   Python complaining.\n",
    "2. Next we have `ips_df` - this is just the starting DataFrame, our input data.\n",
    "3. Next we call the `mp_pivot.run()` accessor method on this dataframe.\n",
    "   We pass it the pivot function that we want to run and the input column name.\n",
    "   This column name is the column in ips_df where our input IP addresses are.\n",
    "   We've also specified an `join` type of inner. In this case the join type doesn't\n",
    "   really matter since we know we get exactly one output row for every input row.\n",
    "4. We're using the pandas `query` function to filter out unwanted entries\n",
    "   from the previous stage. In this case we only want Public IP addresses. \n",
    "   This illustrates that you can intersperse standard pandas functions\n",
    "   in the same pipeline. We could have also added a column selector expression\n",
    "   ([[\"col1\", \"col2\"...]]) if we wanted to filter the columns passed to the \n",
    "   next stage\n",
    "5. We are calling a further pivot function - `whois`. Remember the \"column\" parameter\n",
    "   always refers to the input column, i.e. the column from previous stage\n",
    "   that we want to use in this stage.\n",
    "6. We are calling `geoloc` to get geo location details joining with a left\n",
    "   join - this preserves the input data rows and adds null columns in any cases\n",
    "   where the pivot function returned no result.\n",
    "7. Is the same as 6 except is a data query to see if we have any alerts\n",
    "   that contain these IP addresses. Remember, in the case of data queries\n",
    "   we have to name the specific query parameter that we want the input to \n",
    "   go to. In this case, each row value in the \"ip\" column from the previous\n",
    "   stage will be sent to the query.\n",
    "8. Finally we close the parentheses to form a valid Python expression.\n",
    "   The whole expression returns a DataFrame so we can add further pandas\n",
    "   operations here (like `.head(5)` shown here)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 43,
   "metadata": {},
   "outputs": [],
   "source": [
    "ip_list = [\n",
    "    \"192.168.40.32\",\n",
    "    \"192.168.1.216\",\n",
    "    \"192.168.153.17\",\n",
    "    \"3.88.48.125\",\n",
    "    \"10.200.104.20\",\n",
    "    \"192.168.90.101\",\n",
    "    \"192.168.150.50\",\n",
    "    \"172.16.100.31\",\n",
    "    \"192.168.30.189\",\n",
    "    \"10.100.199.10\",\n",
    "]\n",
    "ips_df = pd.DataFrame(ip_list, columns=[\"IP\"])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 44,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
        "<div>\n",
        "<style scoped>\n",
        "    .dataframe tbody tr th:only-of-type {\n",
        "        vertical-align: middle;\n",
        "    }\n",
        "\n",
        "    .dataframe tbody tr th {\n",
        "        vertical-align: top;\n",
        "    }\n",
        "\n",
        "    .dataframe thead th {\n",
        "        text-align: right;\n",
        "    }\n",
        "</style>\n",
        "<table border=\"1\" class=\"dataframe\">\n",
        "  <thead>\n",
        "    <tr style=\"text-align: right;\">\n",
        "      <th></th>\n",
        "      <th>IP</th>\n",
        "      <th>ip</th>\n",
        "      <th>result</th>\n",
        "      <th>asn</th>\n",
        "      <th>asn_cidr</th>\n",
        "      <th>asn_country_code</th>\n",
        "      <th>asn_date</th>\n",
        "      <th>asn_description</th>\n",
        "      <th>asn_registry</th>\n",
        "      <th>nets</th>\n",
        "      <th>nir</th>\n",
        "      <th>query</th>\n",
        "      <th>raw</th>\n",
        "      <th>raw_referral</th>\n",
        "      <th>referral</th>\n",
        "      <th>CountryCode</th>\n",
        "      <th>CountryName</th>\n",
        "      <th>State</th>\n",
        "      <th>City</th>\n",
        "      <th>Longitude</th>\n",
        "      <th>Latitude</th>\n",
        "      <th>Asn</th>\n",
        "      <th>edges</th>\n",
        "      <th>Type_x</th>\n",
        "      <th>AdditionalData</th>\n",
        "      <th>...</th>\n",
        "      <th>AlertType</th>\n",
        "      <th>ConfidenceLevel</th>\n",
        "      <th>ConfidenceScore</th>\n",
        "      <th>IsIncident</th>\n",
        "      <th>StartTimeUtc</th>\n",
        "      <th>EndTimeUtc</th>\n",
        "      <th>ProcessingEndTime</th>\n",
        "      <th>RemediationSteps</th>\n",
        "      <th>ExtendedProperties</th>\n",
        "      <th>Entities</th>\n",
        "      <th>SourceSystem</th>\n",
        "      <th>WorkspaceSubscriptionId</th>\n",
        "      <th>WorkspaceResourceGroup</th>\n",
        "      <th>ExtendedLinks</th>\n",
        "      <th>ProductName</th>\n",
        "      <th>ProductComponentName</th>\n",
        "      <th>AlertLink</th>\n",
        "      <th>Status</th>\n",
        "      <th>CompromisedEntity</th>\n",
        "      <th>Tactics</th>\n",
        "      <th>Type_y</th>\n",
        "      <th>SystemAlertId1</th>\n",
        "      <th>ExtendedProperties1</th>\n",
        "      <th>Entities1</th>\n",
        "      <th>MatchingIps</th>\n",
        "    </tr>\n",
        "  </thead>\n",
        "  <tbody>\n",
        "    <tr>\n",
        "      <th>0</th>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Public</td>\n",
        "      <td>14618</td>\n",
        "      <td>3.80.0.0/12</td>\n",
        "      <td>US</td>\n",
        "      <td>2017-12-20</td>\n",
        "      <td>AMAZON-AES, US</td>\n",
        "      <td>arin</td>\n",
        "      <td>[{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...</td>\n",
        "      <td>None</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>US</td>\n",
        "      <td>United States</td>\n",
        "      <td>Virginia</td>\n",
        "      <td>Ashburn</td>\n",
        "      <td>-77.4728</td>\n",
        "      <td>39.0481</td>\n",
        "      <td>None</td>\n",
        "      <td>{}</td>\n",
        "      <td>geolocation</td>\n",
        "      <td>{}</td>\n",
        "      <td>...</td>\n",
        "      <td>8ecf8077-cf51-4820-aadd-14040956f35d_8a369bd2-97b6-4fe2-922a-cd170faf25bc</td>\n",
        "      <td></td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-12-19 13:04:59+00:00</td>\n",
        "      <td>2020-12-19 19:04:59+00:00</td>\n",
        "      <td>2020-12-19 19:10:17+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  }\\r\\n]</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Scheduled Alerts</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td></td>\n",
        "      <td>CommandAndControl</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>fdc54c12-efba-38b0-8379-f06d7fbfd34a</td>\n",
        "      <td>{\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  }\\r\\n]</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>1</th>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Public</td>\n",
        "      <td>14618</td>\n",
        "      <td>3.80.0.0/12</td>\n",
        "      <td>US</td>\n",
        "      <td>2017-12-20</td>\n",
        "      <td>AMAZON-AES, US</td>\n",
        "      <td>arin</td>\n",
        "      <td>[{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...</td>\n",
        "      <td>None</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>US</td>\n",
        "      <td>United States</td>\n",
        "      <td>Virginia</td>\n",
        "      <td>Ashburn</td>\n",
        "      <td>-77.4728</td>\n",
        "      <td>39.0481</td>\n",
        "      <td>None</td>\n",
        "      <td>{}</td>\n",
        "      <td>geolocation</td>\n",
        "      <td>{}</td>\n",
        "      <td>...</td>\n",
        "      <td>ThreatIntelligence</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 14:08:15+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>625ff9af-dddc-0cf8-9d4b-e79067fa2e71</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>2</th>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Public</td>\n",
        "      <td>14618</td>\n",
        "      <td>3.80.0.0/12</td>\n",
        "      <td>US</td>\n",
        "      <td>2017-12-20</td>\n",
        "      <td>AMAZON-AES, US</td>\n",
        "      <td>arin</td>\n",
        "      <td>[{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...</td>\n",
        "      <td>None</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>US</td>\n",
        "      <td>United States</td>\n",
        "      <td>Virginia</td>\n",
        "      <td>Ashburn</td>\n",
        "      <td>-77.4728</td>\n",
        "      <td>39.0481</td>\n",
        "      <td>None</td>\n",
        "      <td>{}</td>\n",
        "      <td>geolocation</td>\n",
        "      <td>{}</td>\n",
        "      <td>...</td>\n",
        "      <td>ThreatIntelligence</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 14:08:15+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>c977f904-ab30-d57e-986f-9d6ebf72771b</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>3</th>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Public</td>\n",
        "      <td>14618</td>\n",
        "      <td>3.80.0.0/12</td>\n",
        "      <td>US</td>\n",
        "      <td>2017-12-20</td>\n",
        "      <td>AMAZON-AES, US</td>\n",
        "      <td>arin</td>\n",
        "      <td>[{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...</td>\n",
        "      <td>None</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>US</td>\n",
        "      <td>United States</td>\n",
        "      <td>Virginia</td>\n",
        "      <td>Ashburn</td>\n",
        "      <td>-77.4728</td>\n",
        "      <td>39.0481</td>\n",
        "      <td>None</td>\n",
        "      <td>{}</td>\n",
        "      <td>geolocation</td>\n",
        "      <td>{}</td>\n",
        "      <td>...</td>\n",
        "      <td>ThreatIntelligence</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 14:08:15+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>9ee547e4-cba1-47d1-e1f9-87247b693a52</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>4</th>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Public</td>\n",
        "      <td>14618</td>\n",
        "      <td>3.80.0.0/12</td>\n",
        "      <td>US</td>\n",
        "      <td>2017-12-20</td>\n",
        "      <td>AMAZON-AES, US</td>\n",
        "      <td>arin</td>\n",
        "      <td>[{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...</td>\n",
        "      <td>None</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>US</td>\n",
        "      <td>United States</td>\n",
        "      <td>Virginia</td>\n",
        "      <td>Ashburn</td>\n",
        "      <td>-77.4728</td>\n",
        "      <td>39.0481</td>\n",
        "      <td>None</td>\n",
        "      <td>{}</td>\n",
        "      <td>geolocation</td>\n",
        "      <td>{}</td>\n",
        "      <td>...</td>\n",
        "      <td>ThreatIntelligence</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 14:08:16+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>83a0e08a-1adb-ef75-1c56-f6c9ce25ca69</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "    </tr>\n",
        "  </tbody>\n",
        "</table>\n",
        "<p>5 rows × 63 columns</p>\n",
        "</div>"
      ],
      "text/plain": [
        "            IP           ip  result    asn     asn_cidr asn_country_code  \\\n",
        "0  3.88.48.125  3.88.48.125  Public  14618  3.80.0.0/12               US   \n",
        "1  3.88.48.125  3.88.48.125  Public  14618  3.80.0.0/12               US   \n",
        "2  3.88.48.125  3.88.48.125  Public  14618  3.80.0.0/12               US   \n",
        "3  3.88.48.125  3.88.48.125  Public  14618  3.80.0.0/12               US   \n",
        "4  3.88.48.125  3.88.48.125  Public  14618  3.80.0.0/12               US   \n",
        "\n",
        "     asn_date asn_description asn_registry  \\\n",
        "0  2017-12-20  AMAZON-AES, US         arin   \n",
        "1  2017-12-20  AMAZON-AES, US         arin   \n",
        "2  2017-12-20  AMAZON-AES, US         arin   \n",
        "3  2017-12-20  AMAZON-AES, US         arin   \n",
        "4  2017-12-20  AMAZON-AES, US         arin   \n",
        "\n",
        "                                                                                                  nets  \\\n",
        "0  [{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...   \n",
        "1  [{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...   \n",
        "2  [{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...   \n",
        "3  [{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...   \n",
        "4  [{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...   \n",
        "\n",
        "    nir        query   raw raw_referral referral CountryCode    CountryName  \\\n",
        "0  None  3.88.48.125  None         None     None          US  United States   \n",
        "1  None  3.88.48.125  None         None     None          US  United States   \n",
        "2  None  3.88.48.125  None         None     None          US  United States   \n",
        "3  None  3.88.48.125  None         None     None          US  United States   \n",
        "4  None  3.88.48.125  None         None     None          US  United States   \n",
        "\n",
        "      State     City  Longitude  Latitude   Asn edges       Type_x  \\\n",
        "0  Virginia  Ashburn   -77.4728   39.0481  None    {}  geolocation   \n",
        "1  Virginia  Ashburn   -77.4728   39.0481  None    {}  geolocation   \n",
        "2  Virginia  Ashburn   -77.4728   39.0481  None    {}  geolocation   \n",
        "3  Virginia  Ashburn   -77.4728   39.0481  None    {}  geolocation   \n",
        "4  Virginia  Ashburn   -77.4728   39.0481  None    {}  geolocation   \n",
        "\n",
        "  AdditionalData  ...  \\\n",
        "0             {}  ...   \n",
        "1             {}  ...   \n",
        "2             {}  ...   \n",
        "3             {}  ...   \n",
        "4             {}  ...   \n",
        "\n",
        "                                                                   AlertType  \\\n",
        "0  8ecf8077-cf51-4820-aadd-14040956f35d_8a369bd2-97b6-4fe2-922a-cd170faf25bc   \n",
        "1                                                         ThreatIntelligence   \n",
        "2                                                         ThreatIntelligence   \n",
        "3                                                         ThreatIntelligence   \n",
        "4                                                         ThreatIntelligence   \n",
        "\n",
        "  ConfidenceLevel ConfidenceScore IsIncident              StartTimeUtc  \\\n",
        "0                             NaN      False 2020-12-19 13:04:59+00:00   \n",
        "1              83             NaN      False 2020-12-23 13:48:23+00:00   \n",
        "2              83             NaN      False 2020-12-23 13:48:23+00:00   \n",
        "3              83             NaN      False 2020-12-23 13:48:23+00:00   \n",
        "4              83             NaN      False 2020-12-23 13:48:23+00:00   \n",
        "\n",
        "                 EndTimeUtc         ProcessingEndTime RemediationSteps  \\\n",
        "0 2020-12-19 19:04:59+00:00 2020-12-19 19:10:17+00:00                    \n",
        "1 2020-12-23 13:48:23+00:00 2020-12-23 14:08:15+00:00                    \n",
        "2 2020-12-23 13:48:23+00:00 2020-12-23 14:08:15+00:00                    \n",
        "3 2020-12-23 13:48:23+00:00 2020-12-23 14:08:15+00:00                    \n",
        "4 2020-12-23 13:48:23+00:00 2020-12-23 14:08:16+00:00                    \n",
        "\n",
        "                                                                                    ExtendedProperties  \\\n",
        "0  {\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...   \n",
        "1  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "2  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "3  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "4  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "\n",
        "                                                                                              Entities  \\\n",
        "0         [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  }\\r\\n]   \n",
        "1  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "2  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "3  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "4  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "\n",
        "  SourceSystem               WorkspaceSubscriptionId WorkspaceResourceGroup  \\\n",
        "0    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "1    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "2    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "3    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "4    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "\n",
        "  ExtendedLinks     ProductName                     ProductComponentName  \\\n",
        "0                Microsoft Sentinel                         Scheduled Alerts   \n",
        "1                Microsoft Sentinel  Microsoft Threat Intelligence Analytics   \n",
        "2                Microsoft Sentinel  Microsoft Threat Intelligence Analytics   \n",
        "3                Microsoft Sentinel  Microsoft Threat Intelligence Analytics   \n",
        "4                Microsoft Sentinel  Microsoft Threat Intelligence Analytics   \n",
        "\n",
        "   AlertLink Status CompromisedEntity            Tactics         Type_y  \\\n",
        "0               New                    CommandAndControl  SecurityAlert   \n",
        "1               New       3.88.48.125            Unknown  SecurityAlert   \n",
        "2               New       3.88.48.125            Unknown  SecurityAlert   \n",
        "3               New       3.88.48.125            Unknown  SecurityAlert   \n",
        "4               New       3.88.48.125            Unknown  SecurityAlert   \n",
        "\n",
        "                         SystemAlertId1  \\\n",
        "0  fdc54c12-efba-38b0-8379-f06d7fbfd34a   \n",
        "1  625ff9af-dddc-0cf8-9d4b-e79067fa2e71   \n",
        "2  c977f904-ab30-d57e-986f-9d6ebf72771b   \n",
        "3  9ee547e4-cba1-47d1-e1f9-87247b693a52   \n",
        "4  83a0e08a-1adb-ef75-1c56-f6c9ce25ca69   \n",
        "\n",
        "                                                                                   ExtendedProperties1  \\\n",
        "0  {\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...   \n",
        "1  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "2  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "3  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "4  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "\n",
        "                                                                                             Entities1  \\\n",
        "0         [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  }\\r\\n]   \n",
        "1  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "2  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "3  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "4  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "\n",
        "     MatchingIps  \n",
        "0  [3.88.48.125]  \n",
        "1  [3.88.48.125]  \n",
        "2  [3.88.48.125]  \n",
        "3  [3.88.48.125]  \n",
        "4  [3.88.48.125]  \n",
        "\n",
        "[5 rows x 63 columns]"
      ]
     },
     "execution_count": 44,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "(\n",
    "    ips_df\n",
    "    .mp_pivot.run(entities.IpAddress.util.ip_type, column=\"IP\", join=\"inner\")\n",
    "    .query(\"result == 'Public'\").head(10)\n",
    "    .mp_pivot.run(entities.IpAddress.util.whois, column=\"ip\", join=\"left\")\n",
    "    .mp_pivot.run(entities.IpAddress.util.geoloc, column=\"ip\", join=\"left\")\n",
    "    .mp_pivot.run(entities.IpAddress.AzureSentinel.SecurityAlert_list_alerts_for_ip, source_ip_list=\"ip\", join=\"left\")\n",
    ").head(5)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Other pipeline functions\n",
    "\n",
    "In addition to `run`, the `mp_pivot` accessor also \n",
    "has the following functions:\n",
    "- `display` - this simply displays the data at the point called in\n",
    "  the pipeline. You can add an optional title, filtering and the number\n",
    "  or rows to display\n",
    "- `tee` - this forks a copy of the dataframe at the point it is\n",
    "  called in the pipeline. It will assign the forked copy to the name\n",
    "  given in the `var_name` parameter. If there is an existing variable of\n",
    "  the same name it will not overwrite it unless you add the `clobber=True`\n",
    "  parameter.\n",
    "  \n",
    "In both cases the pipelined data is passed through unchanged.\n",
    "See [Pivot functions help](https://msticpy.readthedocs.io/en/latest/data_analysis/PivotFunctions.html#mp-pivot-display)\n",
    "for more details.\n",
    "\n",
    "Use of these is shown below"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "```\n",
    "    ...\n",
    "    .mp_pivot.run(entities.IpAddress.util.geoloc, column=\"ip\", join=\"left\")\n",
    "    .mp_pivot.display(title=\"Geo Lookup\", cols=[\"IP\", \"City\"])  # << display an intermediate result\n",
    "    .mp_pivot.tee(var_name=\"geoip_df\", clobber=True)  # << save a copy called 'geoip_df'\n",
    "    .mp_pivot.run(entities.IpAddress.AzureSentinel.SecurityAlert_list_alerts_for_ip, source_ip_list=\"ip\", join=\"left\")\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "In the next release we've also implemented:\n",
    "- `tee_exec` - this executes a function on a forked copy of the DataFrame\n",
    "  The function must be a pandas function or custom accessor. A\n",
    "  good example of the use of this might be creating a plot or summary\n",
    "  table to display partway through the pipeline."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Extending Pivot - adding your own (or someone else's) functions\n",
    "\n",
    "You can add pivot functions of your own. You need to supply:\n",
    "- the function\n",
    "- some metadata that describes where the function can be found\n",
    "  and how the function works\n",
    "\n",
    "\n",
    "Full details of this are [described here](https://msticpy.readthedocs.io/en/latest/data_analysis/PivotFunctions.html#adding-custom-functions-to-the-pivot-interface).\n",
    "\n",
    "The published version of Pivot doesn't let you add functions\n",
    "defined inline (i.e. in the notebook itself) but this will be possible\n",
    "in the next release."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Assume that we've created this function in a Python module `my_module.py`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 45,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Writing my_module.py\n"
     ]
    }
   ],
   "source": [
    "%%writefile my_module.py\n",
    "\"\"\"U-case and hash\"\"\"\n",
    "from hashlib import md5\n",
    "\n",
    "def my_func(input: str):\n",
    "    md5_hash = \"-\".join(hex(b)[2:] for b in md5(\"hello\".encode(\"utf-8\")).digest())\n",
    "    return {\n",
    "        \"Title\": input.upper(),\n",
    "        \"Hash\": md5_hash\n",
    "    }"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Create a definition file"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 46,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Writing my_func.yml\n"
     ]
    }
   ],
   "source": [
    "%%writefile my_func.yml\n",
    "pivot_providers:\n",
    "  my_func_defn:\n",
    "    src_func_name: my_func\n",
    "    src_module: my_module\n",
    "    entity_container_name: cyber\n",
    "    input_type: value\n",
    "    entity_map:\n",
    "      Host: HostName\n",
    "    func_input_value_arg: input\n",
    "    func_new_name: upper_hash_name"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 47,
   "metadata": {},
   "outputs": [],
   "source": [
    "from msticpy.datamodel.pivot_register_reader import register_pivots\n",
    "register_pivots(\"my_func.yml\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 48,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Title</th>\n",
       "      <th>Hash</th>\n",
       "      <th>input</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>HOST_NAME</td>\n",
       "      <td>5d-41-40-2a-bc-4b-2a-76-b9-71-9d-91-10-17-c5-92</td>\n",
       "      <td>host_name</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "       Title                                             Hash      input\n",
       "0  HOST_NAME  5d-41-40-2a-bc-4b-2a-76-b9-71-9d-91-10-17-c5-92  host_name"
      ]
     },
     "execution_count": 48,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "Host.cyber.upper_hash_name(\"host_name\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "In the next release, this will be available as a simple\n",
    "function that can be used to add a function defined in the notebook.\n",
    "> <p style=\"color:red\"><b>Warning:</b> post-0.9.0 functionality</p>\n",
    "> This will throw and error in v0.9.0 of MSTICPy"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 49,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Title</th>\n",
       "      <th>Hash</th>\n",
       "      <th>input</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>HOST_NAME</td>\n",
       "      <td>5d-41-40-2a-bc-4b-2a-76-b9-71-9d-91-10-17-c5-92</td>\n",
       "      <td>host_name</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "       Title                                             Hash      input\n",
       "0  HOST_NAME  5d-41-40-2a-bc-4b-2a-76-b9-71-9d-91-10-17-c5-92  host_name"
      ]
     },
     "execution_count": 49,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "from hashlib import md5\n",
    "\n",
    "def my_func2(input: str):\n",
    "    md5_hash = \"-\".join(hex(b)[2:] for b in md5(\"hello\".encode(\"utf-8\")).digest())\n",
    "    return {\n",
    "        \"Title\": input.upper(),\n",
    "        \"Hash\": md5_hash\n",
    "    }\n",
    "\n",
    "\n",
    "Pivot.add_pivot_function(\n",
    "    func=my_func2,\n",
    "    container=\"cyber\",  # which container it will appear in on the entity\n",
    "    input_type=\"value\",\n",
    "    entity_map={\"Host\": \"HostName\"},\n",
    "    func_input_value_arg=\"input\",\n",
    "    func_new_name=\"il_upper_hash_name\",\n",
    ")\n",
    "\n",
    "Host.cyber.il_upper_hash_name(\"host_name\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Conclusion\n",
    "\n",
    "We've taken a short tour through the *MSTICPy* looking at how\n",
    "they make the functionality in the package easier to discover\n",
    "and use.\n",
    "I'm particularly excited about the pipeline functionality.\n",
    "In the next release we're going to make it possible to define\n",
    "reusable pipelines in configuration files and execute them\n",
    "with a single function call. This should help streamline\n",
    "some common patterns in notebooks for Cyber hunting and investigation.\n",
    "\n",
    "Please send any feedback or suggestions for improvements\n",
    "to msticpy@microsoft.com or create an issue on https://github.com/microsoft/msticpy.\n",
    "\n",
    "Happy hunting!"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Get some input data"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 53,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "query = \"\"\"\n",
    "SecurityAlert \n",
    "| where AlertName == \"Time series anomaly detection for total volume of traffic\" \n",
    "| project AlertName, Description, Entities\n",
    "| extend Entities = todynamic(Entities)\n",
    "| mvexpand with_itemindex=Index Entities\n",
    "| extend IP = Entities[\"Address\"]\n",
    "\"\"\"\n",
    "ips = az_provider.exec_query(query)\n",
    "ips_df = ips[[\"IP\"]].drop_duplicates()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 54,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>IP</th>\n",
       "      <th>ip</th>\n",
       "      <th>result</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>192.168.40.32</td>\n",
       "      <td>192.168.40.32</td>\n",
       "      <td>Private</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>192.168.1.216</td>\n",
       "      <td>192.168.1.216</td>\n",
       "      <td>Private</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>192.168.153.17</td>\n",
       "      <td>192.168.153.17</td>\n",
       "      <td>Private</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>3.88.48.125</td>\n",
       "      <td>3.88.48.125</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>10.200.104.20</td>\n",
       "      <td>10.200.104.20</td>\n",
       "      <td>Private</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>192.168.90.101</td>\n",
       "      <td>192.168.90.101</td>\n",
       "      <td>Private</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>192.168.150.50</td>\n",
       "      <td>192.168.150.50</td>\n",
       "      <td>Private</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>172.16.100.31</td>\n",
       "      <td>172.16.100.31</td>\n",
       "      <td>Private</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>192.168.30.189</td>\n",
       "      <td>192.168.30.189</td>\n",
       "      <td>Private</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>10.100.199.10</td>\n",
       "      <td>10.100.199.10</td>\n",
       "      <td>Private</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>10</th>\n",
       "      <td>52.171.57.74</td>\n",
       "      <td>52.171.57.74</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11</th>\n",
       "      <td>52.171.36.115</td>\n",
       "      <td>52.171.36.115</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>12</th>\n",
       "      <td>20.84.105.0</td>\n",
       "      <td>20.84.105.0</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>13</th>\n",
       "      <td>20.55.97.123</td>\n",
       "      <td>20.55.97.123</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>14</th>\n",
       "      <td>20.84.112.117</td>\n",
       "      <td>20.84.112.117</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>15</th>\n",
       "      <td>192.168.99.137</td>\n",
       "      <td>192.168.99.137</td>\n",
       "      <td>Private</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>16</th>\n",
       "      <td>192.168.55.10</td>\n",
       "      <td>192.168.55.10</td>\n",
       "      <td>Private</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>17</th>\n",
       "      <td>192.168.51.6</td>\n",
       "      <td>192.168.51.6</td>\n",
       "      <td>Private</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>18</th>\n",
       "      <td>104.214.50.229</td>\n",
       "      <td>104.214.50.229</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>19</th>\n",
       "      <td>20.51.104.164</td>\n",
       "      <td>20.51.104.164</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>20</th>\n",
       "      <td>20.81.40.144</td>\n",
       "      <td>20.81.40.144</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>21</th>\n",
       "      <td>20.80.162.44</td>\n",
       "      <td>20.80.162.44</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>22</th>\n",
       "      <td>172.31.0.0</td>\n",
       "      <td>172.31.0.0</td>\n",
       "      <td>Private</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>23</th>\n",
       "      <td>104.215.76.44</td>\n",
       "      <td>104.215.76.44</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>24</th>\n",
       "      <td>172.31.0.1</td>\n",
       "      <td>172.31.0.1</td>\n",
       "      <td>Private</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25</th>\n",
       "      <td>20.81.42.55</td>\n",
       "      <td>20.81.42.55</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>26</th>\n",
       "      <td>20.55.80.232</td>\n",
       "      <td>20.55.80.232</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>27</th>\n",
       "      <td>172.16.199.104</td>\n",
       "      <td>172.16.199.104</td>\n",
       "      <td>Private</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>28</th>\n",
       "      <td>79.124.62.82</td>\n",
       "      <td>79.124.62.82</td>\n",
       "      <td>Public</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                IP              ip   result\n",
       "0    192.168.40.32   192.168.40.32  Private\n",
       "1    192.168.1.216   192.168.1.216  Private\n",
       "2   192.168.153.17  192.168.153.17  Private\n",
       "3      3.88.48.125     3.88.48.125   Public\n",
       "4    10.200.104.20   10.200.104.20  Private\n",
       "5   192.168.90.101  192.168.90.101  Private\n",
       "6   192.168.150.50  192.168.150.50  Private\n",
       "7    172.16.100.31   172.16.100.31  Private\n",
       "8   192.168.30.189  192.168.30.189  Private\n",
       "9    10.100.199.10   10.100.199.10  Private\n",
       "10    52.171.57.74    52.171.57.74   Public\n",
       "11   52.171.36.115   52.171.36.115   Public\n",
       "12     20.84.105.0     20.84.105.0   Public\n",
       "13    20.55.97.123    20.55.97.123   Public\n",
       "14   20.84.112.117   20.84.112.117   Public\n",
       "15  192.168.99.137  192.168.99.137  Private\n",
       "16   192.168.55.10   192.168.55.10  Private\n",
       "17    192.168.51.6    192.168.51.6  Private\n",
       "18  104.214.50.229  104.214.50.229   Public\n",
       "19   20.51.104.164   20.51.104.164   Public\n",
       "20    20.81.40.144    20.81.40.144   Public\n",
       "21    20.80.162.44    20.80.162.44   Public\n",
       "22      172.31.0.0      172.31.0.0  Private\n",
       "23   104.215.76.44   104.215.76.44   Public\n",
       "24      172.31.0.1      172.31.0.1  Private\n",
       "25     20.81.42.55     20.81.42.55   Public\n",
       "26    20.55.80.232    20.55.80.232   Public\n",
       "27  172.16.199.104  172.16.199.104  Private\n",
       "28    79.124.62.82    79.124.62.82   Public"
      ]
     },
     "execution_count": 54,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "entities.IpAddress.util.ip_type(data=ips_df, column=\"IP\", join=\"inner\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Pivot functions that we want to execute\n",
    "\n",
    "```Python\n",
    "entities.IpAddress.util.ip_type\n",
    "entities.IpAddress.util.whois\n",
    "entities.IpAddress.util.geoloc\n",
    "entities.IpAddress.AzureSentinel.SecurityAlert_list_related_alerts\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### We could do this\n",
    "\n",
    "```Python\n",
    "df = entities.IpAddress.util.ip_type(data=ips, column=\"IP\", join=\"inner\")\n",
    "df2 = entities.IpAddress.util.whois(data=df, column=\"IP\", join=\"inner\")\n",
    "df3 = entities.IpAddress.util.geoloc(data=df2, column=\"IP\", join=\"inner\")\n",
    "df3 = entities.IpAddress.AzureSentinel.SecurityAlert_list_related_alerts(data=df3, column=\"IP\", join=\"inner\")\n",
    "```\n",
    "\n",
    "### .... but there's a better way"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 55,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "<msticpy.datamodel.pivot_pd_accessor.PivotAccessor at 0x275754e2208>"
      ]
     },
     "execution_count": 55,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "ips_df.mp_pivot"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 56,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
        "<div>\n",
        "<style scoped>\n",
        "    .dataframe tbody tr th:only-of-type {\n",
        "        vertical-align: middle;\n",
        "    }\n",
        "\n",
        "    .dataframe tbody tr th {\n",
        "        vertical-align: top;\n",
        "    }\n",
        "\n",
        "    .dataframe thead th {\n",
        "        text-align: right;\n",
        "    }\n",
        "</style>\n",
        "<table border=\"1\" class=\"dataframe\">\n",
        "  <thead>\n",
        "    <tr style=\"text-align: right;\">\n",
        "      <th></th>\n",
        "      <th>TenantId</th>\n",
        "      <th>TimeGenerated</th>\n",
        "      <th>AlertDisplayName</th>\n",
        "      <th>AlertName</th>\n",
        "      <th>Severity</th>\n",
        "      <th>Description</th>\n",
        "      <th>ProviderName</th>\n",
        "      <th>VendorName</th>\n",
        "      <th>VendorOriginalId</th>\n",
        "      <th>SystemAlertId</th>\n",
        "      <th>ResourceId</th>\n",
        "      <th>SourceComputerId</th>\n",
        "      <th>AlertType</th>\n",
        "      <th>ConfidenceLevel</th>\n",
        "      <th>ConfidenceScore</th>\n",
        "      <th>IsIncident</th>\n",
        "      <th>StartTimeUtc</th>\n",
        "      <th>EndTimeUtc</th>\n",
        "      <th>ProcessingEndTime</th>\n",
        "      <th>RemediationSteps</th>\n",
        "      <th>ExtendedProperties</th>\n",
        "      <th>Entities</th>\n",
        "      <th>SourceSystem</th>\n",
        "      <th>WorkspaceSubscriptionId</th>\n",
        "      <th>WorkspaceResourceGroup</th>\n",
        "      <th>ExtendedLinks</th>\n",
        "      <th>ProductName</th>\n",
        "      <th>ProductComponentName</th>\n",
        "      <th>AlertLink</th>\n",
        "      <th>Status</th>\n",
        "      <th>CompromisedEntity</th>\n",
        "      <th>Tactics</th>\n",
        "      <th>Type</th>\n",
        "      <th>SystemAlertId1</th>\n",
        "      <th>ExtendedProperties1</th>\n",
        "      <th>Entities1</th>\n",
        "      <th>MatchingIps</th>\n",
        "      <th>src_row_index</th>\n",
        "    </tr>\n",
        "  </thead>\n",
        "  <tbody>\n",
        "    <tr>\n",
        "      <th>0</th>\n",
        "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
        "      <td>2020-12-23 14:08:12+00:00</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td>Medium</td>\n",
        "      <td>Microsoft threat intelligence analytic has detected Blocked communication to a known WatchList d...</td>\n",
        "      <td>Threat Intelligence Alerts</td>\n",
        "      <td>Microsoft</td>\n",
        "      <td>91d806d3-6b6f-4e5c-a78f-e674d602be51</td>\n",
        "      <td>625ff9af-dddc-0cf8-9d4b-e79067fa2e71</td>\n",
        "      <td></td>\n",
        "      <td></td>\n",
        "      <td>ThreatIntelligence</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 14:08:15+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>625ff9af-dddc-0cf8-9d4b-e79067fa2e71</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "      <td>0</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>1</th>\n",
        "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
        "      <td>2020-12-23 14:08:12+00:00</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td>Medium</td>\n",
        "      <td>Microsoft threat intelligence analytic has detected Blocked communication to a known WatchList d...</td>\n",
        "      <td>Threat Intelligence Alerts</td>\n",
        "      <td>Microsoft</td>\n",
        "      <td>173063c4-10dd-4dd2-9e4f-ec5ed596ec54</td>\n",
        "      <td>c977f904-ab30-d57e-986f-9d6ebf72771b</td>\n",
        "      <td></td>\n",
        "      <td></td>\n",
        "      <td>ThreatIntelligence</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 14:08:15+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>c977f904-ab30-d57e-986f-9d6ebf72771b</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "      <td>0</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>2</th>\n",
        "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
        "      <td>2020-12-23 14:08:12+00:00</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td>Medium</td>\n",
        "      <td>Microsoft threat intelligence analytic has detected Blocked communication to a known WatchList d...</td>\n",
        "      <td>Threat Intelligence Alerts</td>\n",
        "      <td>Microsoft</td>\n",
        "      <td>58b2cda2-11c6-42b8-b6f1-72751cad8f38</td>\n",
        "      <td>9ee547e4-cba1-47d1-e1f9-87247b693a52</td>\n",
        "      <td></td>\n",
        "      <td></td>\n",
        "      <td>ThreatIntelligence</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 14:08:15+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>9ee547e4-cba1-47d1-e1f9-87247b693a52</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "      <td>0</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>3</th>\n",
        "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
        "      <td>2020-12-23 14:08:12+00:00</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td>Medium</td>\n",
        "      <td>Microsoft threat intelligence analytic has detected Blocked communication to a known WatchList d...</td>\n",
        "      <td>Threat Intelligence Alerts</td>\n",
        "      <td>Microsoft</td>\n",
        "      <td>e945f91e-5726-4581-8564-4c04e5414a58</td>\n",
        "      <td>83a0e08a-1adb-ef75-1c56-f6c9ce25ca69</td>\n",
        "      <td></td>\n",
        "      <td></td>\n",
        "      <td>ThreatIntelligence</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 14:08:16+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>83a0e08a-1adb-ef75-1c56-f6c9ce25ca69</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "      <td>0</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>4</th>\n",
        "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
        "      <td>2020-12-23 13:53:46+00:00</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td>Medium</td>\n",
        "      <td>Microsoft threat intelligence analytic has detected Blocked communication to a known WatchList d...</td>\n",
        "      <td>Threat Intelligence Alerts</td>\n",
        "      <td>Microsoft</td>\n",
        "      <td>a95aaf62-9628-418b-8f5f-0f1f26dcdc13</td>\n",
        "      <td>fde729f6-674b-997a-17eb-e4e7d2b3690d</td>\n",
        "      <td></td>\n",
        "      <td></td>\n",
        "      <td>ThreatIntelligence</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 13:53:47+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>fde729f6-674b-997a-17eb-e4e7d2b3690d</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "      <td>0</td>\n",
        "    </tr>\n",
        "  </tbody>\n",
        "</table>\n",
        "</div>"
      ],
      "text/plain": [
        "                               TenantId             TimeGenerated  \\\n",
        "0  8ecf8077-cf51-4820-aadd-14040956f35d 2020-12-23 14:08:12+00:00   \n",
        "1  8ecf8077-cf51-4820-aadd-14040956f35d 2020-12-23 14:08:12+00:00   \n",
        "2  8ecf8077-cf51-4820-aadd-14040956f35d 2020-12-23 14:08:12+00:00   \n",
        "3  8ecf8077-cf51-4820-aadd-14040956f35d 2020-12-23 14:08:12+00:00   \n",
        "4  8ecf8077-cf51-4820-aadd-14040956f35d 2020-12-23 13:53:46+00:00   \n",
        "\n",
        "                          AlertDisplayName  \\\n",
        "0  Microsoft Threat Intelligence Analytics   \n",
        "1  Microsoft Threat Intelligence Analytics   \n",
        "2  Microsoft Threat Intelligence Analytics   \n",
        "3  Microsoft Threat Intelligence Analytics   \n",
        "4  Microsoft Threat Intelligence Analytics   \n",
        "\n",
        "                                 AlertName Severity  \\\n",
        "0  Microsoft Threat Intelligence Analytics   Medium   \n",
        "1  Microsoft Threat Intelligence Analytics   Medium   \n",
        "2  Microsoft Threat Intelligence Analytics   Medium   \n",
        "3  Microsoft Threat Intelligence Analytics   Medium   \n",
        "4  Microsoft Threat Intelligence Analytics   Medium   \n",
        "\n",
        "                                                                                           Description  \\\n",
        "0  Microsoft threat intelligence analytic has detected Blocked communication to a known WatchList d...   \n",
        "1  Microsoft threat intelligence analytic has detected Blocked communication to a known WatchList d...   \n",
        "2  Microsoft threat intelligence analytic has detected Blocked communication to a known WatchList d...   \n",
        "3  Microsoft threat intelligence analytic has detected Blocked communication to a known WatchList d...   \n",
        "4  Microsoft threat intelligence analytic has detected Blocked communication to a known WatchList d...   \n",
        "\n",
        "                 ProviderName VendorName  \\\n",
        "0  Threat Intelligence Alerts  Microsoft   \n",
        "1  Threat Intelligence Alerts  Microsoft   \n",
        "2  Threat Intelligence Alerts  Microsoft   \n",
        "3  Threat Intelligence Alerts  Microsoft   \n",
        "4  Threat Intelligence Alerts  Microsoft   \n",
        "\n",
        "                       VendorOriginalId                         SystemAlertId  \\\n",
        "0  91d806d3-6b6f-4e5c-a78f-e674d602be51  625ff9af-dddc-0cf8-9d4b-e79067fa2e71   \n",
        "1  173063c4-10dd-4dd2-9e4f-ec5ed596ec54  c977f904-ab30-d57e-986f-9d6ebf72771b   \n",
        "2  58b2cda2-11c6-42b8-b6f1-72751cad8f38  9ee547e4-cba1-47d1-e1f9-87247b693a52   \n",
        "3  e945f91e-5726-4581-8564-4c04e5414a58  83a0e08a-1adb-ef75-1c56-f6c9ce25ca69   \n",
        "4  a95aaf62-9628-418b-8f5f-0f1f26dcdc13  fde729f6-674b-997a-17eb-e4e7d2b3690d   \n",
        "\n",
        "  ResourceId SourceComputerId           AlertType ConfidenceLevel  \\\n",
        "0                              ThreatIntelligence              83   \n",
        "1                              ThreatIntelligence              83   \n",
        "2                              ThreatIntelligence              83   \n",
        "3                              ThreatIntelligence              83   \n",
        "4                              ThreatIntelligence              83   \n",
        "\n",
        "   ConfidenceScore  IsIncident              StartTimeUtc  \\\n",
        "0              NaN       False 2020-12-23 13:48:23+00:00   \n",
        "1              NaN       False 2020-12-23 13:48:23+00:00   \n",
        "2              NaN       False 2020-12-23 13:48:23+00:00   \n",
        "3              NaN       False 2020-12-23 13:48:23+00:00   \n",
        "4              NaN       False 2020-12-23 13:48:23+00:00   \n",
        "\n",
        "                 EndTimeUtc         ProcessingEndTime RemediationSteps  \\\n",
        "0 2020-12-23 13:48:23+00:00 2020-12-23 14:08:15+00:00                    \n",
        "1 2020-12-23 13:48:23+00:00 2020-12-23 14:08:15+00:00                    \n",
        "2 2020-12-23 13:48:23+00:00 2020-12-23 14:08:15+00:00                    \n",
        "3 2020-12-23 13:48:23+00:00 2020-12-23 14:08:16+00:00                    \n",
        "4 2020-12-23 13:48:23+00:00 2020-12-23 13:53:47+00:00                    \n",
        "\n",
        "                                                                                    ExtendedProperties  \\\n",
        "0  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "1  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "2  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "3  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "4  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "\n",
        "                                                                                              Entities  \\\n",
        "0  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "1  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "2  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "3  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "4  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "\n",
        "  SourceSystem               WorkspaceSubscriptionId WorkspaceResourceGroup  \\\n",
        "0    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "1    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "2    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "3    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "4    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "\n",
        "  ExtendedLinks     ProductName                     ProductComponentName  \\\n",
        "0                Microsoft Sentinel  Microsoft Threat Intelligence Analytics   \n",
        "1                Microsoft Sentinel  Microsoft Threat Intelligence Analytics   \n",
        "2                Microsoft Sentinel  Microsoft Threat Intelligence Analytics   \n",
        "3                Microsoft Sentinel  Microsoft Threat Intelligence Analytics   \n",
        "4                Microsoft Sentinel  Microsoft Threat Intelligence Analytics   \n",
        "\n",
        "  AlertLink Status CompromisedEntity  Tactics           Type  \\\n",
        "0              New       3.88.48.125  Unknown  SecurityAlert   \n",
        "1              New       3.88.48.125  Unknown  SecurityAlert   \n",
        "2              New       3.88.48.125  Unknown  SecurityAlert   \n",
        "3              New       3.88.48.125  Unknown  SecurityAlert   \n",
        "4              New       3.88.48.125  Unknown  SecurityAlert   \n",
        "\n",
        "                         SystemAlertId1  \\\n",
        "0  625ff9af-dddc-0cf8-9d4b-e79067fa2e71   \n",
        "1  c977f904-ab30-d57e-986f-9d6ebf72771b   \n",
        "2  9ee547e4-cba1-47d1-e1f9-87247b693a52   \n",
        "3  83a0e08a-1adb-ef75-1c56-f6c9ce25ca69   \n",
        "4  fde729f6-674b-997a-17eb-e4e7d2b3690d   \n",
        "\n",
        "                                                                                   ExtendedProperties1  \\\n",
        "0  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "1  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "2  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "3  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "4  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "\n",
        "                                                                                             Entities1  \\\n",
        "0  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "1  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "2  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "3  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "4  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "\n",
        "     MatchingIps  src_row_index  \n",
        "0  [3.88.48.125]              0  \n",
        "1  [3.88.48.125]              0  \n",
        "2  [3.88.48.125]              0  \n",
        "3  [3.88.48.125]              0  \n",
        "4  [3.88.48.125]              0  "
      ]
     },
     "execution_count": 56,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "(\n",
    "    ips_df\n",
    "    .mp_pivot.run(entities.IpAddress.util.ip_type, column=\"IP\", join=\"inner\")\n",
    "    .query(\"result == 'Public'\").head(10)\n",
    "    .mp_pivot.run(entities.IpAddress.util.whois, column=\"ip\", join=\"left\")\n",
    "    .mp_pivot.run(entities.IpAddress.util.geoloc, column=\"ip\", join=\"left\")\n",
    "    .mp_pivot.run(entities.IpAddress.AzureSentinel.SecurityAlert_list_alerts_for_ip, source_ip_list=\"ip\")\n",
    ").head(5)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 57,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>IP</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>192.168.40.32</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>192.168.1.216</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>192.168.153.17</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>3.88.48.125</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>10.200.104.20</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>17</th>\n",
       "      <td>192.168.90.101</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>68</th>\n",
       "      <td>192.168.150.50</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>69</th>\n",
       "      <td>172.16.100.31</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>70</th>\n",
       "      <td>192.168.30.189</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>105</th>\n",
       "      <td>10.100.199.10</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>272</th>\n",
       "      <td>52.171.57.74</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>273</th>\n",
       "      <td>52.171.36.115</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>275</th>\n",
       "      <td>20.84.105.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>276</th>\n",
       "      <td>20.55.97.123</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>392</th>\n",
       "      <td>20.84.112.117</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>397</th>\n",
       "      <td>192.168.99.137</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>410</th>\n",
       "      <td>192.168.55.10</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>720</th>\n",
       "      <td>192.168.51.6</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>923</th>\n",
       "      <td>104.214.50.229</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>924</th>\n",
       "      <td>20.51.104.164</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>925</th>\n",
       "      <td>20.81.40.144</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>926</th>\n",
       "      <td>20.80.162.44</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>927</th>\n",
       "      <td>172.31.0.0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>928</th>\n",
       "      <td>104.215.76.44</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1017</th>\n",
       "      <td>172.31.0.1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1923</th>\n",
       "      <td>20.81.42.55</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3290</th>\n",
       "      <td>20.55.80.232</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4381</th>\n",
       "      <td>172.16.199.104</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5542</th>\n",
       "      <td>79.124.62.82</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                  IP\n",
       "0      192.168.40.32\n",
       "1      192.168.1.216\n",
       "2     192.168.153.17\n",
       "3        3.88.48.125\n",
       "4      10.200.104.20\n",
       "17    192.168.90.101\n",
       "68    192.168.150.50\n",
       "69     172.16.100.31\n",
       "70    192.168.30.189\n",
       "105    10.100.199.10\n",
       "272     52.171.57.74\n",
       "273    52.171.36.115\n",
       "275      20.84.105.0\n",
       "276     20.55.97.123\n",
       "392    20.84.112.117\n",
       "397   192.168.99.137\n",
       "410    192.168.55.10\n",
       "720     192.168.51.6\n",
       "923   104.214.50.229\n",
       "924    20.51.104.164\n",
       "925     20.81.40.144\n",
       "926     20.80.162.44\n",
       "927       172.31.0.0\n",
       "928    104.215.76.44\n",
       "1017      172.31.0.1\n",
       "1923     20.81.42.55\n",
       "3290    20.55.80.232\n",
       "4381  172.16.199.104\n",
       "5542    79.124.62.82"
      ]
     },
     "execution_count": 57,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "ips_df"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 58,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>nir</th>\n",
       "      <th>asn_registry</th>\n",
       "      <th>asn</th>\n",
       "      <th>asn_cidr</th>\n",
       "      <th>asn_country_code</th>\n",
       "      <th>asn_date</th>\n",
       "      <th>asn_description</th>\n",
       "      <th>query</th>\n",
       "      <th>nets</th>\n",
       "      <th>raw</th>\n",
       "      <th>referral</th>\n",
       "      <th>raw_referral</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>14618</td>\n",
       "      <td>3.80.0.0/12</td>\n",
       "      <td>US</td>\n",
       "      <td>2017-12-20</td>\n",
       "      <td>AMAZON-AES, US</td>\n",
       "      <td>3.88.48.125</td>\n",
       "      <td>[{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>17</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>68</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>69</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>70</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>105</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>272</th>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>8075</td>\n",
       "      <td>52.160.0.0/11</td>\n",
       "      <td>US</td>\n",
       "      <td>2015-11-24</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>52.171.57.74</td>\n",
       "      <td>[{'cidr': '52.160.0.0/11, 52.148.0.0/14, 52.152.0.0/13, 52.145.0.0/16, 52.146.0.0/15', 'name': '...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>273</th>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>8075</td>\n",
       "      <td>52.160.0.0/11</td>\n",
       "      <td>US</td>\n",
       "      <td>2015-11-24</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>52.171.36.115</td>\n",
       "      <td>[{'cidr': '52.145.0.0/16, 52.146.0.0/15, 52.152.0.0/13, 52.160.0.0/11, 52.148.0.0/14', 'name': '...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>275</th>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>8075</td>\n",
       "      <td>20.64.0.0/10</td>\n",
       "      <td>US</td>\n",
       "      <td>2017-10-18</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>20.84.105.0</td>\n",
       "      <td>[{'cidr': '20.128.0.0/16, 20.64.0.0/10, 20.40.0.0/13, 20.36.0.0/14, 20.48.0.0/12, 20.34.0.0/15, ...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>276</th>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>8075</td>\n",
       "      <td>20.48.0.0/12</td>\n",
       "      <td>US</td>\n",
       "      <td>2017-10-18</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>20.55.97.123</td>\n",
       "      <td>[{'cidr': '20.128.0.0/16, 20.64.0.0/10, 20.40.0.0/13, 20.36.0.0/14, 20.48.0.0/12, 20.34.0.0/15, ...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>392</th>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>8075</td>\n",
       "      <td>20.64.0.0/10</td>\n",
       "      <td>US</td>\n",
       "      <td>2017-10-18</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>20.84.112.117</td>\n",
       "      <td>[{'cidr': '20.128.0.0/16, 20.64.0.0/10, 20.40.0.0/13, 20.36.0.0/14, 20.48.0.0/12, 20.34.0.0/15, ...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>397</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>410</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>720</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>923</th>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>8075</td>\n",
       "      <td>104.208.0.0/13</td>\n",
       "      <td>US</td>\n",
       "      <td>2014-10-01</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>104.214.50.229</td>\n",
       "      <td>[{'cidr': '104.208.0.0/13', 'name': 'MSFT', 'handle': 'NET-104-208-0-0-1', 'range': '104.208.0.0...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>924</th>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>8075</td>\n",
       "      <td>20.48.0.0/12</td>\n",
       "      <td>US</td>\n",
       "      <td>2017-10-18</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>20.51.104.164</td>\n",
       "      <td>[{'cidr': '20.34.0.0/15, 20.48.0.0/12, 20.64.0.0/10, 20.33.0.0/16, 20.40.0.0/13, 20.36.0.0/14, 2...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>925</th>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>8075</td>\n",
       "      <td>20.64.0.0/10</td>\n",
       "      <td>US</td>\n",
       "      <td>2017-10-18</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>20.81.40.144</td>\n",
       "      <td>[{'cidr': '20.128.0.0/16, 20.33.0.0/16, 20.48.0.0/12, 20.34.0.0/15, 20.64.0.0/10, 20.36.0.0/14, ...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>926</th>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>8075</td>\n",
       "      <td>20.64.0.0/10</td>\n",
       "      <td>US</td>\n",
       "      <td>2017-10-18</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>20.80.162.44</td>\n",
       "      <td>[{'cidr': '20.128.0.0/16, 20.33.0.0/16, 20.48.0.0/12, 20.34.0.0/15, 20.64.0.0/10, 20.36.0.0/14, ...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>927</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>928</th>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>8075</td>\n",
       "      <td>104.208.0.0/13</td>\n",
       "      <td>US</td>\n",
       "      <td>2014-10-01</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>104.215.76.44</td>\n",
       "      <td>[{'cidr': '104.208.0.0/13', 'name': 'MSFT', 'handle': 'NET-104-208-0-0-1', 'range': '104.208.0.0...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1017</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1923</th>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>8075</td>\n",
       "      <td>20.64.0.0/10</td>\n",
       "      <td>US</td>\n",
       "      <td>2017-10-18</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>20.81.42.55</td>\n",
       "      <td>[{'cidr': '20.34.0.0/15, 20.36.0.0/14, 20.48.0.0/12, 20.64.0.0/10, 20.128.0.0/16, 20.33.0.0/16, ...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3290</th>\n",
       "      <td>NaN</td>\n",
       "      <td>arin</td>\n",
       "      <td>8075</td>\n",
       "      <td>20.48.0.0/12</td>\n",
       "      <td>US</td>\n",
       "      <td>2017-10-18</td>\n",
       "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
       "      <td>20.55.80.232</td>\n",
       "      <td>[{'cidr': '20.34.0.0/15, 20.36.0.0/14, 20.48.0.0/12, 20.64.0.0/10, 20.128.0.0/16, 20.33.0.0/16, ...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4381</th>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5542</th>\n",
       "      <td>NaN</td>\n",
       "      <td>ripencc</td>\n",
       "      <td>207812</td>\n",
       "      <td>79.124.62.0/24</td>\n",
       "      <td>BG</td>\n",
       "      <td>2007-07-31</td>\n",
       "      <td>DM_AUTO, BG</td>\n",
       "      <td>79.124.62.82</td>\n",
       "      <td>[{'cidr': '79.124.62.0/24', 'name': 'CLOUDVPS-NET', 'handle': 'NOC299-RIPE', 'range': '79.124.62...</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "      nir asn_registry     asn        asn_cidr asn_country_code    asn_date  \\\n",
       "0     NaN          NaN     NaN             NaN              NaN         NaN   \n",
       "1     NaN          NaN     NaN             NaN              NaN         NaN   \n",
       "2     NaN          NaN     NaN             NaN              NaN         NaN   \n",
       "3     NaN         arin   14618     3.80.0.0/12               US  2017-12-20   \n",
       "4     NaN          NaN     NaN             NaN              NaN         NaN   \n",
       "17    NaN          NaN     NaN             NaN              NaN         NaN   \n",
       "68    NaN          NaN     NaN             NaN              NaN         NaN   \n",
       "69    NaN          NaN     NaN             NaN              NaN         NaN   \n",
       "70    NaN          NaN     NaN             NaN              NaN         NaN   \n",
       "105   NaN          NaN     NaN             NaN              NaN         NaN   \n",
       "272   NaN         arin    8075   52.160.0.0/11               US  2015-11-24   \n",
       "273   NaN         arin    8075   52.160.0.0/11               US  2015-11-24   \n",
       "275   NaN         arin    8075    20.64.0.0/10               US  2017-10-18   \n",
       "276   NaN         arin    8075    20.48.0.0/12               US  2017-10-18   \n",
       "392   NaN         arin    8075    20.64.0.0/10               US  2017-10-18   \n",
       "397   NaN          NaN     NaN             NaN              NaN         NaN   \n",
       "410   NaN          NaN     NaN             NaN              NaN         NaN   \n",
       "720   NaN          NaN     NaN             NaN              NaN         NaN   \n",
       "923   NaN         arin    8075  104.208.0.0/13               US  2014-10-01   \n",
       "924   NaN         arin    8075    20.48.0.0/12               US  2017-10-18   \n",
       "925   NaN         arin    8075    20.64.0.0/10               US  2017-10-18   \n",
       "926   NaN         arin    8075    20.64.0.0/10               US  2017-10-18   \n",
       "927   NaN          NaN     NaN             NaN              NaN         NaN   \n",
       "928   NaN         arin    8075  104.208.0.0/13               US  2014-10-01   \n",
       "1017  NaN          NaN     NaN             NaN              NaN         NaN   \n",
       "1923  NaN         arin    8075    20.64.0.0/10               US  2017-10-18   \n",
       "3290  NaN         arin    8075    20.48.0.0/12               US  2017-10-18   \n",
       "4381  NaN          NaN     NaN             NaN              NaN         NaN   \n",
       "5542  NaN      ripencc  207812  79.124.62.0/24               BG  2007-07-31   \n",
       "\n",
       "                      asn_description           query  \\\n",
       "0                                 NaN             NaN   \n",
       "1                                 NaN             NaN   \n",
       "2                                 NaN             NaN   \n",
       "3                      AMAZON-AES, US     3.88.48.125   \n",
       "4                                 NaN             NaN   \n",
       "17                                NaN             NaN   \n",
       "68                                NaN             NaN   \n",
       "69                                NaN             NaN   \n",
       "70                                NaN             NaN   \n",
       "105                               NaN             NaN   \n",
       "272   MICROSOFT-CORP-MSN-AS-BLOCK, US    52.171.57.74   \n",
       "273   MICROSOFT-CORP-MSN-AS-BLOCK, US   52.171.36.115   \n",
       "275   MICROSOFT-CORP-MSN-AS-BLOCK, US     20.84.105.0   \n",
       "276   MICROSOFT-CORP-MSN-AS-BLOCK, US    20.55.97.123   \n",
       "392   MICROSOFT-CORP-MSN-AS-BLOCK, US   20.84.112.117   \n",
       "397                               NaN             NaN   \n",
       "410                               NaN             NaN   \n",
       "720                               NaN             NaN   \n",
       "923   MICROSOFT-CORP-MSN-AS-BLOCK, US  104.214.50.229   \n",
       "924   MICROSOFT-CORP-MSN-AS-BLOCK, US   20.51.104.164   \n",
       "925   MICROSOFT-CORP-MSN-AS-BLOCK, US    20.81.40.144   \n",
       "926   MICROSOFT-CORP-MSN-AS-BLOCK, US    20.80.162.44   \n",
       "927                               NaN             NaN   \n",
       "928   MICROSOFT-CORP-MSN-AS-BLOCK, US   104.215.76.44   \n",
       "1017                              NaN             NaN   \n",
       "1923  MICROSOFT-CORP-MSN-AS-BLOCK, US     20.81.42.55   \n",
       "3290  MICROSOFT-CORP-MSN-AS-BLOCK, US    20.55.80.232   \n",
       "4381                              NaN             NaN   \n",
       "5542                      DM_AUTO, BG    79.124.62.82   \n",
       "\n",
       "                                                                                                     nets  \\\n",
       "0                                                                                                     NaN   \n",
       "1                                                                                                     NaN   \n",
       "2                                                                                                     NaN   \n",
       "3     [{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...   \n",
       "4                                                                                                     NaN   \n",
       "17                                                                                                    NaN   \n",
       "68                                                                                                    NaN   \n",
       "69                                                                                                    NaN   \n",
       "70                                                                                                    NaN   \n",
       "105                                                                                                   NaN   \n",
       "272   [{'cidr': '52.160.0.0/11, 52.148.0.0/14, 52.152.0.0/13, 52.145.0.0/16, 52.146.0.0/15', 'name': '...   \n",
       "273   [{'cidr': '52.145.0.0/16, 52.146.0.0/15, 52.152.0.0/13, 52.160.0.0/11, 52.148.0.0/14', 'name': '...   \n",
       "275   [{'cidr': '20.128.0.0/16, 20.64.0.0/10, 20.40.0.0/13, 20.36.0.0/14, 20.48.0.0/12, 20.34.0.0/15, ...   \n",
       "276   [{'cidr': '20.128.0.0/16, 20.64.0.0/10, 20.40.0.0/13, 20.36.0.0/14, 20.48.0.0/12, 20.34.0.0/15, ...   \n",
       "392   [{'cidr': '20.128.0.0/16, 20.64.0.0/10, 20.40.0.0/13, 20.36.0.0/14, 20.48.0.0/12, 20.34.0.0/15, ...   \n",
       "397                                                                                                   NaN   \n",
       "410                                                                                                   NaN   \n",
       "720                                                                                                   NaN   \n",
       "923   [{'cidr': '104.208.0.0/13', 'name': 'MSFT', 'handle': 'NET-104-208-0-0-1', 'range': '104.208.0.0...   \n",
       "924   [{'cidr': '20.34.0.0/15, 20.48.0.0/12, 20.64.0.0/10, 20.33.0.0/16, 20.40.0.0/13, 20.36.0.0/14, 2...   \n",
       "925   [{'cidr': '20.128.0.0/16, 20.33.0.0/16, 20.48.0.0/12, 20.34.0.0/15, 20.64.0.0/10, 20.36.0.0/14, ...   \n",
       "926   [{'cidr': '20.128.0.0/16, 20.33.0.0/16, 20.48.0.0/12, 20.34.0.0/15, 20.64.0.0/10, 20.36.0.0/14, ...   \n",
       "927                                                                                                   NaN   \n",
       "928   [{'cidr': '104.208.0.0/13', 'name': 'MSFT', 'handle': 'NET-104-208-0-0-1', 'range': '104.208.0.0...   \n",
       "1017                                                                                                  NaN   \n",
       "1923  [{'cidr': '20.34.0.0/15, 20.36.0.0/14, 20.48.0.0/12, 20.64.0.0/10, 20.128.0.0/16, 20.33.0.0/16, ...   \n",
       "3290  [{'cidr': '20.34.0.0/15, 20.36.0.0/14, 20.48.0.0/12, 20.64.0.0/10, 20.128.0.0/16, 20.33.0.0/16, ...   \n",
       "4381                                                                                                  NaN   \n",
       "5542  [{'cidr': '79.124.62.0/24', 'name': 'CLOUDVPS-NET', 'handle': 'NOC299-RIPE', 'range': '79.124.62...   \n",
       "\n",
       "      raw  referral  raw_referral  \n",
       "0     NaN       NaN           NaN  \n",
       "1     NaN       NaN           NaN  \n",
       "2     NaN       NaN           NaN  \n",
       "3     NaN       NaN           NaN  \n",
       "4     NaN       NaN           NaN  \n",
       "17    NaN       NaN           NaN  \n",
       "68    NaN       NaN           NaN  \n",
       "69    NaN       NaN           NaN  \n",
       "70    NaN       NaN           NaN  \n",
       "105   NaN       NaN           NaN  \n",
       "272   NaN       NaN           NaN  \n",
       "273   NaN       NaN           NaN  \n",
       "275   NaN       NaN           NaN  \n",
       "276   NaN       NaN           NaN  \n",
       "392   NaN       NaN           NaN  \n",
       "397   NaN       NaN           NaN  \n",
       "410   NaN       NaN           NaN  \n",
       "720   NaN       NaN           NaN  \n",
       "923   NaN       NaN           NaN  \n",
       "924   NaN       NaN           NaN  \n",
       "925   NaN       NaN           NaN  \n",
       "926   NaN       NaN           NaN  \n",
       "927   NaN       NaN           NaN  \n",
       "928   NaN       NaN           NaN  \n",
       "1017  NaN       NaN           NaN  \n",
       "1923  NaN       NaN           NaN  \n",
       "3290  NaN       NaN           NaN  \n",
       "4381  NaN       NaN           NaN  \n",
       "5542  NaN       NaN           NaN  "
      ]
     },
     "execution_count": 58,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "entities.IpAddress.util.whois(data=ips_df, column=\"IP\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Simple pipeline\n",
    "\n",
    "Note:\n",
    "- inline query to filter to only \"Public\" IPs\n",
    "- `mp_pivot.display` function to display intermediate results"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 59,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<h3>Geo Lookup</h3>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>IP</th>\n",
       "      <th>City</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>3.88.48.125</td>\n",
       "      <td>Ashburn</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>52.171.57.74</td>\n",
       "      <td>San Antonio</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>52.171.36.115</td>\n",
       "      <td>San Antonio</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>20.84.105.0</td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>20.55.97.123</td>\n",
       "      <td>Washington</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>20.84.112.117</td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>104.214.50.229</td>\n",
       "      <td>San Antonio</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>20.51.104.164</td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>20.81.40.144</td>\n",
       "      <td>Washington</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>20.80.162.44</td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "               IP         City\n",
       "0     3.88.48.125      Ashburn\n",
       "1    52.171.57.74  San Antonio\n",
       "2   52.171.36.115  San Antonio\n",
       "3     20.84.105.0         None\n",
       "4    20.55.97.123   Washington\n",
       "5   20.84.112.117         None\n",
       "6  104.214.50.229  San Antonio\n",
       "7   20.51.104.164         None\n",
       "8    20.81.40.144   Washington\n",
       "9    20.80.162.44         None"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
        "<div>\n",
        "<style scoped>\n",
        "    .dataframe tbody tr th:only-of-type {\n",
        "        vertical-align: middle;\n",
        "    }\n",
        "\n",
        "    .dataframe tbody tr th {\n",
        "        vertical-align: top;\n",
        "    }\n",
        "\n",
        "    .dataframe thead th {\n",
        "        text-align: right;\n",
        "    }\n",
        "</style>\n",
        "<table border=\"1\" class=\"dataframe\">\n",
        "  <thead>\n",
        "    <tr style=\"text-align: right;\">\n",
        "      <th></th>\n",
        "      <th>IP</th>\n",
        "      <th>ip</th>\n",
        "      <th>result</th>\n",
        "      <th>nir</th>\n",
        "      <th>asn_registry</th>\n",
        "      <th>asn</th>\n",
        "      <th>asn_cidr</th>\n",
        "      <th>asn_country_code</th>\n",
        "      <th>asn_date</th>\n",
        "      <th>asn_description</th>\n",
        "      <th>query</th>\n",
        "      <th>nets</th>\n",
        "      <th>raw</th>\n",
        "      <th>referral</th>\n",
        "      <th>raw_referral</th>\n",
        "      <th>CountryCode</th>\n",
        "      <th>CountryName</th>\n",
        "      <th>State</th>\n",
        "      <th>City</th>\n",
        "      <th>Longitude</th>\n",
        "      <th>Latitude</th>\n",
        "      <th>Asn</th>\n",
        "      <th>edges</th>\n",
        "      <th>Type_x</th>\n",
        "      <th>AdditionalData</th>\n",
        "      <th>...</th>\n",
        "      <th>ConfidenceLevel</th>\n",
        "      <th>ConfidenceScore</th>\n",
        "      <th>IsIncident</th>\n",
        "      <th>StartTimeUtc</th>\n",
        "      <th>EndTimeUtc</th>\n",
        "      <th>ProcessingEndTime</th>\n",
        "      <th>RemediationSteps</th>\n",
        "      <th>ExtendedProperties</th>\n",
        "      <th>Entities</th>\n",
        "      <th>SourceSystem</th>\n",
        "      <th>WorkspaceSubscriptionId</th>\n",
        "      <th>WorkspaceResourceGroup</th>\n",
        "      <th>ExtendedLinks</th>\n",
        "      <th>ProductName</th>\n",
        "      <th>ProductComponentName</th>\n",
        "      <th>AlertLink</th>\n",
        "      <th>Status</th>\n",
        "      <th>CompromisedEntity</th>\n",
        "      <th>Tactics</th>\n",
        "      <th>Type_y</th>\n",
        "      <th>SystemAlertId1</th>\n",
        "      <th>ExtendedProperties1</th>\n",
        "      <th>Entities1</th>\n",
        "      <th>MatchingIps</th>\n",
        "      <th>src_row_index</th>\n",
        "    </tr>\n",
        "  </thead>\n",
        "  <tbody>\n",
        "    <tr>\n",
        "      <th>0</th>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Public</td>\n",
        "      <td>None</td>\n",
        "      <td>arin</td>\n",
        "      <td>14618</td>\n",
        "      <td>3.80.0.0/12</td>\n",
        "      <td>US</td>\n",
        "      <td>2017-12-20</td>\n",
        "      <td>AMAZON-AES, US</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>[{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>US</td>\n",
        "      <td>United States</td>\n",
        "      <td>Virginia</td>\n",
        "      <td>Ashburn</td>\n",
        "      <td>-77.4728</td>\n",
        "      <td>39.0481</td>\n",
        "      <td>None</td>\n",
        "      <td>{}</td>\n",
        "      <td>geolocation</td>\n",
        "      <td>{}</td>\n",
        "      <td>...</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-11-20 14:57:45+00:00</td>\n",
        "      <td>2020-11-20 14:57:45+00:00</td>\n",
        "      <td>2020-11-20 15:08:56+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"bigbonsai-music.de\\\") | where T...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"bigbonsai-music.de\",\\r\\n    \"HostName\": \"bigbon...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>a9954983-cc15-8b65-8e2d-ae268e8c6cb5</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"bigbonsai-music.de\\\") | where T...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"bigbonsai-music.de\",\\r\\n    \"HostName\": \"bigbon...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "      <td>0</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>1</th>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Public</td>\n",
        "      <td>None</td>\n",
        "      <td>arin</td>\n",
        "      <td>14618</td>\n",
        "      <td>3.80.0.0/12</td>\n",
        "      <td>US</td>\n",
        "      <td>2017-12-20</td>\n",
        "      <td>AMAZON-AES, US</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>[{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>US</td>\n",
        "      <td>United States</td>\n",
        "      <td>Virginia</td>\n",
        "      <td>Ashburn</td>\n",
        "      <td>-77.4728</td>\n",
        "      <td>39.0481</td>\n",
        "      <td>None</td>\n",
        "      <td>{}</td>\n",
        "      <td>geolocation</td>\n",
        "      <td>{}</td>\n",
        "      <td>...</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-11-20 14:57:45+00:00</td>\n",
        "      <td>2020-11-20 14:57:45+00:00</td>\n",
        "      <td>2020-11-20 15:08:57+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"bigbonsai-music.de\\\") | where T...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"bigbonsai-music.de\",\\r\\n    \"HostName\": \"bigbon...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>b241e024-ca33-c706-7475-c7dbecbc41c3</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"bigbonsai-music.de\\\") | where T...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"bigbonsai-music.de\",\\r\\n    \"HostName\": \"bigbon...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "      <td>0</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>2</th>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Public</td>\n",
        "      <td>None</td>\n",
        "      <td>arin</td>\n",
        "      <td>14618</td>\n",
        "      <td>3.80.0.0/12</td>\n",
        "      <td>US</td>\n",
        "      <td>2017-12-20</td>\n",
        "      <td>AMAZON-AES, US</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>[{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>US</td>\n",
        "      <td>United States</td>\n",
        "      <td>Virginia</td>\n",
        "      <td>Ashburn</td>\n",
        "      <td>-77.4728</td>\n",
        "      <td>39.0481</td>\n",
        "      <td>None</td>\n",
        "      <td>{}</td>\n",
        "      <td>geolocation</td>\n",
        "      <td>{}</td>\n",
        "      <td>...</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-11-20 14:57:46+00:00</td>\n",
        "      <td>2020-11-20 14:57:46+00:00</td>\n",
        "      <td>2020-11-20 15:08:57+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"bigbonsai-music.de\\\") | where T...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"bigbonsai-music.de\",\\r\\n    \"HostName\": \"bigbon...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>f9bf5915-4560-664c-486d-4e60c8cf6641</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"bigbonsai-music.de\\\") | where T...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"bigbonsai-music.de\",\\r\\n    \"HostName\": \"bigbon...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "      <td>0</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>3</th>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Public</td>\n",
        "      <td>None</td>\n",
        "      <td>arin</td>\n",
        "      <td>14618</td>\n",
        "      <td>3.80.0.0/12</td>\n",
        "      <td>US</td>\n",
        "      <td>2017-12-20</td>\n",
        "      <td>AMAZON-AES, US</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>[{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>US</td>\n",
        "      <td>United States</td>\n",
        "      <td>Virginia</td>\n",
        "      <td>Ashburn</td>\n",
        "      <td>-77.4728</td>\n",
        "      <td>39.0481</td>\n",
        "      <td>None</td>\n",
        "      <td>{}</td>\n",
        "      <td>geolocation</td>\n",
        "      <td>{}</td>\n",
        "      <td>...</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-11-20 14:57:45+00:00</td>\n",
        "      <td>2020-11-20 14:57:45+00:00</td>\n",
        "      <td>2020-11-20 15:08:57+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"bigbonsai-music.de\\\") | where T...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"bigbonsai-music.de\",\\r\\n    \"HostName\": \"bigbon...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>63fb83f4-54a0-ad9a-84cc-4d4403dcf8ec</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"bigbonsai-music.de\\\") | where T...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"bigbonsai-music.de\",\\r\\n    \"HostName\": \"bigbon...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "      <td>0</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>4</th>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Public</td>\n",
        "      <td>None</td>\n",
        "      <td>arin</td>\n",
        "      <td>14618</td>\n",
        "      <td>3.80.0.0/12</td>\n",
        "      <td>US</td>\n",
        "      <td>2017-12-20</td>\n",
        "      <td>AMAZON-AES, US</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>[{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>US</td>\n",
        "      <td>United States</td>\n",
        "      <td>Virginia</td>\n",
        "      <td>Ashburn</td>\n",
        "      <td>-77.4728</td>\n",
        "      <td>39.0481</td>\n",
        "      <td>None</td>\n",
        "      <td>{}</td>\n",
        "      <td>geolocation</td>\n",
        "      <td>{}</td>\n",
        "      <td>...</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-11-20 14:57:45+00:00</td>\n",
        "      <td>2020-11-20 14:57:45+00:00</td>\n",
        "      <td>2020-11-20 15:08:56+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"bigbonsai-music.de\\\") | where T...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"bigbonsai-music.de\",\\r\\n    \"HostName\": \"bigbon...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>dd08cd9d-2d76-83b6-daae-335dfd1466eb</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"bigbonsai-music.de\\\") | where T...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"bigbonsai-music.de\",\\r\\n    \"HostName\": \"bigbon...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "      <td>0</td>\n",
        "    </tr>\n",
        "  </tbody>\n",
        "</table>\n",
        "<p>5 rows × 64 columns</p>\n",
        "</div>"
      ],
      "text/plain": [
        "            IP           ip  result   nir asn_registry    asn     asn_cidr  \\\n",
        "0  3.88.48.125  3.88.48.125  Public  None         arin  14618  3.80.0.0/12   \n",
        "1  3.88.48.125  3.88.48.125  Public  None         arin  14618  3.80.0.0/12   \n",
        "2  3.88.48.125  3.88.48.125  Public  None         arin  14618  3.80.0.0/12   \n",
        "3  3.88.48.125  3.88.48.125  Public  None         arin  14618  3.80.0.0/12   \n",
        "4  3.88.48.125  3.88.48.125  Public  None         arin  14618  3.80.0.0/12   \n",
        "\n",
        "  asn_country_code    asn_date asn_description        query  \\\n",
        "0               US  2017-12-20  AMAZON-AES, US  3.88.48.125   \n",
        "1               US  2017-12-20  AMAZON-AES, US  3.88.48.125   \n",
        "2               US  2017-12-20  AMAZON-AES, US  3.88.48.125   \n",
        "3               US  2017-12-20  AMAZON-AES, US  3.88.48.125   \n",
        "4               US  2017-12-20  AMAZON-AES, US  3.88.48.125   \n",
        "\n",
        "                                                                                                  nets  \\\n",
        "0  [{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...   \n",
        "1  [{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...   \n",
        "2  [{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...   \n",
        "3  [{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...   \n",
        "4  [{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...   \n",
        "\n",
        "    raw referral raw_referral CountryCode    CountryName     State     City  \\\n",
        "0  None     None         None          US  United States  Virginia  Ashburn   \n",
        "1  None     None         None          US  United States  Virginia  Ashburn   \n",
        "2  None     None         None          US  United States  Virginia  Ashburn   \n",
        "3  None     None         None          US  United States  Virginia  Ashburn   \n",
        "4  None     None         None          US  United States  Virginia  Ashburn   \n",
        "\n",
        "   Longitude  Latitude   Asn edges       Type_x AdditionalData  ...  \\\n",
        "0   -77.4728   39.0481  None    {}  geolocation             {}  ...   \n",
        "1   -77.4728   39.0481  None    {}  geolocation             {}  ...   \n",
        "2   -77.4728   39.0481  None    {}  geolocation             {}  ...   \n",
        "3   -77.4728   39.0481  None    {}  geolocation             {}  ...   \n",
        "4   -77.4728   39.0481  None    {}  geolocation             {}  ...   \n",
        "\n",
        "  ConfidenceLevel ConfidenceScore IsIncident              StartTimeUtc  \\\n",
        "0              83             NaN      False 2020-11-20 14:57:45+00:00   \n",
        "1              83             NaN      False 2020-11-20 14:57:45+00:00   \n",
        "2              83             NaN      False 2020-11-20 14:57:46+00:00   \n",
        "3              83             NaN      False 2020-11-20 14:57:45+00:00   \n",
        "4              83             NaN      False 2020-11-20 14:57:45+00:00   \n",
        "\n",
        "                 EndTimeUtc         ProcessingEndTime RemediationSteps  \\\n",
        "0 2020-11-20 14:57:45+00:00 2020-11-20 15:08:56+00:00                    \n",
        "1 2020-11-20 14:57:45+00:00 2020-11-20 15:08:57+00:00                    \n",
        "2 2020-11-20 14:57:46+00:00 2020-11-20 15:08:57+00:00                    \n",
        "3 2020-11-20 14:57:45+00:00 2020-11-20 15:08:57+00:00                    \n",
        "4 2020-11-20 14:57:45+00:00 2020-11-20 15:08:56+00:00                    \n",
        "\n",
        "                                                                                    ExtendedProperties  \\\n",
        "0  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"bigbonsai-music.de\\\") | where T...   \n",
        "1  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"bigbonsai-music.de\\\") | where T...   \n",
        "2  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"bigbonsai-music.de\\\") | where T...   \n",
        "3  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"bigbonsai-music.de\\\") | where T...   \n",
        "4  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"bigbonsai-music.de\\\") | where T...   \n",
        "\n",
        "                                                                                              Entities  \\\n",
        "0  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"bigbonsai-music.de\",\\r\\n    \"HostName\": \"bigbon...   \n",
        "1  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"bigbonsai-music.de\",\\r\\n    \"HostName\": \"bigbon...   \n",
        "2  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"bigbonsai-music.de\",\\r\\n    \"HostName\": \"bigbon...   \n",
        "3  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"bigbonsai-music.de\",\\r\\n    \"HostName\": \"bigbon...   \n",
        "4  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"bigbonsai-music.de\",\\r\\n    \"HostName\": \"bigbon...   \n",
        "\n",
        "  SourceSystem               WorkspaceSubscriptionId WorkspaceResourceGroup  \\\n",
        "0    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "1    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "2    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "3    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "4    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "\n",
        "  ExtendedLinks     ProductName                     ProductComponentName  \\\n",
        "0                Microsoft Sentinel  Microsoft Threat Intelligence Analytics   \n",
        "1                Microsoft Sentinel  Microsoft Threat Intelligence Analytics   \n",
        "2                Microsoft Sentinel  Microsoft Threat Intelligence Analytics   \n",
        "3                Microsoft Sentinel  Microsoft Threat Intelligence Analytics   \n",
        "4                Microsoft Sentinel  Microsoft Threat Intelligence Analytics   \n",
        "\n",
        "   AlertLink  Status CompromisedEntity  Tactics         Type_y  \\\n",
        "0                New       3.88.48.125  Unknown  SecurityAlert   \n",
        "1                New       3.88.48.125  Unknown  SecurityAlert   \n",
        "2                New       3.88.48.125  Unknown  SecurityAlert   \n",
        "3                New       3.88.48.125  Unknown  SecurityAlert   \n",
        "4                New       3.88.48.125  Unknown  SecurityAlert   \n",
        "\n",
        "                         SystemAlertId1  \\\n",
        "0  a9954983-cc15-8b65-8e2d-ae268e8c6cb5   \n",
        "1  b241e024-ca33-c706-7475-c7dbecbc41c3   \n",
        "2  f9bf5915-4560-664c-486d-4e60c8cf6641   \n",
        "3  63fb83f4-54a0-ad9a-84cc-4d4403dcf8ec   \n",
        "4  dd08cd9d-2d76-83b6-daae-335dfd1466eb   \n",
        "\n",
        "                                                                                   ExtendedProperties1  \\\n",
        "0  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"bigbonsai-music.de\\\") | where T...   \n",
        "1  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"bigbonsai-music.de\\\") | where T...   \n",
        "2  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"bigbonsai-music.de\\\") | where T...   \n",
        "3  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"bigbonsai-music.de\\\") | where T...   \n",
        "4  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"bigbonsai-music.de\\\") | where T...   \n",
        "\n",
        "                                                                                             Entities1  \\\n",
        "0  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"bigbonsai-music.de\",\\r\\n    \"HostName\": \"bigbon...   \n",
        "1  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"bigbonsai-music.de\",\\r\\n    \"HostName\": \"bigbon...   \n",
        "2  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"bigbonsai-music.de\",\\r\\n    \"HostName\": \"bigbon...   \n",
        "3  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"bigbonsai-music.de\",\\r\\n    \"HostName\": \"bigbon...   \n",
        "4  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"bigbonsai-music.de\",\\r\\n    \"HostName\": \"bigbon...   \n",
        "\n",
        "     MatchingIps src_row_index  \n",
        "0  [3.88.48.125]             0  \n",
        "1  [3.88.48.125]             0  \n",
        "2  [3.88.48.125]             0  \n",
        "3  [3.88.48.125]             0  \n",
        "4  [3.88.48.125]             0  \n",
        "\n",
        "[5 rows x 64 columns]"
      ]
     },
     "execution_count": 59,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "(\n",
    "    ips_df\n",
    "    .mp_pivot.run(entities.IpAddress.util.ip_type, column=\"IP\", join=\"inner\")\n",
    "    .query(\"result == 'Public'\").head(10)\n",
    "    .mp_pivot.run(entities.IpAddress.util.whois, column=\"ip\", join=\"left\")\n",
    "    .mp_pivot.run(entities.IpAddress.util.geoloc, column=\"ip\", join=\"left\")\n",
    "    .mp_pivot.display(title=\"Geo Lookup\", cols=[\"IP\", \"City\"])  # << display an intermediate result\n",
    "    .mp_pivot.run(entities.IpAddress.AzureSentinel.SecurityAlert_list_alerts_for_ip, source_ip_list=\"ip\", join=\"left\")\n",
    ").head(5)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 60,
   "metadata": {},
   "outputs": [],
   "source": [
    "ip_test_df = (\n",
    "    ips_df\n",
    "    .mp_pivot.run(entities.IpAddress.util.ip_type, column=\"IP\", join=\"inner\")\n",
    "    .query(\"result == 'Public'\").head(10)\n",
    "    .mp_pivot.run(entities.IpAddress.util.whois, column=\"ip\", join=\"left\")\n",
    "    .mp_pivot.run(entities.IpAddress.util.geoloc, column=\"ip\", join=\"left\")\n",
    ").head(5)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 61,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
        "<div>\n",
        "<style scoped>\n",
        "    .dataframe tbody tr th:only-of-type {\n",
        "        vertical-align: middle;\n",
        "    }\n",
        "\n",
        "    .dataframe tbody tr th {\n",
        "        vertical-align: top;\n",
        "    }\n",
        "\n",
        "    .dataframe thead th {\n",
        "        text-align: right;\n",
        "    }\n",
        "</style>\n",
        "<table border=\"1\" class=\"dataframe\">\n",
        "  <thead>\n",
        "    <tr style=\"text-align: right;\">\n",
        "      <th></th>\n",
        "      <th>IP</th>\n",
        "      <th>ip</th>\n",
        "      <th>result</th>\n",
        "      <th>nir</th>\n",
        "      <th>asn_registry</th>\n",
        "      <th>asn</th>\n",
        "      <th>asn_cidr</th>\n",
        "      <th>asn_country_code</th>\n",
        "      <th>asn_date</th>\n",
        "      <th>asn_description</th>\n",
        "      <th>query</th>\n",
        "      <th>nets</th>\n",
        "      <th>raw</th>\n",
        "      <th>referral</th>\n",
        "      <th>raw_referral</th>\n",
        "      <th>CountryCode</th>\n",
        "      <th>CountryName</th>\n",
        "      <th>State</th>\n",
        "      <th>City</th>\n",
        "      <th>Longitude</th>\n",
        "      <th>Latitude</th>\n",
        "      <th>Asn</th>\n",
        "      <th>edges</th>\n",
        "      <th>Type_x</th>\n",
        "      <th>AdditionalData</th>\n",
        "      <th>...</th>\n",
        "      <th>ConfidenceLevel</th>\n",
        "      <th>ConfidenceScore</th>\n",
        "      <th>IsIncident</th>\n",
        "      <th>StartTimeUtc</th>\n",
        "      <th>EndTimeUtc</th>\n",
        "      <th>ProcessingEndTime</th>\n",
        "      <th>RemediationSteps</th>\n",
        "      <th>ExtendedProperties</th>\n",
        "      <th>Entities</th>\n",
        "      <th>SourceSystem</th>\n",
        "      <th>WorkspaceSubscriptionId</th>\n",
        "      <th>WorkspaceResourceGroup</th>\n",
        "      <th>ExtendedLinks</th>\n",
        "      <th>ProductName</th>\n",
        "      <th>ProductComponentName</th>\n",
        "      <th>AlertLink</th>\n",
        "      <th>Status</th>\n",
        "      <th>CompromisedEntity</th>\n",
        "      <th>Tactics</th>\n",
        "      <th>Type_y</th>\n",
        "      <th>SystemAlertId1</th>\n",
        "      <th>ExtendedProperties1</th>\n",
        "      <th>Entities1</th>\n",
        "      <th>MatchingIps</th>\n",
        "      <th>src_row_index</th>\n",
        "    </tr>\n",
        "  </thead>\n",
        "  <tbody>\n",
        "    <tr>\n",
        "      <th>0</th>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Public</td>\n",
        "      <td>None</td>\n",
        "      <td>arin</td>\n",
        "      <td>14618</td>\n",
        "      <td>3.80.0.0/12</td>\n",
        "      <td>US</td>\n",
        "      <td>2017-12-20</td>\n",
        "      <td>AMAZON-AES, US</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>[{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>US</td>\n",
        "      <td>United States</td>\n",
        "      <td>Virginia</td>\n",
        "      <td>Ashburn</td>\n",
        "      <td>-77.4728</td>\n",
        "      <td>39.0481</td>\n",
        "      <td>None</td>\n",
        "      <td>{}</td>\n",
        "      <td>geolocation</td>\n",
        "      <td>{}</td>\n",
        "      <td>...</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-11-20 03:52:17+00:00</td>\n",
        "      <td>2020-11-20 03:52:17+00:00</td>\n",
        "      <td>2020-11-20 04:06:42+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"chambresdhotesbruges.fr\\\") | wh...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"chambresdhotesbruges.fr\",\\r\\n    \"HostName\": \"c...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>45614988-e680-cbc0-4673-babf03147290</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"chambresdhotesbruges.fr\\\") | wh...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"chambresdhotesbruges.fr\",\\r\\n    \"HostName\": \"c...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "      <td>0</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>1</th>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Public</td>\n",
        "      <td>None</td>\n",
        "      <td>arin</td>\n",
        "      <td>14618</td>\n",
        "      <td>3.80.0.0/12</td>\n",
        "      <td>US</td>\n",
        "      <td>2017-12-20</td>\n",
        "      <td>AMAZON-AES, US</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>[{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>US</td>\n",
        "      <td>United States</td>\n",
        "      <td>Virginia</td>\n",
        "      <td>Ashburn</td>\n",
        "      <td>-77.4728</td>\n",
        "      <td>39.0481</td>\n",
        "      <td>None</td>\n",
        "      <td>{}</td>\n",
        "      <td>geolocation</td>\n",
        "      <td>{}</td>\n",
        "      <td>...</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-11-20 03:52:17+00:00</td>\n",
        "      <td>2020-11-20 03:52:17+00:00</td>\n",
        "      <td>2020-11-20 04:06:42+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"chambresdhotesbruges.fr\\\") | wh...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"chambresdhotesbruges.fr\",\\r\\n    \"HostName\": \"c...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>2cc59e4f-1cd3-b583-fdc2-96f1837bb0e1</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"chambresdhotesbruges.fr\\\") | wh...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"chambresdhotesbruges.fr\",\\r\\n    \"HostName\": \"c...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "      <td>0</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>2</th>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Public</td>\n",
        "      <td>None</td>\n",
        "      <td>arin</td>\n",
        "      <td>14618</td>\n",
        "      <td>3.80.0.0/12</td>\n",
        "      <td>US</td>\n",
        "      <td>2017-12-20</td>\n",
        "      <td>AMAZON-AES, US</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>[{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>US</td>\n",
        "      <td>United States</td>\n",
        "      <td>Virginia</td>\n",
        "      <td>Ashburn</td>\n",
        "      <td>-77.4728</td>\n",
        "      <td>39.0481</td>\n",
        "      <td>None</td>\n",
        "      <td>{}</td>\n",
        "      <td>geolocation</td>\n",
        "      <td>{}</td>\n",
        "      <td>...</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-11-20 03:52:20+00:00</td>\n",
        "      <td>2020-11-20 03:52:20+00:00</td>\n",
        "      <td>2020-11-20 04:06:42+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"chambresdhotesbruges.fr\\\") | wh...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"chambresdhotesbruges.fr\",\\r\\n    \"HostName\": \"c...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>ebfe31f1-bc4b-69a1-521a-84b35a681cd1</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"chambresdhotesbruges.fr\\\") | wh...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"chambresdhotesbruges.fr\",\\r\\n    \"HostName\": \"c...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "      <td>0</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>3</th>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Public</td>\n",
        "      <td>None</td>\n",
        "      <td>arin</td>\n",
        "      <td>14618</td>\n",
        "      <td>3.80.0.0/12</td>\n",
        "      <td>US</td>\n",
        "      <td>2017-12-20</td>\n",
        "      <td>AMAZON-AES, US</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>[{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>US</td>\n",
        "      <td>United States</td>\n",
        "      <td>Virginia</td>\n",
        "      <td>Ashburn</td>\n",
        "      <td>-77.4728</td>\n",
        "      <td>39.0481</td>\n",
        "      <td>None</td>\n",
        "      <td>{}</td>\n",
        "      <td>geolocation</td>\n",
        "      <td>{}</td>\n",
        "      <td>...</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-11-20 03:52:17+00:00</td>\n",
        "      <td>2020-11-20 03:52:17+00:00</td>\n",
        "      <td>2020-11-20 04:06:43+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"chambresdhotesbruges.fr\\\") | wh...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"chambresdhotesbruges.fr\",\\r\\n    \"HostName\": \"c...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>1eb1fd38-431d-a69a-bc81-955b7e675ddf</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"chambresdhotesbruges.fr\\\") | wh...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"chambresdhotesbruges.fr\",\\r\\n    \"HostName\": \"c...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "      <td>0</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>4</th>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Public</td>\n",
        "      <td>None</td>\n",
        "      <td>arin</td>\n",
        "      <td>14618</td>\n",
        "      <td>3.80.0.0/12</td>\n",
        "      <td>US</td>\n",
        "      <td>2017-12-20</td>\n",
        "      <td>AMAZON-AES, US</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>[{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>US</td>\n",
        "      <td>United States</td>\n",
        "      <td>Virginia</td>\n",
        "      <td>Ashburn</td>\n",
        "      <td>-77.4728</td>\n",
        "      <td>39.0481</td>\n",
        "      <td>None</td>\n",
        "      <td>{}</td>\n",
        "      <td>geolocation</td>\n",
        "      <td>{}</td>\n",
        "      <td>...</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-11-20 03:52:17+00:00</td>\n",
        "      <td>2020-11-20 03:52:17+00:00</td>\n",
        "      <td>2020-11-20 04:06:45+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"chambresdhotesbruges.fr\\\") | wh...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"chambresdhotesbruges.fr\",\\r\\n    \"HostName\": \"c...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>a79e3d8f-ce76-cba5-ea9a-00a89fc4b2a9</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"chambresdhotesbruges.fr\\\") | wh...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"chambresdhotesbruges.fr\",\\r\\n    \"HostName\": \"c...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "      <td>0</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>...</th>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "      <td>...</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>1592</th>\n",
        "      <td>20.55.97.123</td>\n",
        "      <td>20.55.97.123</td>\n",
        "      <td>Public</td>\n",
        "      <td>None</td>\n",
        "      <td>arin</td>\n",
        "      <td>8075</td>\n",
        "      <td>20.48.0.0/12</td>\n",
        "      <td>US</td>\n",
        "      <td>2017-10-18</td>\n",
        "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
        "      <td>20.55.97.123</td>\n",
        "      <td>[{'cidr': '20.128.0.0/16, 20.64.0.0/10, 20.40.0.0/13, 20.36.0.0/14, 20.48.0.0/12, 20.34.0.0/15, ...</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>US</td>\n",
        "      <td>United States</td>\n",
        "      <td>Virginia</td>\n",
        "      <td>Washington</td>\n",
        "      <td>-78.1539</td>\n",
        "      <td>38.7095</td>\n",
        "      <td>None</td>\n",
        "      <td>{}</td>\n",
        "      <td>geolocation</td>\n",
        "      <td>{}</td>\n",
        "      <td>...</td>\n",
        "      <td></td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2021-01-30 21:04:21.558000+00:00</td>\n",
        "      <td>2021-02-13 21:04:21.558000+00:00</td>\n",
        "      <td>2021-02-13 21:09:29.084000+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"// The query_now parameter represents the time (in UTC) at which the scheduled ...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"192.168.1.216\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  ...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Scheduled Alerts</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td></td>\n",
        "      <td>Exfiltration</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>b03ba910-9e74-49d3-4454-6338d853400b</td>\n",
        "      <td>{\\r\\n  \"Query\": \"// The query_now parameter represents the time (in UTC) at which the scheduled ...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"192.168.1.216\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  ...</td>\n",
        "      <td>[20.55.97.123]</td>\n",
        "      <td>4</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>1593</th>\n",
        "      <td>20.55.97.123</td>\n",
        "      <td>20.55.97.123</td>\n",
        "      <td>Public</td>\n",
        "      <td>None</td>\n",
        "      <td>arin</td>\n",
        "      <td>8075</td>\n",
        "      <td>20.48.0.0/12</td>\n",
        "      <td>US</td>\n",
        "      <td>2017-10-18</td>\n",
        "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
        "      <td>20.55.97.123</td>\n",
        "      <td>[{'cidr': '20.128.0.0/16, 20.64.0.0/10, 20.40.0.0/13, 20.36.0.0/14, 20.48.0.0/12, 20.34.0.0/15, ...</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>US</td>\n",
        "      <td>United States</td>\n",
        "      <td>Virginia</td>\n",
        "      <td>Washington</td>\n",
        "      <td>-78.1539</td>\n",
        "      <td>38.7095</td>\n",
        "      <td>None</td>\n",
        "      <td>{}</td>\n",
        "      <td>geolocation</td>\n",
        "      <td>{}</td>\n",
        "      <td>...</td>\n",
        "      <td></td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2021-01-30 22:04:21.558000+00:00</td>\n",
        "      <td>2021-02-13 22:04:21.558000+00:00</td>\n",
        "      <td>2021-02-13 22:09:28.540000+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"// The query_now parameter represents the time (in UTC) at which the scheduled ...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"192.168.1.216\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  ...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Scheduled Alerts</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td></td>\n",
        "      <td>Exfiltration</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>5da44cf1-5f00-b9b0-61eb-d3e5e4051478</td>\n",
        "      <td>{\\r\\n  \"Query\": \"// The query_now parameter represents the time (in UTC) at which the scheduled ...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"192.168.1.216\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  ...</td>\n",
        "      <td>[20.55.97.123]</td>\n",
        "      <td>4</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>1594</th>\n",
        "      <td>20.55.97.123</td>\n",
        "      <td>20.55.97.123</td>\n",
        "      <td>Public</td>\n",
        "      <td>None</td>\n",
        "      <td>arin</td>\n",
        "      <td>8075</td>\n",
        "      <td>20.48.0.0/12</td>\n",
        "      <td>US</td>\n",
        "      <td>2017-10-18</td>\n",
        "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
        "      <td>20.55.97.123</td>\n",
        "      <td>[{'cidr': '20.128.0.0/16, 20.64.0.0/10, 20.40.0.0/13, 20.36.0.0/14, 20.48.0.0/12, 20.34.0.0/15, ...</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>US</td>\n",
        "      <td>United States</td>\n",
        "      <td>Virginia</td>\n",
        "      <td>Washington</td>\n",
        "      <td>-78.1539</td>\n",
        "      <td>38.7095</td>\n",
        "      <td>None</td>\n",
        "      <td>{}</td>\n",
        "      <td>geolocation</td>\n",
        "      <td>{}</td>\n",
        "      <td>...</td>\n",
        "      <td></td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2021-01-31 02:04:21.558000+00:00</td>\n",
        "      <td>2021-02-14 02:04:21.558000+00:00</td>\n",
        "      <td>2021-02-14 02:09:28.799000+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"// The query_now parameter represents the time (in UTC) at which the scheduled ...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"192.168.1.216\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  ...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Scheduled Alerts</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td></td>\n",
        "      <td>Exfiltration</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>0f0aa0e7-f56a-7f90-c042-a082e33c7bc6</td>\n",
        "      <td>{\\r\\n  \"Query\": \"// The query_now parameter represents the time (in UTC) at which the scheduled ...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"192.168.1.216\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  ...</td>\n",
        "      <td>[20.55.97.123]</td>\n",
        "      <td>4</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>1595</th>\n",
        "      <td>20.55.97.123</td>\n",
        "      <td>20.55.97.123</td>\n",
        "      <td>Public</td>\n",
        "      <td>None</td>\n",
        "      <td>arin</td>\n",
        "      <td>8075</td>\n",
        "      <td>20.48.0.0/12</td>\n",
        "      <td>US</td>\n",
        "      <td>2017-10-18</td>\n",
        "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
        "      <td>20.55.97.123</td>\n",
        "      <td>[{'cidr': '20.128.0.0/16, 20.64.0.0/10, 20.40.0.0/13, 20.36.0.0/14, 20.48.0.0/12, 20.34.0.0/15, ...</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>US</td>\n",
        "      <td>United States</td>\n",
        "      <td>Virginia</td>\n",
        "      <td>Washington</td>\n",
        "      <td>-78.1539</td>\n",
        "      <td>38.7095</td>\n",
        "      <td>None</td>\n",
        "      <td>{}</td>\n",
        "      <td>geolocation</td>\n",
        "      <td>{}</td>\n",
        "      <td>...</td>\n",
        "      <td></td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2021-01-31 04:04:21.558000+00:00</td>\n",
        "      <td>2021-02-14 04:04:21.558000+00:00</td>\n",
        "      <td>2021-02-14 04:09:28.953000+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"// The query_now parameter represents the time (in UTC) at which the scheduled ...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"192.168.1.216\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  ...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Scheduled Alerts</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td></td>\n",
        "      <td>Exfiltration</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>44df015d-0414-88db-e149-18c9c6f37764</td>\n",
        "      <td>{\\r\\n  \"Query\": \"// The query_now parameter represents the time (in UTC) at which the scheduled ...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"192.168.1.216\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  ...</td>\n",
        "      <td>[20.55.97.123]</td>\n",
        "      <td>4</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>1596</th>\n",
        "      <td>20.55.97.123</td>\n",
        "      <td>20.55.97.123</td>\n",
        "      <td>Public</td>\n",
        "      <td>None</td>\n",
        "      <td>arin</td>\n",
        "      <td>8075</td>\n",
        "      <td>20.48.0.0/12</td>\n",
        "      <td>US</td>\n",
        "      <td>2017-10-18</td>\n",
        "      <td>MICROSOFT-CORP-MSN-AS-BLOCK, US</td>\n",
        "      <td>20.55.97.123</td>\n",
        "      <td>[{'cidr': '20.128.0.0/16, 20.64.0.0/10, 20.40.0.0/13, 20.36.0.0/14, 20.48.0.0/12, 20.34.0.0/15, ...</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>None</td>\n",
        "      <td>US</td>\n",
        "      <td>United States</td>\n",
        "      <td>Virginia</td>\n",
        "      <td>Washington</td>\n",
        "      <td>-78.1539</td>\n",
        "      <td>38.7095</td>\n",
        "      <td>None</td>\n",
        "      <td>{}</td>\n",
        "      <td>geolocation</td>\n",
        "      <td>{}</td>\n",
        "      <td>...</td>\n",
        "      <td></td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2021-02-09 17:25:20+00:00</td>\n",
        "      <td>2021-02-10 01:04:24+00:00</td>\n",
        "      <td>2021-02-10 01:09:28+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"// The query_now parameter represents the time (in UTC) at which the scheduled ...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Url\": \"https://bit.ly/3htG84T\",\\r\\n    \"Type\": \"url\"\\r\\n  },...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Scheduled Alerts</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td></td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>9efcecb6-1a26-eb48-81ed-f6268080ac60</td>\n",
        "      <td>{\\r\\n  \"Query\": \"// The query_now parameter represents the time (in UTC) at which the scheduled ...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Url\": \"https://bit.ly/3htG84T\",\\r\\n    \"Type\": \"url\"\\r\\n  },...</td>\n",
        "      <td>[20.55.97.123]</td>\n",
        "      <td>4</td>\n",
        "    </tr>\n",
        "  </tbody>\n",
        "</table>\n",
        "<p>1597 rows × 64 columns</p>\n",
        "</div>"
      ],
      "text/plain": [
        "                IP            ip  result   nir asn_registry    asn  \\\n",
        "0      3.88.48.125   3.88.48.125  Public  None         arin  14618   \n",
        "1      3.88.48.125   3.88.48.125  Public  None         arin  14618   \n",
        "2      3.88.48.125   3.88.48.125  Public  None         arin  14618   \n",
        "3      3.88.48.125   3.88.48.125  Public  None         arin  14618   \n",
        "4      3.88.48.125   3.88.48.125  Public  None         arin  14618   \n",
        "...            ...           ...     ...   ...          ...    ...   \n",
        "1592  20.55.97.123  20.55.97.123  Public  None         arin   8075   \n",
        "1593  20.55.97.123  20.55.97.123  Public  None         arin   8075   \n",
        "1594  20.55.97.123  20.55.97.123  Public  None         arin   8075   \n",
        "1595  20.55.97.123  20.55.97.123  Public  None         arin   8075   \n",
        "1596  20.55.97.123  20.55.97.123  Public  None         arin   8075   \n",
        "\n",
        "          asn_cidr asn_country_code    asn_date  \\\n",
        "0      3.80.0.0/12               US  2017-12-20   \n",
        "1      3.80.0.0/12               US  2017-12-20   \n",
        "2      3.80.0.0/12               US  2017-12-20   \n",
        "3      3.80.0.0/12               US  2017-12-20   \n",
        "4      3.80.0.0/12               US  2017-12-20   \n",
        "...            ...              ...         ...   \n",
        "1592  20.48.0.0/12               US  2017-10-18   \n",
        "1593  20.48.0.0/12               US  2017-10-18   \n",
        "1594  20.48.0.0/12               US  2017-10-18   \n",
        "1595  20.48.0.0/12               US  2017-10-18   \n",
        "1596  20.48.0.0/12               US  2017-10-18   \n",
        "\n",
        "                      asn_description         query  \\\n",
        "0                      AMAZON-AES, US   3.88.48.125   \n",
        "1                      AMAZON-AES, US   3.88.48.125   \n",
        "2                      AMAZON-AES, US   3.88.48.125   \n",
        "3                      AMAZON-AES, US   3.88.48.125   \n",
        "4                      AMAZON-AES, US   3.88.48.125   \n",
        "...                               ...           ...   \n",
        "1592  MICROSOFT-CORP-MSN-AS-BLOCK, US  20.55.97.123   \n",
        "1593  MICROSOFT-CORP-MSN-AS-BLOCK, US  20.55.97.123   \n",
        "1594  MICROSOFT-CORP-MSN-AS-BLOCK, US  20.55.97.123   \n",
        "1595  MICROSOFT-CORP-MSN-AS-BLOCK, US  20.55.97.123   \n",
        "1596  MICROSOFT-CORP-MSN-AS-BLOCK, US  20.55.97.123   \n",
        "\n",
        "                                                                                                     nets  \\\n",
        "0     [{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...   \n",
        "1     [{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...   \n",
        "2     [{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...   \n",
        "3     [{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...   \n",
        "4     [{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...   \n",
        "...                                                                                                   ...   \n",
        "1592  [{'cidr': '20.128.0.0/16, 20.64.0.0/10, 20.40.0.0/13, 20.36.0.0/14, 20.48.0.0/12, 20.34.0.0/15, ...   \n",
        "1593  [{'cidr': '20.128.0.0/16, 20.64.0.0/10, 20.40.0.0/13, 20.36.0.0/14, 20.48.0.0/12, 20.34.0.0/15, ...   \n",
        "1594  [{'cidr': '20.128.0.0/16, 20.64.0.0/10, 20.40.0.0/13, 20.36.0.0/14, 20.48.0.0/12, 20.34.0.0/15, ...   \n",
        "1595  [{'cidr': '20.128.0.0/16, 20.64.0.0/10, 20.40.0.0/13, 20.36.0.0/14, 20.48.0.0/12, 20.34.0.0/15, ...   \n",
        "1596  [{'cidr': '20.128.0.0/16, 20.64.0.0/10, 20.40.0.0/13, 20.36.0.0/14, 20.48.0.0/12, 20.34.0.0/15, ...   \n",
        "\n",
        "       raw referral raw_referral CountryCode    CountryName     State  \\\n",
        "0     None     None         None          US  United States  Virginia   \n",
        "1     None     None         None          US  United States  Virginia   \n",
        "2     None     None         None          US  United States  Virginia   \n",
        "3     None     None         None          US  United States  Virginia   \n",
        "4     None     None         None          US  United States  Virginia   \n",
        "...    ...      ...          ...         ...            ...       ...   \n",
        "1592  None     None         None          US  United States  Virginia   \n",
        "1593  None     None         None          US  United States  Virginia   \n",
        "1594  None     None         None          US  United States  Virginia   \n",
        "1595  None     None         None          US  United States  Virginia   \n",
        "1596  None     None         None          US  United States  Virginia   \n",
        "\n",
        "            City  Longitude  Latitude   Asn edges       Type_x AdditionalData  \\\n",
        "0        Ashburn   -77.4728   39.0481  None    {}  geolocation             {}   \n",
        "1        Ashburn   -77.4728   39.0481  None    {}  geolocation             {}   \n",
        "2        Ashburn   -77.4728   39.0481  None    {}  geolocation             {}   \n",
        "3        Ashburn   -77.4728   39.0481  None    {}  geolocation             {}   \n",
        "4        Ashburn   -77.4728   39.0481  None    {}  geolocation             {}   \n",
        "...          ...        ...       ...   ...   ...          ...            ...   \n",
        "1592  Washington   -78.1539   38.7095  None    {}  geolocation             {}   \n",
        "1593  Washington   -78.1539   38.7095  None    {}  geolocation             {}   \n",
        "1594  Washington   -78.1539   38.7095  None    {}  geolocation             {}   \n",
        "1595  Washington   -78.1539   38.7095  None    {}  geolocation             {}   \n",
        "1596  Washington   -78.1539   38.7095  None    {}  geolocation             {}   \n",
        "\n",
        "      ... ConfidenceLevel ConfidenceScore IsIncident  \\\n",
        "0     ...              83             NaN      False   \n",
        "1     ...              83             NaN      False   \n",
        "2     ...              83             NaN      False   \n",
        "3     ...              83             NaN      False   \n",
        "4     ...              83             NaN      False   \n",
        "...   ...             ...             ...        ...   \n",
        "1592  ...                             NaN      False   \n",
        "1593  ...                             NaN      False   \n",
        "1594  ...                             NaN      False   \n",
        "1595  ...                             NaN      False   \n",
        "1596  ...                             NaN      False   \n",
        "\n",
        "                         StartTimeUtc                       EndTimeUtc  \\\n",
        "0           2020-11-20 03:52:17+00:00        2020-11-20 03:52:17+00:00   \n",
        "1           2020-11-20 03:52:17+00:00        2020-11-20 03:52:17+00:00   \n",
        "2           2020-11-20 03:52:20+00:00        2020-11-20 03:52:20+00:00   \n",
        "3           2020-11-20 03:52:17+00:00        2020-11-20 03:52:17+00:00   \n",
        "4           2020-11-20 03:52:17+00:00        2020-11-20 03:52:17+00:00   \n",
        "...                               ...                              ...   \n",
        "1592 2021-01-30 21:04:21.558000+00:00 2021-02-13 21:04:21.558000+00:00   \n",
        "1593 2021-01-30 22:04:21.558000+00:00 2021-02-13 22:04:21.558000+00:00   \n",
        "1594 2021-01-31 02:04:21.558000+00:00 2021-02-14 02:04:21.558000+00:00   \n",
        "1595 2021-01-31 04:04:21.558000+00:00 2021-02-14 04:04:21.558000+00:00   \n",
        "1596        2021-02-09 17:25:20+00:00        2021-02-10 01:04:24+00:00   \n",
        "\n",
        "                    ProcessingEndTime RemediationSteps  \\\n",
        "0           2020-11-20 04:06:42+00:00                    \n",
        "1           2020-11-20 04:06:42+00:00                    \n",
        "2           2020-11-20 04:06:42+00:00                    \n",
        "3           2020-11-20 04:06:43+00:00                    \n",
        "4           2020-11-20 04:06:45+00:00                    \n",
        "...                               ...              ...   \n",
        "1592 2021-02-13 21:09:29.084000+00:00                    \n",
        "1593 2021-02-13 22:09:28.540000+00:00                    \n",
        "1594 2021-02-14 02:09:28.799000+00:00                    \n",
        "1595 2021-02-14 04:09:28.953000+00:00                    \n",
        "1596        2021-02-10 01:09:28+00:00                    \n",
        "\n",
        "                                                                                       ExtendedProperties  \\\n",
        "0     {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"chambresdhotesbruges.fr\\\") | wh...   \n",
        "1     {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"chambresdhotesbruges.fr\\\") | wh...   \n",
        "2     {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"chambresdhotesbruges.fr\\\") | wh...   \n",
        "3     {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"chambresdhotesbruges.fr\\\") | wh...   \n",
        "4     {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"chambresdhotesbruges.fr\\\") | wh...   \n",
        "...                                                                                                   ...   \n",
        "1592  {\\r\\n  \"Query\": \"// The query_now parameter represents the time (in UTC) at which the scheduled ...   \n",
        "1593  {\\r\\n  \"Query\": \"// The query_now parameter represents the time (in UTC) at which the scheduled ...   \n",
        "1594  {\\r\\n  \"Query\": \"// The query_now parameter represents the time (in UTC) at which the scheduled ...   \n",
        "1595  {\\r\\n  \"Query\": \"// The query_now parameter represents the time (in UTC) at which the scheduled ...   \n",
        "1596  {\\r\\n  \"Query\": \"// The query_now parameter represents the time (in UTC) at which the scheduled ...   \n",
        "\n",
        "                                                                                                 Entities  \\\n",
        "0     [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"chambresdhotesbruges.fr\",\\r\\n    \"HostName\": \"c...   \n",
        "1     [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"chambresdhotesbruges.fr\",\\r\\n    \"HostName\": \"c...   \n",
        "2     [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"chambresdhotesbruges.fr\",\\r\\n    \"HostName\": \"c...   \n",
        "3     [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"chambresdhotesbruges.fr\",\\r\\n    \"HostName\": \"c...   \n",
        "4     [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"chambresdhotesbruges.fr\",\\r\\n    \"HostName\": \"c...   \n",
        "...                                                                                                   ...   \n",
        "1592  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"192.168.1.216\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  ...   \n",
        "1593  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"192.168.1.216\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  ...   \n",
        "1594  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"192.168.1.216\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  ...   \n",
        "1595  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"192.168.1.216\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  ...   \n",
        "1596  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Url\": \"https://bit.ly/3htG84T\",\\r\\n    \"Type\": \"url\"\\r\\n  },...   \n",
        "\n",
        "     SourceSystem               WorkspaceSubscriptionId  \\\n",
        "0       Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f   \n",
        "1       Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f   \n",
        "2       Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f   \n",
        "3       Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f   \n",
        "4       Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f   \n",
        "...           ...                                   ...   \n",
        "1592    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f   \n",
        "1593    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f   \n",
        "1594    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f   \n",
        "1595    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f   \n",
        "1596    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f   \n",
        "\n",
        "     WorkspaceResourceGroup ExtendedLinks     ProductName  \\\n",
        "0                       soc                Microsoft Sentinel   \n",
        "1                       soc                Microsoft Sentinel   \n",
        "2                       soc                Microsoft Sentinel   \n",
        "3                       soc                Microsoft Sentinel   \n",
        "4                       soc                Microsoft Sentinel   \n",
        "...                     ...           ...             ...   \n",
        "1592                    soc                Microsoft Sentinel   \n",
        "1593                    soc                Microsoft Sentinel   \n",
        "1594                    soc                Microsoft Sentinel   \n",
        "1595                    soc                Microsoft Sentinel   \n",
        "1596                    soc                Microsoft Sentinel   \n",
        "\n",
        "                         ProductComponentName  AlertLink  Status  \\\n",
        "0     Microsoft Threat Intelligence Analytics                New   \n",
        "1     Microsoft Threat Intelligence Analytics                New   \n",
        "2     Microsoft Threat Intelligence Analytics                New   \n",
        "3     Microsoft Threat Intelligence Analytics                New   \n",
        "4     Microsoft Threat Intelligence Analytics                New   \n",
        "...                                       ...        ...     ...   \n",
        "1592                         Scheduled Alerts                New   \n",
        "1593                         Scheduled Alerts                New   \n",
        "1594                         Scheduled Alerts                New   \n",
        "1595                         Scheduled Alerts                New   \n",
        "1596                         Scheduled Alerts                New   \n",
        "\n",
        "     CompromisedEntity       Tactics         Type_y  \\\n",
        "0          3.88.48.125       Unknown  SecurityAlert   \n",
        "1          3.88.48.125       Unknown  SecurityAlert   \n",
        "2          3.88.48.125       Unknown  SecurityAlert   \n",
        "3          3.88.48.125       Unknown  SecurityAlert   \n",
        "4          3.88.48.125       Unknown  SecurityAlert   \n",
        "...                ...           ...            ...   \n",
        "1592                    Exfiltration  SecurityAlert   \n",
        "1593                    Exfiltration  SecurityAlert   \n",
        "1594                    Exfiltration  SecurityAlert   \n",
        "1595                    Exfiltration  SecurityAlert   \n",
        "1596                         Unknown  SecurityAlert   \n",
        "\n",
        "                            SystemAlertId1  \\\n",
        "0     45614988-e680-cbc0-4673-babf03147290   \n",
        "1     2cc59e4f-1cd3-b583-fdc2-96f1837bb0e1   \n",
        "2     ebfe31f1-bc4b-69a1-521a-84b35a681cd1   \n",
        "3     1eb1fd38-431d-a69a-bc81-955b7e675ddf   \n",
        "4     a79e3d8f-ce76-cba5-ea9a-00a89fc4b2a9   \n",
        "...                                    ...   \n",
        "1592  b03ba910-9e74-49d3-4454-6338d853400b   \n",
        "1593  5da44cf1-5f00-b9b0-61eb-d3e5e4051478   \n",
        "1594  0f0aa0e7-f56a-7f90-c042-a082e33c7bc6   \n",
        "1595  44df015d-0414-88db-e149-18c9c6f37764   \n",
        "1596  9efcecb6-1a26-eb48-81ed-f6268080ac60   \n",
        "\n",
        "                                                                                      ExtendedProperties1  \\\n",
        "0     {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"chambresdhotesbruges.fr\\\") | wh...   \n",
        "1     {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"chambresdhotesbruges.fr\\\") | wh...   \n",
        "2     {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"chambresdhotesbruges.fr\\\") | wh...   \n",
        "3     {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"chambresdhotesbruges.fr\\\") | wh...   \n",
        "4     {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"chambresdhotesbruges.fr\\\") | wh...   \n",
        "...                                                                                                   ...   \n",
        "1592  {\\r\\n  \"Query\": \"// The query_now parameter represents the time (in UTC) at which the scheduled ...   \n",
        "1593  {\\r\\n  \"Query\": \"// The query_now parameter represents the time (in UTC) at which the scheduled ...   \n",
        "1594  {\\r\\n  \"Query\": \"// The query_now parameter represents the time (in UTC) at which the scheduled ...   \n",
        "1595  {\\r\\n  \"Query\": \"// The query_now parameter represents the time (in UTC) at which the scheduled ...   \n",
        "1596  {\\r\\n  \"Query\": \"// The query_now parameter represents the time (in UTC) at which the scheduled ...   \n",
        "\n",
        "                                                                                                Entities1  \\\n",
        "0     [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"chambresdhotesbruges.fr\",\\r\\n    \"HostName\": \"c...   \n",
        "1     [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"chambresdhotesbruges.fr\",\\r\\n    \"HostName\": \"c...   \n",
        "2     [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"chambresdhotesbruges.fr\",\\r\\n    \"HostName\": \"c...   \n",
        "3     [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"chambresdhotesbruges.fr\",\\r\\n    \"HostName\": \"c...   \n",
        "4     [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"chambresdhotesbruges.fr\",\\r\\n    \"HostName\": \"c...   \n",
        "...                                                                                                   ...   \n",
        "1592  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"192.168.1.216\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  ...   \n",
        "1593  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"192.168.1.216\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  ...   \n",
        "1594  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"192.168.1.216\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  ...   \n",
        "1595  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"192.168.1.216\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  ...   \n",
        "1596  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Url\": \"https://bit.ly/3htG84T\",\\r\\n    \"Type\": \"url\"\\r\\n  },...   \n",
        "\n",
        "         MatchingIps src_row_index  \n",
        "0      [3.88.48.125]             0  \n",
        "1      [3.88.48.125]             0  \n",
        "2      [3.88.48.125]             0  \n",
        "3      [3.88.48.125]             0  \n",
        "4      [3.88.48.125]             0  \n",
        "...              ...           ...  \n",
        "1592  [20.55.97.123]             4  \n",
        "1593  [20.55.97.123]             4  \n",
        "1594  [20.55.97.123]             4  \n",
        "1595  [20.55.97.123]             4  \n",
        "1596  [20.55.97.123]             4  \n",
        "\n",
        "[1597 rows x 64 columns]"
      ]
     },
     "execution_count": 61,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# %%debug\n",
    "ip_test_df.mp_pivot.run(entities.IpAddress.AzureSentinel.SecurityAlert_list_alerts_for_ip, source_ip_list=\"ip\", join=\"left\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Inline filtering and `tee` function\n",
    "\n",
    "Save intermediate results to a DataFrame"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 50,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<h3>Geo Lookup</h3>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>IP</th>\n",
       "      <th>City</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>3.88.48.125</td>\n",
       "      <td>Ashburn</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "            IP     City\n",
       "0  3.88.48.125  Ashburn"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
        "<div>\n",
        "<style scoped>\n",
        "    .dataframe tbody tr th:only-of-type {\n",
        "        vertical-align: middle;\n",
        "    }\n",
        "\n",
        "    .dataframe tbody tr th {\n",
        "        vertical-align: top;\n",
        "    }\n",
        "\n",
        "    .dataframe thead th {\n",
        "        text-align: right;\n",
        "    }\n",
        "</style>\n",
        "<table border=\"1\" class=\"dataframe\">\n",
        "  <thead>\n",
        "    <tr style=\"text-align: right;\">\n",
        "      <th></th>\n",
        "      <th>TenantId</th>\n",
        "      <th>TimeGenerated</th>\n",
        "      <th>AlertDisplayName</th>\n",
        "      <th>AlertName</th>\n",
        "      <th>Severity</th>\n",
        "      <th>Description</th>\n",
        "      <th>ProviderName</th>\n",
        "      <th>VendorName</th>\n",
        "      <th>VendorOriginalId</th>\n",
        "      <th>SystemAlertId</th>\n",
        "      <th>ResourceId</th>\n",
        "      <th>SourceComputerId</th>\n",
        "      <th>AlertType</th>\n",
        "      <th>ConfidenceLevel</th>\n",
        "      <th>ConfidenceScore</th>\n",
        "      <th>IsIncident</th>\n",
        "      <th>StartTimeUtc</th>\n",
        "      <th>EndTimeUtc</th>\n",
        "      <th>ProcessingEndTime</th>\n",
        "      <th>RemediationSteps</th>\n",
        "      <th>ExtendedProperties</th>\n",
        "      <th>Entities</th>\n",
        "      <th>SourceSystem</th>\n",
        "      <th>WorkspaceSubscriptionId</th>\n",
        "      <th>WorkspaceResourceGroup</th>\n",
        "      <th>ExtendedLinks</th>\n",
        "      <th>ProductName</th>\n",
        "      <th>ProductComponentName</th>\n",
        "      <th>AlertLink</th>\n",
        "      <th>Status</th>\n",
        "      <th>CompromisedEntity</th>\n",
        "      <th>Tactics</th>\n",
        "      <th>Type</th>\n",
        "      <th>SystemAlertId1</th>\n",
        "      <th>ExtendedProperties1</th>\n",
        "      <th>Entities1</th>\n",
        "      <th>MatchingIps</th>\n",
        "    </tr>\n",
        "  </thead>\n",
        "  <tbody>\n",
        "    <tr>\n",
        "      <th>0</th>\n",
        "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
        "      <td>2020-12-23 14:08:12+00:00</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td>Medium</td>\n",
        "      <td>Microsoft threat intelligence analytic has detected Blocked communication to a known WatchList d...</td>\n",
        "      <td>Threat Intelligence Alerts</td>\n",
        "      <td>Microsoft</td>\n",
        "      <td>91d806d3-6b6f-4e5c-a78f-e674d602be51</td>\n",
        "      <td>625ff9af-dddc-0cf8-9d4b-e79067fa2e71</td>\n",
        "      <td></td>\n",
        "      <td></td>\n",
        "      <td>ThreatIntelligence</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 14:08:15+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>625ff9af-dddc-0cf8-9d4b-e79067fa2e71</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>1</th>\n",
        "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
        "      <td>2020-12-23 14:08:12+00:00</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td>Medium</td>\n",
        "      <td>Microsoft threat intelligence analytic has detected Blocked communication to a known WatchList d...</td>\n",
        "      <td>Threat Intelligence Alerts</td>\n",
        "      <td>Microsoft</td>\n",
        "      <td>173063c4-10dd-4dd2-9e4f-ec5ed596ec54</td>\n",
        "      <td>c977f904-ab30-d57e-986f-9d6ebf72771b</td>\n",
        "      <td></td>\n",
        "      <td></td>\n",
        "      <td>ThreatIntelligence</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 14:08:15+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>c977f904-ab30-d57e-986f-9d6ebf72771b</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>2</th>\n",
        "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
        "      <td>2020-12-23 14:08:12+00:00</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td>Medium</td>\n",
        "      <td>Microsoft threat intelligence analytic has detected Blocked communication to a known WatchList d...</td>\n",
        "      <td>Threat Intelligence Alerts</td>\n",
        "      <td>Microsoft</td>\n",
        "      <td>58b2cda2-11c6-42b8-b6f1-72751cad8f38</td>\n",
        "      <td>9ee547e4-cba1-47d1-e1f9-87247b693a52</td>\n",
        "      <td></td>\n",
        "      <td></td>\n",
        "      <td>ThreatIntelligence</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 14:08:15+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>9ee547e4-cba1-47d1-e1f9-87247b693a52</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>3</th>\n",
        "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
        "      <td>2020-12-23 14:08:12+00:00</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td>Medium</td>\n",
        "      <td>Microsoft threat intelligence analytic has detected Blocked communication to a known WatchList d...</td>\n",
        "      <td>Threat Intelligence Alerts</td>\n",
        "      <td>Microsoft</td>\n",
        "      <td>e945f91e-5726-4581-8564-4c04e5414a58</td>\n",
        "      <td>83a0e08a-1adb-ef75-1c56-f6c9ce25ca69</td>\n",
        "      <td></td>\n",
        "      <td></td>\n",
        "      <td>ThreatIntelligence</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 14:08:16+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>83a0e08a-1adb-ef75-1c56-f6c9ce25ca69</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>4</th>\n",
        "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
        "      <td>2020-12-23 13:53:46+00:00</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td>Medium</td>\n",
        "      <td>Microsoft threat intelligence analytic has detected Blocked communication to a known WatchList d...</td>\n",
        "      <td>Threat Intelligence Alerts</td>\n",
        "      <td>Microsoft</td>\n",
        "      <td>a95aaf62-9628-418b-8f5f-0f1f26dcdc13</td>\n",
        "      <td>fde729f6-674b-997a-17eb-e4e7d2b3690d</td>\n",
        "      <td></td>\n",
        "      <td></td>\n",
        "      <td>ThreatIntelligence</td>\n",
        "      <td>83</td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 13:48:23+00:00</td>\n",
        "      <td>2020-12-23 13:53:47+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Microsoft Threat Intelligence Analytics</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td>3.88.48.125</td>\n",
        "      <td>Unknown</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>fde729f6-674b-997a-17eb-e4e7d2b3690d</td>\n",
        "      <td>{\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "    </tr>\n",
        "  </tbody>\n",
        "</table>\n",
        "</div>"
      ],
      "text/plain": [
        "                               TenantId             TimeGenerated  \\\n",
        "0  8ecf8077-cf51-4820-aadd-14040956f35d 2020-12-23 14:08:12+00:00   \n",
        "1  8ecf8077-cf51-4820-aadd-14040956f35d 2020-12-23 14:08:12+00:00   \n",
        "2  8ecf8077-cf51-4820-aadd-14040956f35d 2020-12-23 14:08:12+00:00   \n",
        "3  8ecf8077-cf51-4820-aadd-14040956f35d 2020-12-23 14:08:12+00:00   \n",
        "4  8ecf8077-cf51-4820-aadd-14040956f35d 2020-12-23 13:53:46+00:00   \n",
        "\n",
        "                          AlertDisplayName  \\\n",
        "0  Microsoft Threat Intelligence Analytics   \n",
        "1  Microsoft Threat Intelligence Analytics   \n",
        "2  Microsoft Threat Intelligence Analytics   \n",
        "3  Microsoft Threat Intelligence Analytics   \n",
        "4  Microsoft Threat Intelligence Analytics   \n",
        "\n",
        "                                 AlertName Severity  \\\n",
        "0  Microsoft Threat Intelligence Analytics   Medium   \n",
        "1  Microsoft Threat Intelligence Analytics   Medium   \n",
        "2  Microsoft Threat Intelligence Analytics   Medium   \n",
        "3  Microsoft Threat Intelligence Analytics   Medium   \n",
        "4  Microsoft Threat Intelligence Analytics   Medium   \n",
        "\n",
        "                                                                                           Description  \\\n",
        "0  Microsoft threat intelligence analytic has detected Blocked communication to a known WatchList d...   \n",
        "1  Microsoft threat intelligence analytic has detected Blocked communication to a known WatchList d...   \n",
        "2  Microsoft threat intelligence analytic has detected Blocked communication to a known WatchList d...   \n",
        "3  Microsoft threat intelligence analytic has detected Blocked communication to a known WatchList d...   \n",
        "4  Microsoft threat intelligence analytic has detected Blocked communication to a known WatchList d...   \n",
        "\n",
        "                 ProviderName VendorName  \\\n",
        "0  Threat Intelligence Alerts  Microsoft   \n",
        "1  Threat Intelligence Alerts  Microsoft   \n",
        "2  Threat Intelligence Alerts  Microsoft   \n",
        "3  Threat Intelligence Alerts  Microsoft   \n",
        "4  Threat Intelligence Alerts  Microsoft   \n",
        "\n",
        "                       VendorOriginalId                         SystemAlertId  \\\n",
        "0  91d806d3-6b6f-4e5c-a78f-e674d602be51  625ff9af-dddc-0cf8-9d4b-e79067fa2e71   \n",
        "1  173063c4-10dd-4dd2-9e4f-ec5ed596ec54  c977f904-ab30-d57e-986f-9d6ebf72771b   \n",
        "2  58b2cda2-11c6-42b8-b6f1-72751cad8f38  9ee547e4-cba1-47d1-e1f9-87247b693a52   \n",
        "3  e945f91e-5726-4581-8564-4c04e5414a58  83a0e08a-1adb-ef75-1c56-f6c9ce25ca69   \n",
        "4  a95aaf62-9628-418b-8f5f-0f1f26dcdc13  fde729f6-674b-997a-17eb-e4e7d2b3690d   \n",
        "\n",
        "  ResourceId SourceComputerId           AlertType ConfidenceLevel  \\\n",
        "0                              ThreatIntelligence              83   \n",
        "1                              ThreatIntelligence              83   \n",
        "2                              ThreatIntelligence              83   \n",
        "3                              ThreatIntelligence              83   \n",
        "4                              ThreatIntelligence              83   \n",
        "\n",
        "   ConfidenceScore  IsIncident              StartTimeUtc  \\\n",
        "0              NaN       False 2020-12-23 13:48:23+00:00   \n",
        "1              NaN       False 2020-12-23 13:48:23+00:00   \n",
        "2              NaN       False 2020-12-23 13:48:23+00:00   \n",
        "3              NaN       False 2020-12-23 13:48:23+00:00   \n",
        "4              NaN       False 2020-12-23 13:48:23+00:00   \n",
        "\n",
        "                 EndTimeUtc         ProcessingEndTime RemediationSteps  \\\n",
        "0 2020-12-23 13:48:23+00:00 2020-12-23 14:08:15+00:00                    \n",
        "1 2020-12-23 13:48:23+00:00 2020-12-23 14:08:15+00:00                    \n",
        "2 2020-12-23 13:48:23+00:00 2020-12-23 14:08:15+00:00                    \n",
        "3 2020-12-23 13:48:23+00:00 2020-12-23 14:08:16+00:00                    \n",
        "4 2020-12-23 13:48:23+00:00 2020-12-23 13:53:47+00:00                    \n",
        "\n",
        "                                                                                    ExtendedProperties  \\\n",
        "0  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "1  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "2  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "3  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "4  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "\n",
        "                                                                                              Entities  \\\n",
        "0  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "1  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "2  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "3  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "4  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "\n",
        "  SourceSystem               WorkspaceSubscriptionId WorkspaceResourceGroup  \\\n",
        "0    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "1    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "2    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "3    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "4    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "\n",
        "  ExtendedLinks     ProductName                     ProductComponentName  \\\n",
        "0                Microsoft Sentinel  Microsoft Threat Intelligence Analytics   \n",
        "1                Microsoft Sentinel  Microsoft Threat Intelligence Analytics   \n",
        "2                Microsoft Sentinel  Microsoft Threat Intelligence Analytics   \n",
        "3                Microsoft Sentinel  Microsoft Threat Intelligence Analytics   \n",
        "4                Microsoft Sentinel  Microsoft Threat Intelligence Analytics   \n",
        "\n",
        "  AlertLink Status CompromisedEntity  Tactics           Type  \\\n",
        "0              New       3.88.48.125  Unknown  SecurityAlert   \n",
        "1              New       3.88.48.125  Unknown  SecurityAlert   \n",
        "2              New       3.88.48.125  Unknown  SecurityAlert   \n",
        "3              New       3.88.48.125  Unknown  SecurityAlert   \n",
        "4              New       3.88.48.125  Unknown  SecurityAlert   \n",
        "\n",
        "                         SystemAlertId1  \\\n",
        "0  625ff9af-dddc-0cf8-9d4b-e79067fa2e71   \n",
        "1  c977f904-ab30-d57e-986f-9d6ebf72771b   \n",
        "2  9ee547e4-cba1-47d1-e1f9-87247b693a52   \n",
        "3  83a0e08a-1adb-ef75-1c56-f6c9ce25ca69   \n",
        "4  fde729f6-674b-997a-17eb-e4e7d2b3690d   \n",
        "\n",
        "                                                                                   ExtendedProperties1  \\\n",
        "0  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "1  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "2  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "3  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "4  {\\r\\n  \"Query\": \"CommonSecurityLog| where RequestURL hasprefix(\\\"www.arboretum.hu\\\") | where Tim...   \n",
        "\n",
        "                                                                                             Entities1  \\\n",
        "0  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "1  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "2  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "3  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "4  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"DnsDomain\": \"www.arboretum.hu\",\\r\\n    \"HostName\": \"www.arbo...   \n",
        "\n",
        "     MatchingIps  \n",
        "0  [3.88.48.125]  \n",
        "1  [3.88.48.125]  \n",
        "2  [3.88.48.125]  \n",
        "3  [3.88.48.125]  \n",
        "4  [3.88.48.125]  "
      ]
     },
     "execution_count": 50,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "(\n",
    "    ips_df\n",
    "    .mp_pivot.run(entities.IpAddress.util.ip_type, column=\"IP\", join=\"inner\")\n",
    "    .query(\"result == 'Public'\").head(10)\n",
    "    .mp_pivot.run(entities.IpAddress.util.whois, column=\"ip\", join=\"left\")\n",
    "    .mp_pivot.tee(var_name=\"whois_df\", clobber=True)\n",
    "    .mp_pivot.run(entities.IpAddress.util.geoloc, column=\"ip\", join=\"left\")\n",
    "    .mp_pivot.display(title=\"Geo Lookup\", cols=[\"IP\", \"City\"])  # << display an intermediate result\n",
    "    .mp_pivot.run(entities.IpAddress.AzureSentinel.SecurityAlert_list_alerts_for_ip, source_ip_list=\"ip\")\n",
    ").head(5)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Add a display function"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "(\n",
    "    ips_df\n",
    "    .mp_pivot.run(entities.IpAddress.util.ip_type, column=\"IP\", join=\"inner\")\n",
    "    .query(\"result == 'Public'\").head(5)\n",
    "    .mp_pivot.run(entities.IpAddress.util.whois, column=\"ip\", join=\"left\")\n",
    "    .mp_pivot.run(entities.IpAddress.util.geoloc, column=\"ip\", join=\"left\")\n",
    "    .mp_pivot.display(title=\"Geo Lookup\", cols=[\"IP\", \"City\"])  # << display an intermediate result\n",
    "    .mp_pivot.run(entities.IpAddress.AzureSentinel.SecurityAlert_list_alerts_for_ip, source_ip_list=\"ip\")\n",
    "    .mp_pivot.display(title=\"Alerts Sample\", head=5) \n",
    "    .mp_timeline.plot(\n",
    "        title=\"IPs with alerts\",\n",
    "        source_columns=[\"AlertName\", \"MatchingIps\"],\n",
    "    )\n",
    ");"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 52,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<h3>Geo Lookup</h3>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>IP</th>\n",
       "      <th>City</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>3.88.48.125</td>\n",
       "      <td>Ashburn</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "            IP     City\n",
       "0  3.88.48.125  Ashburn"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<h3>Alerts Sample</h3>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
        "<div>\n",
        "<style scoped>\n",
        "    .dataframe tbody tr th:only-of-type {\n",
        "        vertical-align: middle;\n",
        "    }\n",
        "\n",
        "    .dataframe tbody tr th {\n",
        "        vertical-align: top;\n",
        "    }\n",
        "\n",
        "    .dataframe thead th {\n",
        "        text-align: right;\n",
        "    }\n",
        "</style>\n",
        "<table border=\"1\" class=\"dataframe\">\n",
        "  <thead>\n",
        "    <tr style=\"text-align: right;\">\n",
        "      <th></th>\n",
        "      <th>TenantId</th>\n",
        "      <th>TimeGenerated</th>\n",
        "      <th>AlertDisplayName</th>\n",
        "      <th>AlertName</th>\n",
        "      <th>Severity</th>\n",
        "      <th>Description</th>\n",
        "      <th>ProviderName</th>\n",
        "      <th>VendorName</th>\n",
        "      <th>VendorOriginalId</th>\n",
        "      <th>SystemAlertId</th>\n",
        "      <th>ResourceId</th>\n",
        "      <th>SourceComputerId</th>\n",
        "      <th>AlertType</th>\n",
        "      <th>ConfidenceLevel</th>\n",
        "      <th>ConfidenceScore</th>\n",
        "      <th>IsIncident</th>\n",
        "      <th>StartTimeUtc</th>\n",
        "      <th>EndTimeUtc</th>\n",
        "      <th>ProcessingEndTime</th>\n",
        "      <th>RemediationSteps</th>\n",
        "      <th>ExtendedProperties</th>\n",
        "      <th>Entities</th>\n",
        "      <th>SourceSystem</th>\n",
        "      <th>WorkspaceSubscriptionId</th>\n",
        "      <th>WorkspaceResourceGroup</th>\n",
        "      <th>ExtendedLinks</th>\n",
        "      <th>ProductName</th>\n",
        "      <th>ProductComponentName</th>\n",
        "      <th>AlertLink</th>\n",
        "      <th>Status</th>\n",
        "      <th>CompromisedEntity</th>\n",
        "      <th>Tactics</th>\n",
        "      <th>Type</th>\n",
        "      <th>SystemAlertId1</th>\n",
        "      <th>ExtendedProperties1</th>\n",
        "      <th>Entities1</th>\n",
        "      <th>MatchingIps</th>\n",
        "    </tr>\n",
        "  </thead>\n",
        "  <tbody>\n",
        "    <tr>\n",
        "      <th>0</th>\n",
        "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
        "      <td>2020-12-19 19:10:17+00:00</td>\n",
        "      <td>Possible contact with a domain generated by a DGA</td>\n",
        "      <td>Possible contact with a domain generated by a DGA</td>\n",
        "      <td>Medium</td>\n",
        "      <td>Identifies contacts with domains names in CommonSecurityLog that might have been generated by a ...</td>\n",
        "      <td>ASI Scheduled Alerts</td>\n",
        "      <td>Microsoft</td>\n",
        "      <td>2e06b22f-2022-4cc5-8db4-da726aaca8c7</td>\n",
        "      <td>fdc54c12-efba-38b0-8379-f06d7fbfd34a</td>\n",
        "      <td></td>\n",
        "      <td></td>\n",
        "      <td>8ecf8077-cf51-4820-aadd-14040956f35d_8a369bd2-97b6-4fe2-922a-cd170faf25bc</td>\n",
        "      <td></td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2020-12-19 13:04:59+00:00</td>\n",
        "      <td>2020-12-19 19:04:59+00:00</td>\n",
        "      <td>2020-12-19 19:10:17+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  }\\r\\n]</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Scheduled Alerts</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td></td>\n",
        "      <td>CommandAndControl</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>fdc54c12-efba-38b0-8379-f06d7fbfd34a</td>\n",
        "      <td>{\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  }\\r\\n]</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>1</th>\n",
        "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
        "      <td>2021-01-15 09:32:56+00:00</td>\n",
        "      <td>Time series anomaly detection for total volume of traffic</td>\n",
        "      <td>Time series anomaly detection for total volume of traffic</td>\n",
        "      <td>Medium</td>\n",
        "      <td>Identifies anamalous spikes in network traffic logs as compared to baseline or normal historical...</td>\n",
        "      <td>ASI Scheduled Alerts</td>\n",
        "      <td>Microsoft</td>\n",
        "      <td>61c7e4cb-8a09-4b14-8876-ed01ba79cf97</td>\n",
        "      <td>06c1a670-447a-5032-87d9-dadcc38c7f54</td>\n",
        "      <td></td>\n",
        "      <td></td>\n",
        "      <td>8ecf8077-cf51-4820-aadd-14040956f35d_ab8f7be2-4ada-4f9f-b8b7-5596cc80068d</td>\n",
        "      <td></td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2021-01-01 09:27:50+00:00</td>\n",
        "      <td>2021-01-15 09:27:50+00:00</td>\n",
        "      <td>2021-01-15 09:32:56+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  {\\...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>SOC</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Scheduled Alerts</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td></td>\n",
        "      <td>Exfiltration</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>06c1a670-447a-5032-87d9-dadcc38c7f54</td>\n",
        "      <td>{\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  {\\...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>2</th>\n",
        "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
        "      <td>2021-01-15 10:32:56+00:00</td>\n",
        "      <td>Time series anomaly detection for total volume of traffic</td>\n",
        "      <td>Time series anomaly detection for total volume of traffic</td>\n",
        "      <td>Medium</td>\n",
        "      <td>Identifies anamalous spikes in network traffic logs as compared to baseline or normal historical...</td>\n",
        "      <td>ASI Scheduled Alerts</td>\n",
        "      <td>Microsoft</td>\n",
        "      <td>b3f1d5f8-a6b2-46e3-a479-3748d1dfb3f9</td>\n",
        "      <td>8855a515-5f75-1917-e001-ab7c56fbe7b1</td>\n",
        "      <td></td>\n",
        "      <td></td>\n",
        "      <td>8ecf8077-cf51-4820-aadd-14040956f35d_ab8f7be2-4ada-4f9f-b8b7-5596cc80068d</td>\n",
        "      <td></td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2021-01-01 10:27:50+00:00</td>\n",
        "      <td>2021-01-15 10:27:50+00:00</td>\n",
        "      <td>2021-01-15 10:32:56+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  {\\...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>SOC</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Scheduled Alerts</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td></td>\n",
        "      <td>Exfiltration</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>8855a515-5f75-1917-e001-ab7c56fbe7b1</td>\n",
        "      <td>{\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  {\\...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>3</th>\n",
        "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
        "      <td>2021-01-15 11:09:27+00:00</td>\n",
        "      <td>Time series anomaly detection for total volume of traffic</td>\n",
        "      <td>Time series anomaly detection for total volume of traffic</td>\n",
        "      <td>Medium</td>\n",
        "      <td>Identifies anamalous spikes in network traffic logs as compared to baseline or normal historical...</td>\n",
        "      <td>ASI Scheduled Alerts</td>\n",
        "      <td>Microsoft</td>\n",
        "      <td>60c18b16-17e4-48a2-b79f-6146c0412eb4</td>\n",
        "      <td>4acbd9b6-77b9-6918-bae4-52dcc703e646</td>\n",
        "      <td></td>\n",
        "      <td></td>\n",
        "      <td>8ecf8077-cf51-4820-aadd-14040956f35d_cfb8a41c-dfb8-43e8-978e-3bec44cb62d2</td>\n",
        "      <td></td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2021-01-01 11:04:21+00:00</td>\n",
        "      <td>2021-01-15 11:04:21+00:00</td>\n",
        "      <td>2021-01-15 11:09:27+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  {\\...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Scheduled Alerts</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td></td>\n",
        "      <td>Exfiltration</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>4acbd9b6-77b9-6918-bae4-52dcc703e646</td>\n",
        "      <td>{\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  {\\...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "    </tr>\n",
        "    <tr>\n",
        "      <th>4</th>\n",
        "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
        "      <td>2021-01-15 09:09:27+00:00</td>\n",
        "      <td>Time series anomaly detection for total volume of traffic</td>\n",
        "      <td>Time series anomaly detection for total volume of traffic</td>\n",
        "      <td>Medium</td>\n",
        "      <td>Identifies anamalous spikes in network traffic logs as compared to baseline or normal historical...</td>\n",
        "      <td>ASI Scheduled Alerts</td>\n",
        "      <td>Microsoft</td>\n",
        "      <td>9f91a845-194f-4baf-a479-6d806dd314a8</td>\n",
        "      <td>63d01128-c146-3470-c8d3-dc2e1258c6ab</td>\n",
        "      <td></td>\n",
        "      <td></td>\n",
        "      <td>8ecf8077-cf51-4820-aadd-14040956f35d_cfb8a41c-dfb8-43e8-978e-3bec44cb62d2</td>\n",
        "      <td></td>\n",
        "      <td>NaN</td>\n",
        "      <td>False</td>\n",
        "      <td>2021-01-01 09:04:21+00:00</td>\n",
        "      <td>2021-01-15 09:04:21+00:00</td>\n",
        "      <td>2021-01-15 09:09:27+00:00</td>\n",
        "      <td></td>\n",
        "      <td>{\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  {\\...</td>\n",
        "      <td>Detection</td>\n",
        "      <td>d1d8779d-38d7-4f06-91db-9cbc8de0176f</td>\n",
        "      <td>soc</td>\n",
        "      <td></td>\n",
        "      <td>Microsoft Sentinel</td>\n",
        "      <td>Scheduled Alerts</td>\n",
        "      <td></td>\n",
        "      <td>New</td>\n",
        "      <td></td>\n",
        "      <td>Exfiltration</td>\n",
        "      <td>SecurityAlert</td>\n",
        "      <td>63d01128-c146-3470-c8d3-dc2e1258c6ab</td>\n",
        "      <td>{\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...</td>\n",
        "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  {\\...</td>\n",
        "      <td>[3.88.48.125]</td>\n",
        "    </tr>\n",
        "  </tbody>\n",
        "</table>\n",
        "</div>"
      ],
      "text/plain": [
        "                               TenantId             TimeGenerated  \\\n",
        "0  8ecf8077-cf51-4820-aadd-14040956f35d 2020-12-19 19:10:17+00:00   \n",
        "1  8ecf8077-cf51-4820-aadd-14040956f35d 2021-01-15 09:32:56+00:00   \n",
        "2  8ecf8077-cf51-4820-aadd-14040956f35d 2021-01-15 10:32:56+00:00   \n",
        "3  8ecf8077-cf51-4820-aadd-14040956f35d 2021-01-15 11:09:27+00:00   \n",
        "4  8ecf8077-cf51-4820-aadd-14040956f35d 2021-01-15 09:09:27+00:00   \n",
        "\n",
        "                                            AlertDisplayName  \\\n",
        "0          Possible contact with a domain generated by a DGA   \n",
        "1  Time series anomaly detection for total volume of traffic   \n",
        "2  Time series anomaly detection for total volume of traffic   \n",
        "3  Time series anomaly detection for total volume of traffic   \n",
        "4  Time series anomaly detection for total volume of traffic   \n",
        "\n",
        "                                                   AlertName Severity  \\\n",
        "0          Possible contact with a domain generated by a DGA   Medium   \n",
        "1  Time series anomaly detection for total volume of traffic   Medium   \n",
        "2  Time series anomaly detection for total volume of traffic   Medium   \n",
        "3  Time series anomaly detection for total volume of traffic   Medium   \n",
        "4  Time series anomaly detection for total volume of traffic   Medium   \n",
        "\n",
        "                                                                                           Description  \\\n",
        "0  Identifies contacts with domains names in CommonSecurityLog that might have been generated by a ...   \n",
        "1  Identifies anamalous spikes in network traffic logs as compared to baseline or normal historical...   \n",
        "2  Identifies anamalous spikes in network traffic logs as compared to baseline or normal historical...   \n",
        "3  Identifies anamalous spikes in network traffic logs as compared to baseline or normal historical...   \n",
        "4  Identifies anamalous spikes in network traffic logs as compared to baseline or normal historical...   \n",
        "\n",
        "           ProviderName VendorName                      VendorOriginalId  \\\n",
        "0  ASI Scheduled Alerts  Microsoft  2e06b22f-2022-4cc5-8db4-da726aaca8c7   \n",
        "1  ASI Scheduled Alerts  Microsoft  61c7e4cb-8a09-4b14-8876-ed01ba79cf97   \n",
        "2  ASI Scheduled Alerts  Microsoft  b3f1d5f8-a6b2-46e3-a479-3748d1dfb3f9   \n",
        "3  ASI Scheduled Alerts  Microsoft  60c18b16-17e4-48a2-b79f-6146c0412eb4   \n",
        "4  ASI Scheduled Alerts  Microsoft  9f91a845-194f-4baf-a479-6d806dd314a8   \n",
        "\n",
        "                          SystemAlertId ResourceId SourceComputerId  \\\n",
        "0  fdc54c12-efba-38b0-8379-f06d7fbfd34a                               \n",
        "1  06c1a670-447a-5032-87d9-dadcc38c7f54                               \n",
        "2  8855a515-5f75-1917-e001-ab7c56fbe7b1                               \n",
        "3  4acbd9b6-77b9-6918-bae4-52dcc703e646                               \n",
        "4  63d01128-c146-3470-c8d3-dc2e1258c6ab                               \n",
        "\n",
        "                                                                   AlertType  \\\n",
        "0  8ecf8077-cf51-4820-aadd-14040956f35d_8a369bd2-97b6-4fe2-922a-cd170faf25bc   \n",
        "1  8ecf8077-cf51-4820-aadd-14040956f35d_ab8f7be2-4ada-4f9f-b8b7-5596cc80068d   \n",
        "2  8ecf8077-cf51-4820-aadd-14040956f35d_ab8f7be2-4ada-4f9f-b8b7-5596cc80068d   \n",
        "3  8ecf8077-cf51-4820-aadd-14040956f35d_cfb8a41c-dfb8-43e8-978e-3bec44cb62d2   \n",
        "4  8ecf8077-cf51-4820-aadd-14040956f35d_cfb8a41c-dfb8-43e8-978e-3bec44cb62d2   \n",
        "\n",
        "  ConfidenceLevel  ConfidenceScore  IsIncident              StartTimeUtc  \\\n",
        "0                              NaN       False 2020-12-19 13:04:59+00:00   \n",
        "1                              NaN       False 2021-01-01 09:27:50+00:00   \n",
        "2                              NaN       False 2021-01-01 10:27:50+00:00   \n",
        "3                              NaN       False 2021-01-01 11:04:21+00:00   \n",
        "4                              NaN       False 2021-01-01 09:04:21+00:00   \n",
        "\n",
        "                 EndTimeUtc         ProcessingEndTime RemediationSteps  \\\n",
        "0 2020-12-19 19:04:59+00:00 2020-12-19 19:10:17+00:00                    \n",
        "1 2021-01-15 09:27:50+00:00 2021-01-15 09:32:56+00:00                    \n",
        "2 2021-01-15 10:27:50+00:00 2021-01-15 10:32:56+00:00                    \n",
        "3 2021-01-15 11:04:21+00:00 2021-01-15 11:09:27+00:00                    \n",
        "4 2021-01-15 09:04:21+00:00 2021-01-15 09:09:27+00:00                    \n",
        "\n",
        "                                                                                    ExtendedProperties  \\\n",
        "0  {\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...   \n",
        "1  {\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...   \n",
        "2  {\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...   \n",
        "3  {\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...   \n",
        "4  {\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...   \n",
        "\n",
        "                                                                                              Entities  \\\n",
        "0         [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  }\\r\\n]   \n",
        "1  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  {\\...   \n",
        "2  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  {\\...   \n",
        "3  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  {\\...   \n",
        "4  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  {\\...   \n",
        "\n",
        "  SourceSystem               WorkspaceSubscriptionId WorkspaceResourceGroup  \\\n",
        "0    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "1    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    SOC   \n",
        "2    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    SOC   \n",
        "3    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "4    Detection  d1d8779d-38d7-4f06-91db-9cbc8de0176f                    soc   \n",
        "\n",
        "  ExtendedLinks     ProductName ProductComponentName AlertLink Status  \\\n",
        "0                Microsoft Sentinel     Scheduled Alerts              New   \n",
        "1                Microsoft Sentinel     Scheduled Alerts              New   \n",
        "2                Microsoft Sentinel     Scheduled Alerts              New   \n",
        "3                Microsoft Sentinel     Scheduled Alerts              New   \n",
        "4                Microsoft Sentinel     Scheduled Alerts              New   \n",
        "\n",
        "  CompromisedEntity            Tactics           Type  \\\n",
        "0                    CommandAndControl  SecurityAlert   \n",
        "1                         Exfiltration  SecurityAlert   \n",
        "2                         Exfiltration  SecurityAlert   \n",
        "3                         Exfiltration  SecurityAlert   \n",
        "4                         Exfiltration  SecurityAlert   \n",
        "\n",
        "                         SystemAlertId1  \\\n",
        "0  fdc54c12-efba-38b0-8379-f06d7fbfd34a   \n",
        "1  06c1a670-447a-5032-87d9-dadcc38c7f54   \n",
        "2  8855a515-5f75-1917-e001-ab7c56fbe7b1   \n",
        "3  4acbd9b6-77b9-6918-bae4-52dcc703e646   \n",
        "4  63d01128-c146-3470-c8d3-dc2e1258c6ab   \n",
        "\n",
        "                                                                                   ExtendedProperties1  \\\n",
        "0  {\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...   \n",
        "1  {\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...   \n",
        "2  {\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...   \n",
        "3  {\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...   \n",
        "4  {\\r\\n  \"Query\": \"// The query_now parameter (in UTC format) was prepended to the query to reflec...   \n",
        "\n",
        "                                                                                             Entities1  \\\n",
        "0         [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  }\\r\\n]   \n",
        "1  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  {\\...   \n",
        "2  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  {\\...   \n",
        "3  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  {\\...   \n",
        "4  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"Address\": \"3.88.48.125\",\\r\\n    \"Type\": \"ip\"\\r\\n  },\\r\\n  {\\...   \n",
        "\n",
        "     MatchingIps  \n",
        "0  [3.88.48.125]  \n",
        "1  [3.88.48.125]  \n",
        "2  [3.88.48.125]  \n",
        "3  [3.88.48.125]  \n",
        "4  [3.88.48.125]  "
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"1001\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "\n",
       "(function(root) {\n",
       "  function now() {\n",
       "    return new Date();\n",
       "  }\n",
       "\n",
       "  var force = true;\n",
       "\n",
       "  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n",
       "    root._bokeh_onload_callbacks = [];\n",
       "    root._bokeh_is_loading = undefined;\n",
       "  }\n",
       "\n",
       "  var JS_MIME_TYPE = 'application/javascript';\n",
       "  var HTML_MIME_TYPE = 'text/html';\n",
       "  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n",
       "  var CLASS_NAME = 'output_bokeh rendered_html';\n",
       "\n",
       "  /**\n",
       "   * Render data to the DOM node\n",
       "   */\n",
       "  function render(props, node) {\n",
       "    var script = document.createElement(\"script\");\n",
       "    node.appendChild(script);\n",
       "  }\n",
       "\n",
       "  /**\n",
       "   * Handle when an output is cleared or removed\n",
       "   */\n",
       "  function handleClearOutput(event, handle) {\n",
       "    var cell = handle.cell;\n",
       "\n",
       "    var id = cell.output_area._bokeh_element_id;\n",
       "    var server_id = cell.output_area._bokeh_server_id;\n",
       "    // Clean up Bokeh references\n",
       "    if (id != null && id in Bokeh.index) {\n",
       "      Bokeh.index[id].model.document.clear();\n",
       "      delete Bokeh.index[id];\n",
       "    }\n",
       "\n",
       "    if (server_id !== undefined) {\n",
       "      // Clean up Bokeh references\n",
       "      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n",
       "      cell.notebook.kernel.execute(cmd, {\n",
       "        iopub: {\n",
       "          output: function(msg) {\n",
       "            var id = msg.content.text.trim();\n",
       "            if (id in Bokeh.index) {\n",
       "              Bokeh.index[id].model.document.clear();\n",
       "              delete Bokeh.index[id];\n",
       "            }\n",
       "          }\n",
       "        }\n",
       "      });\n",
       "      // Destroy server and session\n",
       "      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n",
       "      cell.notebook.kernel.execute(cmd);\n",
       "    }\n",
       "  }\n",
       "\n",
       "  /**\n",
       "   * Handle when a new output is added\n",
       "   */\n",
       "  function handleAddOutput(event, handle) {\n",
       "    var output_area = handle.output_area;\n",
       "    var output = handle.output;\n",
       "\n",
       "    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n",
       "    if ((output.output_type != \"display_data\") || (!output.data.hasOwnProperty(EXEC_MIME_TYPE))) {\n",
       "      return\n",
       "    }\n",
       "\n",
       "    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n",
       "\n",
       "    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n",
       "      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n",
       "      // store reference to embed id on output_area\n",
       "      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n",
       "    }\n",
       "    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n",
       "      var bk_div = document.createElement(\"div\");\n",
       "      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n",
       "      var script_attrs = bk_div.children[0].attributes;\n",
       "      for (var i = 0; i < script_attrs.length; i++) {\n",
       "        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n",
       "        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n",
       "      }\n",
       "      // store reference to server id on output_area\n",
       "      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n",
       "    }\n",
       "  }\n",
       "\n",
       "  function register_renderer(events, OutputArea) {\n",
       "\n",
       "    function append_mime(data, metadata, element) {\n",
       "      // create a DOM node to render to\n",
       "      var toinsert = this.create_output_subarea(\n",
       "        metadata,\n",
       "        CLASS_NAME,\n",
       "        EXEC_MIME_TYPE\n",
       "      );\n",
       "      this.keyboard_manager.register_events(toinsert);\n",
       "      // Render to node\n",
       "      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n",
       "      render(props, toinsert[toinsert.length - 1]);\n",
       "      element.append(toinsert);\n",
       "      return toinsert\n",
       "    }\n",
       "\n",
       "    /* Handle when an output is cleared or removed */\n",
       "    events.on('clear_output.CodeCell', handleClearOutput);\n",
       "    events.on('delete.Cell', handleClearOutput);\n",
       "\n",
       "    /* Handle when a new output is added */\n",
       "    events.on('output_added.OutputArea', handleAddOutput);\n",
       "\n",
       "    /**\n",
       "     * Register the mime type and append_mime function with output_area\n",
       "     */\n",
       "    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n",
       "      /* Is output safe? */\n",
       "      safe: true,\n",
       "      /* Index of renderer in `output_area.display_order` */\n",
       "      index: 0\n",
       "    });\n",
       "  }\n",
       "\n",
       "  // register the mime type if in Jupyter Notebook environment and previously unregistered\n",
       "  if (root.Jupyter !== undefined) {\n",
       "    var events = require('base/js/events');\n",
       "    var OutputArea = require('notebook/js/outputarea').OutputArea;\n",
       "\n",
       "    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n",
       "      register_renderer(events, OutputArea);\n",
       "    }\n",
       "  }\n",
       "\n",
       "  \n",
       "  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n",
       "    root._bokeh_timeout = Date.now() + 5000;\n",
       "    root._bokeh_failed_load = false;\n",
       "  }\n",
       "\n",
       "  var NB_LOAD_WARNING = {'data': {'text/html':\n",
       "     \"<div style='background-color: #fdd'>\\n\"+\n",
       "     \"<p>\\n\"+\n",
       "     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n",
       "     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n",
       "     \"</p>\\n\"+\n",
       "     \"<ul>\\n\"+\n",
       "     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n",
       "     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n",
       "     \"</ul>\\n\"+\n",
       "     \"<code>\\n\"+\n",
       "     \"from bokeh.resources import INLINE\\n\"+\n",
       "     \"output_notebook(resources=INLINE)\\n\"+\n",
       "     \"</code>\\n\"+\n",
       "     \"</div>\"}};\n",
       "\n",
       "  function display_loaded() {\n",
       "    var el = document.getElementById(\"1001\");\n",
       "    if (el != null) {\n",
       "      el.textContent = \"BokehJS is loading...\";\n",
       "    }\n",
       "    if (root.Bokeh !== undefined) {\n",
       "      if (el != null) {\n",
       "        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n",
       "      }\n",
       "    } else if (Date.now() < root._bokeh_timeout) {\n",
       "      setTimeout(display_loaded, 100)\n",
       "    }\n",
       "  }\n",
       "\n",
       "\n",
       "  function run_callbacks() {\n",
       "    try {\n",
       "      root._bokeh_onload_callbacks.forEach(function(callback) {\n",
       "        if (callback != null)\n",
       "          callback();\n",
       "      });\n",
       "    } finally {\n",
       "      delete root._bokeh_onload_callbacks\n",
       "    }\n",
       "    console.debug(\"Bokeh: all callbacks have finished\");\n",
       "  }\n",
       "\n",
       "  function load_libs(css_urls, js_urls, callback) {\n",
       "    if (css_urls == null) css_urls = [];\n",
       "    if (js_urls == null) js_urls = [];\n",
       "\n",
       "    root._bokeh_onload_callbacks.push(callback);\n",
       "    if (root._bokeh_is_loading > 0) {\n",
       "      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n",
       "      return null;\n",
       "    }\n",
       "    if (js_urls == null || js_urls.length === 0) {\n",
       "      run_callbacks();\n",
       "      return null;\n",
       "    }\n",
       "    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n",
       "    root._bokeh_is_loading = css_urls.length + js_urls.length;\n",
       "\n",
       "    function on_load() {\n",
       "      root._bokeh_is_loading--;\n",
       "      if (root._bokeh_is_loading === 0) {\n",
       "        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n",
       "        run_callbacks()\n",
       "      }\n",
       "    }\n",
       "\n",
       "    function on_error() {\n",
       "      console.error(\"failed to load \" + url);\n",
       "    }\n",
       "\n",
       "    for (var i = 0; i < css_urls.length; i++) {\n",
       "      var url = css_urls[i];\n",
       "      const element = document.createElement(\"link\");\n",
       "      element.onload = on_load;\n",
       "      element.onerror = on_error;\n",
       "      element.rel = \"stylesheet\";\n",
       "      element.type = \"text/css\";\n",
       "      element.href = url;\n",
       "      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n",
       "      document.body.appendChild(element);\n",
       "    }\n",
       "\n",
       "    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.2.2.min.js\": \"JayppSWSRBsibIZqI8S4vAb1oFgLL0uhNvSn8cmArlOvYOwfFjYeyY5UWwJ+K0SU\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.2.2.min.js\": \"G0/Tv/Yy/zEPNsnW0Qif/FOsGesd+KIrKg/QLmvQmReuUW9qmSP7mAmr0VpiUNr3\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.2.2.min.js\": \"VLYHEbLQDk5G1+/4ALU0myoJPMEUsngWry2fzYorFOUmarjGRPLLURaeK/on6JqX\"};\n",
       "\n",
       "    for (var i = 0; i < js_urls.length; i++) {\n",
       "      var url = js_urls[i];\n",
       "      var element = document.createElement('script');\n",
       "      element.onload = on_load;\n",
       "      element.onerror = on_error;\n",
       "      element.async = false;\n",
       "      element.src = url;\n",
       "      if (url in hashes) {\n",
       "        element.crossOrigin = \"anonymous\";\n",
       "        element.integrity = \"sha384-\" + hashes[url];\n",
       "      }\n",
       "      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n",
       "      document.head.appendChild(element);\n",
       "    }\n",
       "  };\n",
       "\n",
       "  function inject_raw_css(css) {\n",
       "    const element = document.createElement(\"style\");\n",
       "    element.appendChild(document.createTextNode(css));\n",
       "    document.body.appendChild(element);\n",
       "  }\n",
       "\n",
       "  \n",
       "  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.2.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.2.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.2.2.min.js\"];\n",
       "  var css_urls = [];\n",
       "  \n",
       "\n",
       "  var inline_js = [\n",
       "    function(Bokeh) {\n",
       "      Bokeh.set_log_level(\"info\");\n",
       "    },\n",
       "    function(Bokeh) {\n",
       "    \n",
       "    \n",
       "    }\n",
       "  ];\n",
       "\n",
       "  function run_inline_js() {\n",
       "    \n",
       "    if (root.Bokeh !== undefined || force === true) {\n",
       "      \n",
       "    for (var i = 0; i < inline_js.length; i++) {\n",
       "      inline_js[i].call(root, root.Bokeh);\n",
       "    }\n",
       "    if (force === true) {\n",
       "        display_loaded();\n",
       "      }} else if (Date.now() < root._bokeh_timeout) {\n",
       "      setTimeout(run_inline_js, 100);\n",
       "    } else if (!root._bokeh_failed_load) {\n",
       "      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n",
       "      root._bokeh_failed_load = true;\n",
       "    } else if (force !== true) {\n",
       "      var cell = $(document.getElementById(\"1001\")).parents('.cell').data().cell;\n",
       "      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n",
       "    }\n",
       "\n",
       "  }\n",
       "\n",
       "  if (root._bokeh_is_loading === 0) {\n",
       "    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n",
       "    run_inline_js();\n",
       "  } else {\n",
       "    load_libs(css_urls, js_urls, function() {\n",
       "      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n",
       "      run_inline_js();\n",
       "    });\n",
       "  }\n",
       "}(window));"
      ],
      "application/vnd.bokehjs_load.v0+json": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  \n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"1001\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error() {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (var i = 0; i < css_urls.length; i++) {\n      var url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error;\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.2.2.min.js\": \"JayppSWSRBsibIZqI8S4vAb1oFgLL0uhNvSn8cmArlOvYOwfFjYeyY5UWwJ+K0SU\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.2.2.min.js\": \"G0/Tv/Yy/zEPNsnW0Qif/FOsGesd+KIrKg/QLmvQmReuUW9qmSP7mAmr0VpiUNr3\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.2.2.min.js\": \"VLYHEbLQDk5G1+/4ALU0myoJPMEUsngWry2fzYorFOUmarjGRPLLURaeK/on6JqX\"};\n\n    for (var i = 0; i < js_urls.length; i++) {\n      var url = js_urls[i];\n      var element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error;\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.2.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.2.2.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.2.2.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"1001\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));"
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "  <div class=\"bk-root\" id=\"9c3815e8-e651-4c62-b575-428caed055ec\" data-root-id=\"1072\"></div>\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "(function(root) {\n",
       "  function embed_document(root) {\n",
       "    \n",
       "  var docs_json = {\"1fff9a48-6d80-4c53-ab13-9e3c590b6a98\":{\"roots\":{\"references\":[{\"attributes\":{\"children\":[{\"id\":\"1004\"},{\"id\":\"1036\"}]},\"id\":\"1072\",\"type\":\"Column\"},{\"attributes\":{\"end\":1613972756712.4,\"start\":1607027392863.6},\"id\":\"1039\",\"type\":\"Range1d\"},{\"attributes\":{\"below\":[{\"id\":\"1047\"},{\"id\":\"1052\"}],\"center\":[{\"id\":\"1050\"}],\"plot_height\":120,\"plot_width\":900,\"renderers\":[{\"id\":\"1058\"}],\"title\":{\"id\":\"1037\"},\"toolbar\":{\"id\":\"1051\"},\"toolbar_location\":null,\"x_range\":{\"id\":\"1039\"},\"x_scale\":{\"id\":\"1043\"},\"y_range\":{\"id\":\"1041\"},\"y_scale\":{\"id\":\"1045\"}},\"id\":\"1036\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"navy\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"navy\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1069\",\"type\":\"Diamond\"},{\"attributes\":{\"base\":24,\"mantissas\":[1,2,4,6,8,12],\"max_interval\":43200000.0,\"min_interval\":3600000.0,\"num_minor_ticks\":0},\"id\":\"1084\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"base\":60,\"mantissas\":[1,2,5,10,15,20,30],\"max_interval\":1800000.0,\"min_interval\":1000.0,\"num_minor_ticks\":0},\"id\":\"1096\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"months\":[0,6]},\"id\":\"1092\",\"type\":\"MonthsTicker\"},{\"attributes\":{},\"id\":\"1106\",\"type\":\"YearsTicker\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"navy\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"navy\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1068\",\"type\":\"Diamond\"},{\"attributes\":{\"num_minor_ticks\":10,\"tickers\":[{\"id\":\"1082\"},{\"id\":\"1083\"},{\"id\":\"1084\"},{\"id\":\"1085\"},{\"id\":\"1086\"},{\"id\":\"1087\"},{\"id\":\"1088\"},{\"id\":\"1089\"},{\"id\":\"1090\"},{\"id\":\"1091\"},{\"id\":\"1092\"},{\"id\":\"1093\"}]},\"id\":\"1016\",\"type\":\"DatetimeTicker\"},{\"attributes\":{},\"id\":\"1093\",\"type\":\"YearsTicker\"},{\"attributes\":{\"below\":[{\"id\":\"1015\"}],\"center\":[{\"id\":\"1018\"},{\"id\":\"1022\"}],\"left\":[{\"id\":\"1019\"}],\"min_border_left\":50,\"plot_height\":300,\"plot_width\":900,\"renderers\":[{\"id\":\"1070\"}],\"title\":{\"id\":\"1005\"},\"toolbar\":{\"id\":\"1029\"},\"x_range\":{\"id\":\"1007\"},\"x_scale\":{\"id\":\"1011\"},\"y_range\":{\"id\":\"1009\"},\"y_scale\":{\"id\":\"1013\"}},\"id\":\"1004\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"days\":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31]},\"id\":\"1098\",\"type\":\"DaysTicker\"},{\"attributes\":{\"months\":[0,6]},\"id\":\"1105\",\"type\":\"MonthsTicker\"},{\"attributes\":{},\"id\":\"1043\",\"type\":\"LinearScale\"},{\"attributes\":{\"data\":{\"AlertName\":[\"Possible contact with a domain generated by a DGA\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Possible contact with a domain generated by a DGA\",\"Possible contact with a domain generated by a DGA\",\"Possible contact with a domain generated by a DGA\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"test agrigation\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Possible contact with a domain generated by a DGA\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Possible contact with a domain generated by a DGA\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Microsoft Threat Intelligence Analytics\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\",\"Time series anomaly detection for total volume of\\ntraffic\"],\"MatchingIps\":[[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"],[\"3.88.48.125\"]],\"TimeGenerated\":{\"__ndarray__\":\"AIAajsZnd0IAABRAVnB3QgAA/K5ZcHdCAIDlxVtwd0IAgBXoVHB3QgAAzIxgcHdCAAC5V1hwd0IAAJxqZ3B3QgAA5B1dcHdCAAAMNV9wd0IAgIWBaXB3QgAAhNlqcHdCAACs8Gxwd0IAAFkTZnB3QgAAlF9wcHdCAACJBHxwd0IAgA2senB3QgAA3OGCcHdCAAA0G35wd0IAAPSjYnB3QgCA3YmBcHdCAAC0+2Nwd0IAgMX4hHB3QgCAAlGGcHdCAADpSG5wd0IAAFS3cXB3QgAAfM5zcHdCAACsv4lwd0IAgCU9d3B3QgCAspKZcHdCAAA8JnVwd0IAACSVeHB3QgCAHQGdcHdCAIBCyKFwd0IAACbgo3B3QgAA9HJ/cHdCAADsZ4hwd0IAgJXWi3B3QgAAlC6NcHdCAIB9RY9wd0IAAHydkHB3QgAApLSScHdCAADhDJRwd0IAgIp7l3B3QgAAjCOWcHdCAADsNqVwd0IAADTqmnB3QgCAWlmecHdCAABEcKBwd0IAALwUrHB3QgCApSuucHdCAAC0CbVwd0IAgF14uHB3QgCARee7cHdCAIDVTadwd0IAAMxpznB3QgAAnEfVcHdCAICyYbZwd0IAgKol3HB3QgAA1KWocHdCAIC9vKpwd0IAAFSU33B3QgAALK7AcHdCAAA8A+Nwd0IAgBXFwnB3QgAApIOvcHdCAIBv2dFwd0IAANzv03B3QgAAJHLmcHdCAICNmrFwd0IAgFU83nB3QgAAjPKycHdCAAAM4elwd0IAgD2r4XB3QgAA9E/tcHdCAIDF1fJwd0IAgHL463B3QgCAJRrlcHdCAABc0Llwd0IAgN1m73B3QgCAKkX2cHdCAADcvvBwd0IAAEQ/vXB3QgAAxC30cHdCAIAtVr9wd0IAABQdxHB3QgAAPDTGcHdCAIA6jMdwd0IAgOWiyXB3QgCAIvvKcHdCAIDNEc1wd0IAAPSA0HB3QgAAxF7XcHdCAIDCtthwd0IAgG3N2nB3QgCADYnocHdCAACsnPdwd0IAgOIDm2l3QgCAVdabaXdCAIBV1ptpd0IAgFXWm2l3QgCAVdabaXdCAIBV1ptpd0IAgFXWm2l3QgCAVdabaXdCAIBV1ptpd0IAgFXWm2l3QgCA4gObaXdCAIDiA5tpd0IAgOIDm2l3QgCA4gObaXdCAIDiA5tpd0IAgOIDm2l3QgCA4gObaXdCAIDiA5tpd0IAgOIDm2l3QgCAVdabaXdCAACDJXdpd0IAAHC/i2l3QgAAE4xiaXdCAACmdJBqd0IAAKZ0kGp3QgAApnSQandCAACmdJBqd0IAAKZ0kGp3QgAApnSQandCAACmdJBqd0IAAKZ0kGp3QgAApnSQandCAACmdJBqd0IAAKZ0kGp3QgAApnSQandCAACmdJBqd0IAAKZ0kGp3QgAAjsABa3dCAACOwAFrd0IAAI7AAWt3QgAAjsABa3dCAACOwAFrd0IAAI7AAWt3QgAAjsABa3dCAACOwAFrd0IAAI7AAWt3QgCAAOgAa3dCAIAA6ABrd0IAgADoAGt3QgCAAOgAa3dCAIAA6ABrd0IAgADoAGt3QgCAAOgAa3dCAIAA6ABrd0IAgADoAGt3QgCAAOgAa3dCAACOwAFrd0IAgJVKQ3J3QgAApChKcndCAICfoGVyd0IAgPJ9bHJ3QgCAypdNcndCAAA5ukZyd0IAACQXgXJ3QgAAXHVUcndCAAB0BlFyd0IAABTCXnJ3QgCAalNbcndCAABE5Fdyd0IAAKxBknJ3QgAAeTFicndCAABsynZyd0IAgAoPaXJ3QgAAGe1vcndCAACEW3Nyd0IAAPT0h3J3QgCAzYWEcndCAADcY4tyd0IAAMTSjnJ3QgAAVDl6cndCAAA8qH1yd0IAAEz9n3J3QgAAHNumcndCAIAljpxyd0IAAJSwlXJ3QgAApAW4cndCAAB0475yd0IAAARKqnJ3QgAA7LitcndCAAB8H5lyd0IAANQnsXJ3QgCAwjjhcndCAIBybKNyd0IAAGyn5HJ3QgAAvJa0cndCAIBNdLtyd0IAANlSwnJ3QgAARMHFcndCAAAUn8xyd0IAgO0vyXJ3QgCA2sndcndCAADkfNNyd0IAAPwN0HJ3QgAAzOvWcndCAIDyWtpyd0IAgFwpQGt3QgAAJ5A5a3dCAAAnkDlrd0IAACeQOWt3QgAAJ5A5a3dCAAAnkDlrd0IAACeQOWt3QgAAJ5A5a3dCAAAnkDlrd0IAACeQOWt3QgAAJ5A5a3dCAAAnkDlrd0IAACeQOWt3QgCAY96wa3dCAIBj3rBrd0IAgGPesGt3QgCAY96wa3dCAIBj3rBrd0IAgGPesGt3QgCAY96wa3dCAIBj3rBrd0IAgGPesGt3QgCAY96wa3dCAIBj3rBrd0IAgGPesGt3QgAAVK0xdHdCAID9GzV0d0IAgBrYQnR3QgCAzfk7dHdCAAAkizh0d0IAgG21SXR3QgCAIGw/dHdCAACUJE10d0IAAMRGRnR3QgCADXFXdHdCAIA9k1B0d0IAAGQCVHR3QgAAHE9edHdCAIBleW90d0IAgEK+YXR3QgCATehydHdCAICtLGV0d0IAgPXfWnR3QgAAdFd2dHdCAABcxnl0d0IAgAU1fXR3QgAALKSAdHdCAICVm2h0d0IAALwKbHR3QgCA1RKEdHdCAACcPZV0d0IAgP34onR3QgCApfCKdHdCAIDN1ql0d0IAgHXOkXR3QgAA/IGHdHdCAICNX450d0IAgIUjtHR3QgCAnbSwdHdCAIDdK8x0d0IAgFUBu3R3QgCARayYdHdCAIDFms90d0IAAGwbnHR3QgAAfHC+dHdCAABUip90d0IAgPW8yHR3QgCA5WemdHdCAAD0Ra10d0IAgK0J03R3QgCAbZK3dHdCAIAl38F0d0IAgA1OxXR3QgCAVaMFeXdCAABM8A95d0IAgPVeE3l3QgCArasdeXdCAAC8iSR5d0IAUCy0NXl3QgCAuhIJeXdCAIAlgQx5d0IAgB1FMnl3QgCABh0heXdCAIDdzRZ5d0IAsD4jOXl3QgCAxTwaeXdCAIBl+Cd5d0IAAIxnK3l3QgCgVgFAeXdCAECfmlR5d0IAQHnfRnl3QgCg0StReXdCAABBkjx5d0IAgDXWLnl3QgDwEE5KeXdCAGDVvE15d0IAgERwQ3l3QgCA5QnxeHdCAIBnNQJ5d0IAgJ1W+3h3QgCAFSzqeHdCAID9mu14d0IAgC295nh3QgCAhcX+eHdCAIDNePR4d0IAgLXn93h3QgAQXOdeeXdCABBnCVh5d0IA0Et4W3l3QgBwVzRpeXdCAMDromx5d0IAsBLFZXl3QgBAsIBzeXdCAAAoGoh5d0IAIB5WYnl3QgCAds19eXdCANBhPIF5d0IAgOIRcHl3QgCAwO92eXdCAMB5Xnp5d0IA4LarhHl3QgCAnQXWdndCAIDNJ892d0IAgDKX0nZ3QgCAFdvEdndCAAA8Ssh2d0IAgAJ12XZ3QgCAVVLgdndCAIDluMt2d0IAAOQeHnd3QgAAbEkvd3dCAIDVQBd3d0IAgBW4Mnd3QgCA/SY2d3dCAIC9rxp3d0IAgI2NIXd3QgCAtXNAd3dCAIB1/CR3d0IAAITaK3d3QgCAzQQ9d3dCAADEUUd3d0IAgJ3iQ3d3QgCAExBVd3dCAAAcWl93d0IAgPXqW3d3QgCAxchid3dCAACcayh3d0IAgOWVOXd3QgAArMBKd3dCAACUL053d0IAgD2eUXd3QgCADXxYd3dCAICtN2Z3d0IAAKzj3HZ3QgCAJTDndndCAIDdfPF2d0IAgPUN7nZ3QgAApKcCd3dCAIA9weN2d0IAgMXr9HZ3QgCATRYGd3dCAIANn+p2d0IAgK1a+HZ3QgCAlcn7dndCAIA1hQl3d0IAAFz0DHd3QgCABWMQd3dCAAC8OP92d0IAgO3RE3d3QgCATcXgdHdCAIC9XvV0d0IAgH3n2XR3QgCAZVbddHdCAIClzfh0d0IAAMw8/HR3QgCANTTkdHdCAAAsge50d0IAABTw8XR3QgCARYkGdXdCAIBdGgN1d0IAANR41nR3QgCAbW8ldXdCAICao+d0d0IAgAUS63R3QgAAtKv/dHdCAAA81hB1d0IAAGz4CXV3QgAAJEUUdXdCAIAVZw11d0IAAAy0F3V3QgCAAgEidXdCAAD0Iht1d0IAgJ2RHnV3QgAANJo2dXdCAIDFdz11d0IAAOzmQHV3QgCAlVVEdXdCAIBV3ih1d0IAgDURUnV3QgAAfE0sdXdCAABcgFV1d0IAAGS8L3V3QgAARO9YdXdCAIAKGmp1d0IAgFLNX3V3QgCADSszdXdCAACc93B1d0IAAIRmdHV3QgAA5KpmdXdCAAAcCTp1d0IAgC3Vd3V3QgAAvMRHdXdCAACkM0t1d0IAAIyiTnV3QgCAal5cdXdCAAD8O2N1d0IAALSIbXV3QgAADtz+aHdCAAAO3P5od0IAAA7c/mh3QgAADtz+aHdCAAChCP5od0IAAKEI/mh3QgAAoQj+aHdCAAChCP5od0IAAEDMNGZ3QgAAuKEjZndCAACIfypmd0IAgGEQJ2Z3QgCAGV0xZndCAAClOzhmd0IAgCvvLWZ3QgCAACmmZndCAADEpPtvd0IAgG0T/293QgAAND4QcHdCAICtihpwd0IAgD3xBXB3QgAATM8McHdCAAAEHBdwd0IAgELrM3B3QgCAVYICcHdCAIAS+h1wd0IAAKTXJHB3QgAA4WAJcHdCAACMRihwd0IAgJokL3B3QgCA3awTcHdCAIAFkzJwd0IAANTIOnB3QgCAvd88cHdCAIDtATZwd0IAAIwVRXB3QgCAdSxHcHdCAADsWTdwd0IAgPo3PnB3QgCAfWghcHdCAADkTkBwd0IAACzRUnB3QgCANbUrcHdCAACcm0pwd0IAABRxOXB3QgAANA0tcHdCAAAcfDBwd0IAgOKmQXB3QgCAjb1DcHdCAIAvhUhwd0IAgMIKTnB3QgAAXPNLcHdCAID/Yk9wd0IAgKp5UXB3QgCAUuXwcXdCAICNMftxd0IAgBI98nF3QgCAvVP0cXdCAAC8q/Vxd0IAgCLD93F3QgAAXGcDcndCAIDiGvlxd0IAAIR+BXJ3QgAAdPj/cXdCAACcDwJyd0IAAAypFnJ3QgAAbO0IcndCAIDKifxxd0IAALSg/nF3QgAAVFwMcndCAAAUtA1yd0IAgJ2GHXJ3QgCAgtYGcndCAAAkOhNyd0IAAMT1IHJ3QgAALEUKcndCAIAyGBpyd0IAADzLD3J3QgCAco81cndCAACsZCRyd0IAgFXTJ3J3QgAAfEIrcndCAABksS5yd0IAABz+OHJ3QgAABG08cndCAABp3D9yd0IAAEwgMnJ3QgCAt0ajcXdCAACU9rlxd0IAgDdmvXF3QgAAHCHLcXdCAIDqVtNxd0IAAHw02nF3QgCAoqPdcXdCAAAEX+txd0IAACx27XF3QgAAVH+ecXdCAAAkXaVxd0IAADbvoXF3QgAAxBizcXdCAIAKJKpxd0IAAGTUwHF3QgCADUPEcXdCAIDFj85xd0IAANypr3F3QgCAwnC0cXdCAIBth7Zxd0IAgJJOu3F3QgAAub2+cXdCAIAC6M9xd0IAAOz+0XF3QgAAkdefcXdCAIAitaZxd0IAANRt1XF3QgCASsyocXdCAIC1Oqxxd0IAAJTF1nF3QgCA8pKtcXdCAIDaAbFxd0IAABzw53F3QgCABQfqcXdCAICq37dxd0IAALzc2HF3QgAA7M3ucXdCAIBiLMJxd0IAAImbxXF3QgAANLLHcXdCAABxCslxd0IAAMkS4XF3QgCANSnjcXdCAABZecxxd0IAALGB5HF3QgAAXJjmcXdCAACkS9xxd0IAgE2633F3QgAAlEffc3dCAIDdcfBzd0IAAATh83N3QgAA7E/3c3dCAICVvvpzd0IAALwt/nN3QgCAZZwBdHdCAABc6Qt0d0IAAEyU6XN3QgCATQsFdHdCAAA0A+1zd0IAgLq24nN3QgCANXoIdHdCAIAlJeZzd0IAgI2CIHR3QgAAtPEjdHdCAIAFWA90d0IAgO3GEnR3QgAA5BMddHdCAIDVNRZ0d0IAgL2kGXR3QgAAhM8qdHdCAIBdYCd0d0IAgC0+LnR3QgAA1OGMc3dCAIBlv5Nzd0IAAIwul3N3QgAAdJ2ac3dCAABcDJ5zd0IAALxQkHN3QgAAnIO5c3dCAIBSWahzd0IAgKU2r3N3QgCAqmHAc3dCAABU0MNzd0IAAER7oXN3QgAAPD/Hc3dCAAC0FLZzd0IAgLWL0XN3QgAA3PrUc3dCAAAs6qRzd0IAAPzHq3N3QgCAjaWyc3dCAIDlrcpzd0IAgEXyvHN3QgCAzRzOc3dCAADEadhzd0IAgG3Y23N3QgCAfAOhZXdCAIB8A6Fld0IAgHwDoWV3QgCAfAOhZXdCAIB8A6Fld0IAgHwDoWV3QgCAfAOhZXdCAIB8A6Fld0IAgHwDoWV3QgCAfAOhZXdCAAD86j1zd0IAAEnJRHN3QgAA5FlBc3dCAAAUfDpzd0IAALQ3SHN3QgCAXaZLc3dCAIBFFU9zd0IAgP1hWXN3QgCALYRSc3dCAAD0rmNzd0IAgJ0dZ3N3QgAAVPNVc3dCAIDl0Fxzd0IAAKz7bXN3QgCAzT9gc3dCAIBVanFzd0IAAMSManN3QgAAHJWCc3dCAIA92XRzd0IAAOxyiXN3QgAATLd7c3dCAID1JX9zd0IAgCVIeHN3QgCAxQOGc3dCAIAVFuhyd0IAAJSNA3N3QgCAWrgUc3dCAAAEJxhzd0IAAAxj8nJ3QgCA6h4Ac3dCAABM2g1zd0IAADyF63J3QgAApOIlc3dCAIBi9O5yd0IAgJovMHN3QgAAvHMic3dCAAD00fVyd0IAANxA+XJ3QgCAArD8cndCAAB8/AZzd0IAgCVrCnN3QgAANEkRc3dCAICtlRtzd0IAANQEH3N3QgCATVEpc3dCAAB0wCxzd0IAgAWeM3N3QgCA7Qw3c3dCAAA0xwhxd0IAgImEFnF3QgCAvZkYcXdCAIAVojBxd0IAAJQL+3B3QgCAlbP5cHdCAIC1XT5xd0IAAKSRAHF3QgCAqgJKcXdCAIB9Iv1wd0IAAExYBXF3QgCAoukBcXdCAIBNAARxd0IAgB3eCnF3QgCAsm8HcXdCAIC6ev5wd0IAAASlD3F3QgCAWjYMcXdCAIDtuxFxd0IAgAVNDnF3QgAAaRQTcXdCAAC88Rlxd0IAgNUqFXF3QgCAjXcfcXdCAACMzyBxd0IAAHQ+JHF3QgAAtOYicXdCAIClCBxxd0IAgF1VJnF3QgAApGAdcXdCAABcrSdxd0IAgEXEKXF3QgAARBwrcXdCAIAtMy1xd0IAAAzvOnF3QgCAaosucXdCAID9EDRxd0IAgFL6MXF3QgCAGs1BcXdCAAD8aDVxd0IAACSAN3F3QgAA5Nc4cXdCAADMRjxxd0IAAKyqSHF3QgCA8rU/cXdCAACcJENxd0IAgIU7RXF3QgAAhJNGcXdCAIBVGUxxd0IAAAy+V3F3QgCA9dRZcXdCAAB8iE9xd0IAgCX3UnF3QgAA7CFkcXdCAAAkT1Rxd0IAgDItW3F3QgCA3UNdcXdCAABcu3hxd0IAgJJxTXF3QgAABLNgcXdCAADMVI1xd0IAANSQZ3F3QgAAhKGXcXdCAAC8/2pxd0IAADzgUHF3QgAApG5ucXdCAICKZlZxd0IAANybXnF3QgCAosZvcXdCAADECmJxd0IAgEfecXF3QgAArHllcXdCAAAR6Whxd0IAAHxXbHF3QgAATDVzcXdCAICyTHVxd0IAgHKkdnF3QgCAWhN6cXdCAABEKnxxd0IAgEKCfXF3QgCA1QeDcXdCAICyG5Jxd0IAAPx2hnF3QgCAapl/cXdCAABE+Zhxd0IAAOkQm3F3QgCAyqyOcXdCAIAq8YBxd0IAgPLDkHF3QgAAnDKUcXdCAICaipVxd0IAACxonHF3QgAA1F+EcXdCAID6zodxd0IAAOTliXF3QgAApD2LcXdCAACkhHB3d0IAgJWmaXd3QgAAdGJ3d3dCAIBH9HN3d0IAgPoVbXd3QgCAHdF6d3dCAAAsr4F3d0IAAOT7i3d3QgCAXUiWd3dCAAAkc6d3d0IAgHXZknd3QgCAtVCud3dCAIAFQH53d0IAgBWVoHd3QgCALSadd3dCAIDVHYV3d0IAgP0DpHd3QgCAvYyId3dCAICdv7F3d0IAgI1qj3d3QgCARbeZd3dCAICFLrV3d0IAAAziqnd3QgCAbZ24d3dCAIAl6sJ3d0IAAKRh3nd3QgCA3TbNd3dCAIAdruh3d0IAAOwU1Hd3QgCA+vLad3dCAIAFHex3d0IAAJQMvHd3QgCAPXu/d3dCAAABlQd4d0IAgA1Zxnd3QgCA9cfJd3dCAIBN0OF3d0IAACyM73d3QgAA5Nj5d3dCAACcJQR4d0IAgMWl0Hd3QgAAzEf9d3dCAICVg9d3d0IAgDU/5Xd3QgCA1fryd3dCAIC9afZ3d0IAgHW2AHh3QgAAbAMLeHdCAACJkYV1d0IAgPV2pHV3QgAAHOandXdCAIDFVKt1d0IAgP2yfnV3QgAAjH+8dXdCAABcXcN1d0IAAMTdj3V3QgAATAihdXdCAIB9obV1d0IAAFlvjHV3QgAArEyTdXdCAIBVu5Z1d0IAgJUysnV3QgAAVER7dXdCAIDlIYJ1d0IAAPT/iHV3QgAAfCqadXdCAIAlmZ11d0IAAOzDrnV3QgCAZRC5dXdCAICy7r91d0IAgAXMxnV3QgAALDvKdXdCAIDVqc11d0IAgHVl23V3QgAAnNTedXdCAABUIel1d0IAADyQ7HV3QgCAvRjRdXdCAADkh9R1d0IAACT/73V3QgAAzPbXdXdCAIDCQ+J1d0IAAOmy5XV3QgAADG7zdXdCAADEuv11d0IAAPTc9nV3QgCAGkz6dXdCAACUmAR2d0IAALFUEnZ3QgAArCkBdndCAAB8Bwh2d0IAgA3lDnZ3QgAAZHYLdndCAIDdwhV2d0IAgMUxGXZ3QgCAKqEcdndCAAA84RF4d0IAgA9zDnh3QgCAry4ceHdCAAD5WC14d0IAACRQFXh3QgAAsg4jeHdCAABkxzB4d0IAADSlN3h3QgAAFhU7eHdCAADcnB94d0IAANRgRXh3QgCA6nomeHdCAAAGwBh4d0IAgNLpKXh3QgAAJz5MeHdCAIANNjR4d0IAAASDPnh3QgAA7PFBeHdCAIB30Eh4d0IAgAX6WXh3QgCA7WhdeHdCAIBNrU94d0IAgDUcU3h3QgCAHYtWeHdCAAAU2GB4d0IAgHWTbnh3QgAADJyGeHdCAIC9RmR4d0IAgKW1Z3h3QgCAFU98eHdCAACUxpd4d0IAgF0Ccnh3QgCAjSRreHdCAAAHcXV4d0IAgLo1m3h3QgCA/b1/eHdCAICipJ54d0IAgJ15jXh3QgAAxOiQeHdCAIAt4Hh4d0IAgOUsg3h3QgCADROieHdCAIC1Cop4d0IAgN3wqHh3QgCAbVeUeHdCAID1gaV4d0IAgP39BGh3QgCA/f0EaHdCAID9/QRod0IAgP39BGh3QgCAWNQFaHdCAID9/QRod0IAgP39BGh3QgCA/f0EaHdCAID9/QRod0IAgP39BGh3QgCA/f0EaHdCAID9/QRod0IAgP39BGh3QgCA/f0EaHdCAID9/QRod0IAgFjUBWh3QgCAWNQFaHdCAIBY1AVod0IAgFjUBWh3QgCAWNQFaHdCAIBY1AVod0IAgFjUBWh3QgCAWNQFaHdCAIBY1AVod0IAgFjUBWh3QgCAWNQFaHdCAIBY1AVod0IAgFjUBWh3QgCAWNQFaHdCAAChxotod0IAAFBba2h3QgAAocaLaHdCAAChxotod0IAAKHGi2h3QgAAocaLaHdCAAChxotod0IAAKHGi2h3QgAAocaLaHdCAAChxotod0IAAKHGi2h3QgAAocaLaHdCAAChxotod0IAAKHGi2h3QgAAocaLaHdCAIDdn4N2d0IAALxbkXZ3QgAAZFN5dndCAIBVdXJ2d0IAAPnkdXZ3QgAAvH4jdndCAADZOjF2d0IAgEUgUHZ3QgAA1A8gdndCAIBl7SZ2d0IAgI3TRXZ3QgAAtEJJdndCAACcsUx2d0IAgPUwgHZ3QgAABA+HdndCAICtfYp2d0IAAIxcKnZ3QgCAHRefdndCAIAFhqJ2d0IAgO30pXZ3QgCApUGwdndCAAB0yy12d0IAAESpNHZ3QgCAtblkdndCAAAsGDh2d0IAAMSXa3Z3QgAAJNxddndCAIDVhjt2d0IAAPz1PnZ3QgCA6gZvdndCAIClZEJ2d0IAgA3CfHZ3QgAAtB+3dndCAIC90qx2d0IAgC1swXZ3QgCAEu2NdndCAIAtj1N2d0IAAFT+VnZ3QgCAZcqUdndCAIBNOZh2d0IAgDWom3Z3QgCA1WOpdndCAICNsLN2d0IAgF2OunZ3QgCARf29dndCAAA8bVp2d0IAAAxLYXZ3QgAA3ChodndC\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[990]},\"index\":[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,952,953,954,955,956,957,958,959,960,961,962,963,964,965,966,967,968,969,970,971,972,973,974,975,976,977,978,979,980,981,982,983,984,985,986,987,988,989],\"y_index\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]},\"selected\":{\"id\":\"1079\"},\"selection_policy\":{\"id\":\"1080\"}},\"id\":\"1002\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"dimensions\":\"width\"},\"id\":\"1027\",\"type\":\"PanTool\"},{\"attributes\":{},\"id\":\"1079\",\"type\":\"Selection\"},{\"attributes\":{},\"id\":\"1045\",\"type\":\"LinearScale\"},{\"attributes\":{\"axis_label\":\"Event Time\",\"formatter\":{\"id\":\"1065\"},\"ticker\":{\"id\":\"1016\"}},\"id\":\"1015\",\"type\":\"DatetimeAxis\"},{\"attributes\":{},\"id\":\"1080\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"months\":[0,1,2,3,4,5,6,7,8,9,10,11]},\"id\":\"1089\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"source\":{\"id\":\"1002\"}},\"id\":\"1071\",\"type\":\"CDSView\"},{\"attributes\":{\"months\":[0,2,4,6,8,10]},\"id\":\"1103\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"text\":\"Range Selector\"},\"id\":\"1037\",\"type\":\"Title\"},{\"attributes\":{\"months\":[0,2,4,6,8,10]},\"id\":\"1090\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"mantissas\":[1,2,5],\"max_interval\":500.0,\"num_minor_ticks\":0},\"id\":\"1095\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"days\":[\"%m-%d %H:%M\"],\"hours\":[\"%H:%M:%S\"],\"milliseconds\":[\"%H:%M:%S.%3N\"],\"minutes\":[\"%H:%M:%S\"],\"seconds\":[\"%H:%M:%S\"]},\"id\":\"1065\",\"type\":\"DatetimeTickFormatter\"},{\"attributes\":{\"days\":[1,8,15,22]},\"id\":\"1087\",\"type\":\"DaysTicker\"},{\"attributes\":{\"base\":24,\"mantissas\":[1,2,4,6,8,12],\"max_interval\":43200000.0,\"min_interval\":3600000.0,\"num_minor_ticks\":0},\"id\":\"1097\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"formatter\":{\"id\":\"1075\"},\"ticker\":{\"id\":\"1020\"},\"visible\":false},\"id\":\"1019\",\"type\":\"LinearAxis\"},{\"attributes\":{\"days\":[1,15]},\"id\":\"1088\",\"type\":\"DaysTicker\"},{\"attributes\":{\"days\":[1,4,7,10,13,16,19,22,25,28]},\"id\":\"1099\",\"type\":\"DaysTicker\"},{\"attributes\":{\"end\":1613705627333.6,\"start\":1607294522242.4},\"id\":\"1007\",\"type\":\"Range1d\"},{\"attributes\":{\"align\":\"right\",\"text\":\"Drag the middle or edges of the selection box to change the range in the main chart\",\"text_font_size\":{\"value\":\"10px\"}},\"id\":\"1052\",\"type\":\"Title\"},{\"attributes\":{},\"id\":\"1013\",\"type\":\"LinearScale\"},{\"attributes\":{\"data_source\":{\"id\":\"1002\"},\"glyph\":{\"id\":\"1056\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"1057\"},\"selection_glyph\":null,\"view\":{\"id\":\"1059\"}},\"id\":\"1058\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"1026\",\"type\":\"SaveTool\"},{\"attributes\":{\"months\":[0,1,2,3,4,5,6,7,8,9,10,11]},\"id\":\"1102\",\"type\":\"MonthsTicker\"},{\"attributes\":{},\"id\":\"1011\",\"type\":\"LinearScale\"},{\"attributes\":{\"axis\":{\"id\":\"1047\"},\"ticker\":null},\"id\":\"1050\",\"type\":\"Grid\"},{\"attributes\":{},\"id\":\"1020\",\"type\":\"BasicTicker\"},{\"attributes\":{\"formatter\":{\"id\":\"1053\"},\"ticker\":{\"id\":\"1048\"}},\"id\":\"1047\",\"type\":\"DatetimeAxis\"},{\"attributes\":{\"days\":[1,8,15,22]},\"id\":\"1100\",\"type\":\"DaysTicker\"},{\"attributes\":{\"data_source\":{\"id\":\"1002\"},\"glyph\":{\"id\":\"1068\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"1069\"},\"selection_glyph\":null,\"view\":{\"id\":\"1071\"}},\"id\":\"1070\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"active_drag\":\"auto\",\"active_inspect\":\"auto\",\"active_multi\":null,\"active_scroll\":\"auto\",\"active_tap\":\"auto\",\"tools\":[{\"id\":\"1003\"},{\"id\":\"1023\"},{\"id\":\"1024\"},{\"id\":\"1025\"},{\"id\":\"1026\"},{\"id\":\"1027\"}]},\"id\":\"1029\",\"type\":\"Toolbar\"},{\"attributes\":{},\"id\":\"1075\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"days\":[1,15]},\"id\":\"1101\",\"type\":\"DaysTicker\"},{\"attributes\":{},\"id\":\"1025\",\"type\":\"ResetTool\"},{\"attributes\":{\"source\":{\"id\":\"1002\"}},\"id\":\"1059\",\"type\":\"CDSView\"},{\"attributes\":{\"months\":[0,4,8]},\"id\":\"1091\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"fill_alpha\":0.2,\"fill_color\":\"navy\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[2,2],\"line_width\":0.5},\"id\":\"1061\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"text\":\"Timeline: IPs with alerts\"},\"id\":\"1005\",\"type\":\"Title\"},{\"attributes\":{\"axis\":{\"id\":\"1019\"},\"dimension\":1,\"grid_line_color\":null,\"ticker\":null},\"id\":\"1022\",\"type\":\"Grid\"},{\"attributes\":{\"callback\":null,\"formatters\":{\"@TimeGenerated\":\"datetime\"},\"tooltips\":[[\"TimeGenerated\",\"@TimeGenerated{%F %T.%3N}\"],[\"AlertName\",\"@AlertName\"],[\"MatchingIps\",\"@MatchingIps\"]]},\"id\":\"1003\",\"type\":\"HoverTool\"},{\"attributes\":{\"dimensions\":\"width\"},\"id\":\"1023\",\"type\":\"WheelZoomTool\"},{\"attributes\":{\"start\":-1.0},\"id\":\"1009\",\"type\":\"Range1d\"},{\"attributes\":{\"fill_color\":{\"value\":\"navy\"},\"line_color\":{\"value\":\"navy\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1056\",\"type\":\"Circle\"},{\"attributes\":{\"days\":[\"%m-%d %H:%M\"],\"hours\":[\"%H:%M:%S\"],\"milliseconds\":[\"%H:%M:%S.%3N\"],\"minutes\":[\"%H:%M:%S\"],\"seconds\":[\"%H:%M:%S\"]},\"id\":\"1053\",\"type\":\"DatetimeTickFormatter\"},{\"attributes\":{\"num_minor_ticks\":5,\"tickers\":[{\"id\":\"1095\"},{\"id\":\"1096\"},{\"id\":\"1097\"},{\"id\":\"1098\"},{\"id\":\"1099\"},{\"id\":\"1100\"},{\"id\":\"1101\"},{\"id\":\"1102\"},{\"id\":\"1103\"},{\"id\":\"1104\"},{\"id\":\"1105\"},{\"id\":\"1106\"}]},\"id\":\"1048\",\"type\":\"DatetimeTicker\"},{\"attributes\":{},\"id\":\"1041\",\"type\":\"DataRange1d\"},{\"attributes\":{\"base\":60,\"mantissas\":[1,2,5,10,15,20,30],\"max_interval\":1800000.0,\"min_interval\":1000.0,\"num_minor_ticks\":0},\"id\":\"1083\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"days\":[1,4,7,10,13,16,19,22,25,28]},\"id\":\"1086\",\"type\":\"DaysTicker\"},{\"attributes\":{\"axis\":{\"id\":\"1015\"},\"minor_grid_line_alpha\":0.3,\"minor_grid_line_color\":\"navy\",\"ticker\":null},\"id\":\"1018\",\"type\":\"Grid\"},{\"attributes\":{\"active_drag\":\"auto\",\"active_inspect\":\"auto\",\"active_multi\":{\"id\":\"1060\"},\"active_scroll\":\"auto\",\"active_tap\":\"auto\",\"tools\":[{\"id\":\"1060\"}]},\"id\":\"1051\",\"type\":\"Toolbar\"},{\"attributes\":{\"overlay\":{\"id\":\"1061\"},\"x_range\":{\"id\":\"1007\"},\"y_range\":null},\"id\":\"1060\",\"type\":\"RangeTool\"},{\"attributes\":{\"months\":[0,4,8]},\"id\":\"1104\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"bottom_units\":\"screen\",\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"top_units\":\"screen\"},\"id\":\"1028\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"mantissas\":[1,2,5],\"max_interval\":500.0,\"num_minor_ticks\":0},\"id\":\"1082\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"navy\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"navy\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1057\",\"type\":\"Circle\"},{\"attributes\":{\"days\":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31]},\"id\":\"1085\",\"type\":\"DaysTicker\"},{\"attributes\":{\"overlay\":{\"id\":\"1028\"}},\"id\":\"1024\",\"type\":\"BoxZoomTool\"}],\"root_ids\":[\"1072\"]},\"title\":\"Bokeh Application\",\"version\":\"2.2.2\"}};\n",
       "  var render_items = [{\"docid\":\"1fff9a48-6d80-4c53-ab13-9e3c590b6a98\",\"root_ids\":[\"1072\"],\"roots\":{\"1072\":\"9c3815e8-e651-4c62-b575-428caed055ec\"}}];\n",
       "  root.Bokeh.embed.embed_items_notebook(docs_json, render_items);\n",
       "\n",
       "  }\n",
       "  if (root.Bokeh !== undefined) {\n",
       "    embed_document(root);\n",
       "  } else {\n",
       "    var attempts = 0;\n",
       "    var timer = setInterval(function(root) {\n",
       "      if (root.Bokeh !== undefined) {\n",
       "        clearInterval(timer);\n",
       "        embed_document(root);\n",
       "      } else {\n",
       "        attempts++;\n",
       "        if (attempts > 100) {\n",
       "          clearInterval(timer);\n",
       "          console.log(\"Bokeh: ERROR: Unable to run BokehJS code because BokehJS library is missing\");\n",
       "        }\n",
       "      }\n",
       "    }, 10, root)\n",
       "  }\n",
       "})(window);"
      ],
      "application/vnd.bokehjs_exec.v0+json": ""
     },
     "metadata": {
      "application/vnd.bokehjs_exec.v0+json": {
       "id": "1072"
      }
     },
     "output_type": "display_data"
    }
   ],
   "source": [
    "(\n",
    "    ips_df\n",
    "    .mp_pivot.run(entities.IpAddress.util.ip_type, column=\"IP\", join=\"inner\")\n",
    "    .query(\"result == 'Public'\").head(5)\n",
    "    .mp_pivot.run(entities.IpAddress.util.whois, column=\"ip\", join=\"left\")\n",
    "    .mp_pivot.run(entities.IpAddress.util.geoloc, column=\"ip\", join=\"left\")\n",
    "    .mp_pivot.display(title=\"Geo Lookup\", cols=[\"IP\", \"City\"])  # << display an intermediate result\n",
    "    .mp_pivot.run(entities.IpAddress.AzureSentinel.SecurityAlert_list_alerts_for_ip, source_ip_list=\"ip\")\n",
    "    .mp_pivot.display(title=\"Alerts Sample\", head=5) \n",
    "    .mp_timeline.plot(\n",
    "        title=\"IPs with alerts\",\n",
    "        source_columns=[\"AlertName\", \"MatchingIps\"],\n",
    "    )\n",
    ");"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<h3 style=\"color: red\">Post-0.9.0 feature</h>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Saving and re-using pipelines as yaml\n",
    "\n",
    "You can specify a pipeline using YAML syntax and execute directly with\n",
    "a DataFrame input.\n",
    "\n",
    "Here is an example pipeline file with two pipelines, each with multiple\n",
    "steps.\n",
    "\n",
    "```yaml\n",
    "pipelines:\n",
    "  pipeline1:\n",
    "    description: Pipeline 1 description\n",
    "    steps:\n",
    "      - name: get_logons\n",
    "        step_type: pivot\n",
    "        function: util.whois\n",
    "        entity: IpAddress\n",
    "        comment: Standard pivot function\n",
    "        params:\n",
    "          column: IpAddress\n",
    "          join: inner\n",
    "      - name: disp_logons\n",
    "        step_type: pivot_display\n",
    "        comment: Pivot display\n",
    "        params:\n",
    "          title: \"The title\"\n",
    "          cols:\n",
    "              - Computer\n",
    "              - Account\n",
    "          query: Computer.str.startswith('MSTICAlerts')\n",
    "          head: 10\n",
    "      - name: tee_logons\n",
    "        step_type: pivot_tee\n",
    "        comment: Pivot tee\n",
    "        params:\n",
    "          var_name: var_df\n",
    "          clobber: True\n",
    "      - name: tee_logons_disp\n",
    "        step_type: pivot_tee_exec\n",
    "        comment: Pivot tee_exec with mp_timeline.plot\n",
    "        function: mp_timeline.plot\n",
    "        params:\n",
    "          source_columns:\n",
    "              - Computer\n",
    "              - Account\n",
    "      - name: logons_timeline\n",
    "        step_type: pd_accessor\n",
    "        comment: Standard accessor with mp_timeline.plot\n",
    "        function: mp_timeline.plot\n",
    "        params:\n",
    "          source_columns:\n",
    "              - Computer\n",
    "              - Account\n",
    "  pipeline2:\n",
    "    description: Pipeline 2 description\n",
    "    steps:\n",
    "      - name: get_logons\n",
    "        step_type: pivot\n",
    "        function: util.whois\n",
    "        entity: IpAddress\n",
    "        comment: Standard pivot function\n",
    "        params:\n",
    "          column: IpAddress\n",
    "          join: inner\n",
    "      - name: disp_logons\n",
    "        step_type: pivot_display\n",
    "        comment: Pivot display\n",
    "        params:\n",
    "          title: \"The title\"\n",
    "          cols:\n",
    "              - Computer\n",
    "              - Account\n",
    "          query: Computer.str.startswith('MSTICAlerts')\n",
    "          head: 10\n",
    "      - name: tee_logons\n",
    "        step_type: pivot_tee\n",
    "        comment: Pivot tee\n",
    "        params:\n",
    "          var_name: var_df\n",
    "          clobber: True\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Create a sample YAML pipeline"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 59,
   "metadata": {},
   "outputs": [],
   "source": [
    "from msticpy.datamodel.pivot_pipeline import Pipeline\n",
    "\n",
    "pipelines_yml = \"\"\"\n",
    "pipelines:\n",
    "  pipeline1:\n",
    "    description: Pipeline 1 description\n",
    "    steps:\n",
    "      - name: get_ip_type\n",
    "        step_type: pivot\n",
    "        function: util.ip_type\n",
    "        entity: IpAddress\n",
    "        comment: Get IP Type\n",
    "        params:\n",
    "          column: IP\n",
    "          join: inner\n",
    "      - name: filter_public\n",
    "        step_type: pd_accessor\n",
    "        comment: Filter to only public IPs\n",
    "        function: query\n",
    "        pos_params:\n",
    "          - result == \"Public\"\n",
    "      - name: whois\n",
    "        step_type: pivot\n",
    "        function: util.whois\n",
    "        entity: IpAddress\n",
    "        comment: Get Whois info\n",
    "        params:\n",
    "          column: IP\n",
    "          join: inner\n",
    "      \n",
    "\"\"\""
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Qe can store this in a file:\n",
    "\n",
    "```python\n",
    "with open(\"pipelines.yml\", \"w\") as fh:\n",
    "    fh.write(pipelines_yml)\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Load the pipeline and print out what it would look like in code"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 64,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "# Pipeline 1 description\n",
      "(\n",
      "    input_df\n",
      "    # Get IP Type\n",
      "    .mp_pivot.run(IpAddress.util.ip_type, column='IP', join='inner')\n",
      "    # Filter to only public IPs\n",
      "    .query('result == \"Public\"')\n",
      "    # Get Whois info\n",
      "    .mp_pivot.run(IpAddress.util.whois, column='IP', join='inner')\n",
      ")\n"
     ]
    }
   ],
   "source": [
    "pipelines = list(Pipeline.from_yaml(pipelines_yml))\n",
    "print(pipelines[0].print_pipeline())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Run the pipeline"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 65,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "21a927dcc9364c13999cf929078b9506",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "Steps:   0%|          | 0/3 [00:00<?, ?it/s]"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "step = get_ip_type \n",
      " PipelineExecStep(accessor='mp_pivot.run', pos_params=[], params={'func': <function get_ip_type at 0x0000028BAFA17048>, 'column': 'IP', 'join': 'inner'}, text=\".mp_pivot.run(IpAddress.util.ip_type, column='IP', join='inner')\", comment='Get IP Type')\n",
      "step = filter_public \n",
      " PipelineExecStep(accessor='query', pos_params=['result == \"Public\"'], params={}, text='.query(\\'result == \"Public\"\\')', comment='Filter to only public IPs')\n",
      "step = whois \n",
      " PipelineExecStep(accessor='mp_pivot.run', pos_params=[], params={'func': <function get_whois_df at 0x0000028BAFA89F78>, 'column': 'IP', 'join': 'inner'}, text=\".mp_pivot.run(IpAddress.util.whois, column='IP', join='inner')\", comment='Get Whois info')\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>IP</th>\n",
       "      <th>ip</th>\n",
       "      <th>result</th>\n",
       "      <th>asn</th>\n",
       "      <th>asn_cidr</th>\n",
       "      <th>asn_country_code</th>\n",
       "      <th>asn_date</th>\n",
       "      <th>asn_description</th>\n",
       "      <th>asn_registry</th>\n",
       "      <th>nets</th>\n",
       "      <th>nir</th>\n",
       "      <th>query</th>\n",
       "      <th>raw</th>\n",
       "      <th>raw_referral</th>\n",
       "      <th>referral</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>3.88.48.125</td>\n",
       "      <td>3.88.48.125</td>\n",
       "      <td>Public</td>\n",
       "      <td>14618</td>\n",
       "      <td>3.80.0.0/12</td>\n",
       "      <td>US</td>\n",
       "      <td>2017-12-20</td>\n",
       "      <td>AMAZON-AES, US</td>\n",
       "      <td>arin</td>\n",
       "      <td>[{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...</td>\n",
       "      <td>None</td>\n",
       "      <td>3.88.48.125</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "            IP           ip  result    asn     asn_cidr asn_country_code  \\\n",
       "0  3.88.48.125  3.88.48.125  Public  14618  3.80.0.0/12               US   \n",
       "\n",
       "     asn_date asn_description asn_registry  \\\n",
       "0  2017-12-20  AMAZON-AES, US         arin   \n",
       "\n",
       "                                                                                                  nets  \\\n",
       "0  [{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...   \n",
       "\n",
       "    nir        query   raw raw_referral referral  \n",
       "0  None  3.88.48.125  None         None     None  "
      ]
     },
     "execution_count": 65,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "pipeline1 = pipelines[0]\n",
    "result_df = pipeline1.run(data=ips_df, verbose=True)\n",
    "result_df.head(3)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Adding your own pivot functions\n",
    "\n",
    "### A simple example"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 67,
   "metadata": {},
   "outputs": [],
   "source": [
    "def my_func(input: str):\n",
    "    return {\n",
    "        \"title\": input.upper(),\n",
    "        \"text\": \"something\"\n",
    "    }\n",
    "\n",
    "Pivot.add_pivot_function(\n",
    "    func=my_func,\n",
    "    container=\"cyber\",\n",
    "    input_type=\"value\",\n",
    "    entity_map={\"Host\": \"HostName\"},\n",
    "    func_input_value_arg=\"input\",\n",
    "    func_new_name=\"upper_name\",\n",
    ")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 68,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>title</th>\n",
       "      <th>text</th>\n",
       "      <th>input</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>HOST_NAME</td>\n",
       "      <td>something</td>\n",
       "      <td>host_name</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "       title       text      input\n",
       "0  HOST_NAME  something  host_name"
      ]
     },
     "execution_count": 68,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "entities.Host.cyber.upper_name(\"host_name\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "(\n",
    "    ips_df\n",
    "    .mp_pivot.run(entities.IpAddress.util.ip_type, column=\"IP\", join=\"inner\")\n",
    "    .query(\"result == 'Public'\").head(2)\n",
    "    .mp_pivot.run(entities.IpAddress.util.whois, column=\"ip\", join=\"left\")\n",
    "    .mp_pivot.run(entities.IpAddress.util.geoloc, column=\"ip\", join=\"left\")\n",
    "    .mp_pivot.display(title=\"Geo Lookup\", cols=[\"IP\", \"City\"])  # << display an intermediate result\n",
    "    .mp_pivot.run(entities.IpAddress.AzureSentinel.SecurityAlert_list_alerts_for_ip, source_ip_list=\"ip\")\n",
    "    .mp_pivot.display(title=\"Alerts Sample\", head=2) \n",
    "    .mp_pivot.run(entities.Host.cyber.upper_name, column=\"Severity\")\n",
    ").head(3)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### A more realistic example.\n",
    "\n",
    "This function extracts individual elements from a list column into separate rows.\n",
    "In this case the `nets` column."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 72,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>IP</th>\n",
       "      <th>ip</th>\n",
       "      <th>result</th>\n",
       "      <th>asn</th>\n",
       "      <th>asn_cidr</th>\n",
       "      <th>asn_country_code</th>\n",
       "      <th>asn_date</th>\n",
       "      <th>asn_description</th>\n",
       "      <th>asn_registry</th>\n",
       "      <th>nets</th>\n",
       "      <th>nir</th>\n",
       "      <th>query</th>\n",
       "      <th>raw</th>\n",
       "      <th>raw_referral</th>\n",
       "      <th>referral</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>3.88.48.125</td>\n",
       "      <td>3.88.48.125</td>\n",
       "      <td>Public</td>\n",
       "      <td>14618</td>\n",
       "      <td>3.80.0.0/12</td>\n",
       "      <td>US</td>\n",
       "      <td>2017-12-20</td>\n",
       "      <td>AMAZON-AES, US</td>\n",
       "      <td>arin</td>\n",
       "      <td>[{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...</td>\n",
       "      <td>None</td>\n",
       "      <td>3.88.48.125</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "      <td>None</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "            IP           ip  result    asn     asn_cidr asn_country_code  \\\n",
       "0  3.88.48.125  3.88.48.125  Public  14618  3.80.0.0/12               US   \n",
       "\n",
       "     asn_date asn_description asn_registry  \\\n",
       "0  2017-12-20  AMAZON-AES, US         arin   \n",
       "\n",
       "                                                                                                  nets  \\\n",
       "0  [{'cidr': '3.0.0.0/9', 'name': 'AT-88-Z', 'handle': 'NET-3-0-0-0-1', 'range': '3.0.0.0 - 3.127.2...   \n",
       "\n",
       "    nir        query   raw raw_referral referral  \n",
       "0  None  3.88.48.125  None         None     None  "
      ]
     },
     "execution_count": 72,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "(\n",
    "    ips_df\n",
    "    # Get IP Type\n",
    "    .mp_pivot.run(IpAddress.util.ip_type, column='IP', join='inner')\n",
    "    # Filter to only public IPs\n",
    "    .query(expr='result == \"Public\"')\n",
    "    # Get Whois info\n",
    "    .mp_pivot.run(IpAddress.util.whois, column='IP', join='inner')\n",
    ").head(1)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 70,
   "metadata": {},
   "outputs": [],
   "source": [
    "def extract_nets(data, col):\n",
    "    out_series = []\n",
    "    for net in result_df.nets:\n",
    "        for entry in net:\n",
    "            out_series.append(pd.Series(entry))\n",
    "    return pd.DataFrame(out_series) \n",
    "\n",
    "Pivot.add_pivot_function(\n",
    "    func=extract_nets,\n",
    "    container=\"whois\",\n",
    "    input_type=\"dataframe\",\n",
    "    entity_map={\"IpAddress\": \"Address\"},\n",
    "    func_df_param_name=\"data\",\n",
    "    func_df_col_param_name=\"col\",\n",
    "    func_new_name=\"extract_nets\",\n",
    ")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 71,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>cidr</th>\n",
       "      <th>name</th>\n",
       "      <th>handle</th>\n",
       "      <th>range</th>\n",
       "      <th>description</th>\n",
       "      <th>country</th>\n",
       "      <th>state</th>\n",
       "      <th>city</th>\n",
       "      <th>address</th>\n",
       "      <th>postal_code</th>\n",
       "      <th>emails</th>\n",
       "      <th>created</th>\n",
       "      <th>updated</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>3.0.0.0/9</td>\n",
       "      <td>AT-88-Z</td>\n",
       "      <td>NET-3-0-0-0-1</td>\n",
       "      <td>3.0.0.0 - 3.127.255.255</td>\n",
       "      <td>Amazon Technologies Inc.</td>\n",
       "      <td>US</td>\n",
       "      <td>WA</td>\n",
       "      <td>Seattle</td>\n",
       "      <td>410 Terry Ave N.</td>\n",
       "      <td>98109</td>\n",
       "      <td>[aws-routing-poc@amazon.com, abuse@amazonaws.com, amzn-noc-contact@amazon.com, aws-dogfish-routi...</td>\n",
       "      <td>2017-12-20</td>\n",
       "      <td>2018-03-30</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>3.80.0.0/12</td>\n",
       "      <td>AMAZON-IAD</td>\n",
       "      <td>NET-3-80-0-0-1</td>\n",
       "      <td>None</td>\n",
       "      <td>Amazon Data Services NoVa</td>\n",
       "      <td>US</td>\n",
       "      <td>VA</td>\n",
       "      <td>Herndon</td>\n",
       "      <td>13200 Woodland Park Road</td>\n",
       "      <td>20171</td>\n",
       "      <td>[amzn-noc-contact@amazon.com, abuse@amazonaws.com]</td>\n",
       "      <td>2018-08-22</td>\n",
       "      <td>2018-08-22</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "          cidr        name          handle                    range  \\\n",
       "0    3.0.0.0/9     AT-88-Z   NET-3-0-0-0-1  3.0.0.0 - 3.127.255.255   \n",
       "1  3.80.0.0/12  AMAZON-IAD  NET-3-80-0-0-1                     None   \n",
       "\n",
       "                 description country state     city                   address  \\\n",
       "0   Amazon Technologies Inc.      US    WA  Seattle          410 Terry Ave N.   \n",
       "1  Amazon Data Services NoVa      US    VA  Herndon  13200 Woodland Park Road   \n",
       "\n",
       "  postal_code  \\\n",
       "0       98109   \n",
       "1       20171   \n",
       "\n",
       "                                                                                                emails  \\\n",
       "0  [aws-routing-poc@amazon.com, abuse@amazonaws.com, amzn-noc-contact@amazon.com, aws-dogfish-routi...   \n",
       "1                                                   [amzn-noc-contact@amazon.com, abuse@amazonaws.com]   \n",
       "\n",
       "      created     updated  \n",
       "0  2017-12-20  2018-03-30  \n",
       "1  2018-08-22  2018-08-22  "
      ]
     },
     "execution_count": 71,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "from msticpy.datamodel.entities import IpAddress\n",
    "(\n",
    "    ips_df\n",
    "    # Get IP Type\n",
    "    .mp_pivot.run(IpAddress.util.ip_type, column='IP', join='inner')\n",
    "    # Filter to only public IPs\n",
    "    .query(expr='result == \"Public\"')\n",
    "    # Get Whois info\n",
    "    .mp_pivot.run(IpAddress.util.whois, column='IP', join='inner')\n",
    "    .mp_pivot.run(IpAddress.whois.extract_nets, column='nets')\n",
    ")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Appendix - how do pivot wrappers work?\n",
    "\n",
    "In Python you can create functions that return other functions.\n",
    "On the way they can change how the arguments and output are\n",
    "processed.\n",
    "\n",
    "Take this simple function that just applies proper capitalization\n",
    "to an input string."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 35,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Hello\n"
     ]
    }
   ],
   "source": [
    "def print_me(arg):\n",
    "    print(arg.capitalize())\n",
    "    \n",
    "print_me(\"hello\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "If we try to pass a list to this function we get an \n",
    "expected exception about lists not supporting `capitalize`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 66,
   "metadata": {},
   "outputs": [
    {
     "ename": "NameError",
     "evalue": "name 'print_me' is not defined",
     "output_type": "error",
     "traceback": [
      "\u001b[1;31m---------------------------------------------------------------------------\u001b[0m",
      "\u001b[1;31mNameError\u001b[0m                                 Traceback (most recent call last)",
      "\u001b[1;32m<ipython-input-66-94b3e61eb86f>\u001b[0m in \u001b[0;36m<module>\u001b[1;34m\u001b[0m\n\u001b[1;32m----> 1\u001b[1;33m \u001b[0mprint_me\u001b[0m\u001b[1;33m(\u001b[0m\u001b[1;33m[\u001b[0m\u001b[1;34m\"hello\"\u001b[0m\u001b[1;33m,\u001b[0m \u001b[1;34m\"world\"\u001b[0m\u001b[1;33m]\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0m",
      "\u001b[1;31mNameError\u001b[0m: name 'print_me' is not defined"
     ]
    }
   ],
   "source": [
    "print_me([\"hello\", \"world\"])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We could create a wrapper function that checked the\n",
    "input and iterated over the individual items if arg is a list.\n",
    "The works but we don't want to have to do this for every \n",
    "function that we want to have flexible input!"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 37,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Hello\n",
      "How\n",
      "Are\n",
      "You\n",
      "?\n"
     ]
    }
   ],
   "source": [
    "def print_me_list(arg):\n",
    "    if isinstance(arg, list):\n",
    "        for item in arg:\n",
    "            print_me(item)\n",
    "    else:\n",
    "        print_me(arg)\n",
    "        \n",
    "print_me_list(\"hello\")\n",
    "print_me_list([\"how\", \"are\", \"you\", \"?\"])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Instead we can create a function wrapper. The outer function\n",
    "`dont_care_func` defines an inner function, `list_or_str` and then\n",
    "returns this function. The inner function `list_or_str` is what\n",
    "implements the same \"is-this-a-string-or-list\" logic that we \n",
    "saw in the previous example. \n",
    "Crucially though, it isn't hard-coded to call `print_me` but\n",
    "calls whatever function passed to it from the outer function\n",
    "`dont_care_func`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 38,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Our magic wrapper\n",
    "\n",
    "def dont_care_func(func):\n",
    "    \n",
    "    def list_or_str(arg):\n",
    "        if isinstance(arg, list):\n",
    "            for item in arg:\n",
    "                func(item)\n",
    "        else:\n",
    "            func(arg)\n",
    "    return list_or_str"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "How do we use this?\n",
    "\n",
    "We simply pass the function that we want to wrap to\n",
    "`dont_care_func`. Recall, that this function just returns\n",
    "an instance of the inner function. In this particular instance\n",
    "the value `func` will have been replaced by the actual function\n",
    "`print_me`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 38,
   "metadata": {},
   "outputs": [],
   "source": [
    "print_stuff = dont_care_func(print_me)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Now we have a wrapped version of `print_me` that can\n",
    "handle different types of input. Magic!"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 39,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Hello\n",
      "How\n",
      "Are\n",
      "You\n",
      "?\n"
     ]
    }
   ],
   "source": [
    "print_stuff(\"hello\")\n",
    "print_stuff([\"how\", \"are\", \"you\", \"?\"])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "We can also define further functions and create wrapped\n",
    "versions of those by passing them to `dont_care_func`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 118,
   "metadata": {},
   "outputs": [],
   "source": [
    "def shout_me(arg):\n",
    "    print(arg.upper(), \"\\U0001F92C!\", end=\" \")\n",
    "    \n",
    "shout_stuff = dont_care_func(shout_me)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 119,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "HELLO 🤬! HOW 🤬! ARE 🤬! YOU 🤬! ? 🤬! "
     ]
    }
   ],
   "source": [
    "shout_stuff(\"hello\")\n",
    "shout_stuff([\"how\", \"are\", \"you\", \"?\"])"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The wrapper functionality in Pivot is a bit more complex than\n",
    "this but essentially operates this way."
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python (condadev)",
   "language": "python",
   "name": "condadev"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.10"
  },
  "widgets": {
   "application/vnd.jupyter.widget-state+json": {
    "state": {
     "2aeaa3525526453282e5e1934aa4a923": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "95%"
      }
     },
     "d24faa135bc84d798e4028cbbf8a91b9": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "95%"
      }
     }
    },
    "version_major": 2,
    "version_minor": 0
   }
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}