From 90b75b3abb23911fc5ca3142fda0ae7d5a3a6986 Mon Sep 17 00:00:00 2001 From: Ian Hellen Date: Wed, 14 Jul 2021 15:01:21 -0700 Subject: [PATCH 1/3] Updates from feedback to Getting Started and Tour notebooks. --- ...uide For Azure Sentinel ML Notebooks.ipynb | 2211 ++++++++--------- A Tour of Cybersec notebook features.ipynb | 167 +- notebookmetadata.json | 2 +- 3 files changed, 1124 insertions(+), 1256 deletions(-) diff --git a/A Getting Started Guide For Azure Sentinel ML Notebooks.ipynb b/A Getting Started Guide For Azure Sentinel ML Notebooks.ipynb index 73b7dc5..24e7b61 100644 --- a/A Getting Started Guide For Azure Sentinel ML Notebooks.ipynb +++ b/A Getting Started Guide For Azure Sentinel ML Notebooks.ipynb @@ -2,6 +2,7 @@ "cells": [ { "cell_type": "markdown", + "metadata": {}, "source": [ "# Getting Started with Azure ML Notebooks and Azure Sentinel\r\n", "\r\n", @@ -50,137 +51,139 @@ "\r\n", "If you encounter any unexpected errors please see the FAQ at the end of this notebook.\r\n", "
" - ], - "metadata": {} + ] }, { "cell_type": "markdown", + "metadata": {}, "source": [ - "---\r\n", - "\r\n", - "# What is a Jupyter notebook?\r\n", - "\r\n", - "

\r\n", - "If you're familiar with notebooks, skip this section and go to \"Setting up the environment\" section.

\r\n", - "\r\n", - "You are currently reading a Jupyter notebook. [Jupyter](http://jupyter.org/) is an interactive\r\n", - "development and data manipulation environment presented in a browser.\r\n", - "\r\n", - "Using Jupyter you can create documents, called **Notebooks**.\r\n", - "These documents are made up of cells that contain interactive code, alongside that code's output,\r\n", - "and other items such as text and images (what you are looking at now is a cell of Markdown text).\r\n", - "\r\n", - "The name, Jupyter, comes from the core supported programming languages that it supports: **Ju**lia, **Pyt**hon, and **R**.\r\n", - "While you can use any of these languages (and others such as Powershell) we are going to use Python in this notebook.\r\n", - "\r\n", - "The majority of the notebooks on the [Azure Sentinel GitHub repo](https://github.com/Azure/Azure-Sentinel-Notebooks)\r\n", - "are written in Python. Whilst there are pros, and cons to each language, Python is a well-established\r\n", - "language that has a large number of materials and libraries well suited for\r\n", - "data analysis and security investigation, making it ideal for our needs.\r\n", - "\r\n", - "
\r\n", - "
\r\n", - " Learn more...\r\n", - "
\r\n", - "
\r\n" - ], - "metadata": {} + "---\n", + "\n", + "# What is a Jupyter notebook?\n", + "\n", + "
\n", + "

If you're familiar with notebooks, skip this section and go to \"Setting up the environment\" section.

\n", + "
\n", + "
\n", + "\n", + "You are currently reading a Jupyter notebook. [Jupyter](http://jupyter.org/) is an interactive\n", + "development and data manipulation environment presented in a browser.\n", + "\n", + "A Jupyter notebook is a document\n", + "made up of cells that contain interactive code, alongside that code's output,\n", + "and other items such as text and images (what you are looking at now is a cell of *Markdown* text).\n", + "\n", + "The name, Jupyter, comes from the core supported programming languages that it supports: **Ju**lia, **Pyt**hon, and **R**.\n", + "While you can use any of these languages (and others such as Powershell) we are going to use Python in this notebook.\n", + "\n", + "The majority of the notebooks on the [Azure Sentinel GitHub repo](https://github.com/Azure/Azure-Sentinel-Notebooks)\n", + "are written in Python. Whilst there are pros, and cons to each language, Python is a well-established\n", + "language that has a large number of materials and libraries well suited for\n", + "data analysis and security investigation, making it ideal for our needs.\n", + "\n", + "
\n", + "
\n", + " Learn more...\n", + "
\n", + "
\n" + ] }, { "cell_type": "markdown", + "metadata": {}, "source": [ - "---\r\n", - "\r\n", - "## How to use a Jupyter notebook?\r\n", - "\r\n", - "To use a Jupyter notebook you need a Jupyter server that will render the notebook and execute the code within it.\r\n", - "This can take the form of a local [Jupyter installation](https://pypi.org/project/jupyter/),\r\n", - "or a remotely hosted version such as \r\n", - "[Azure Machine Learning Notebooks](https://docs.microsoft.com/en-us/azure/machine-learning/how-to-run-jupyter-notebooks). \r\n", - "\r\n", - "## Using Azure Machine Learning (ML) Notebooks\r\n", - "\r\n", - "If you launched this notebook from Azure Sentinel, you will be running it in an Azure ML workspace.\r\n", - "By default, the notebook is running in the built-in notebook editor. You can also open\r\n", - "and run the notebook in Jupyterlab or Jupyter classic, if these environments are more familiar\r\n", - "to you.\r\n", - "\r\n", - "
\r\n", - " Learn more...\r\n", - "

Although you can view a notebook as a static document (GitHub, for example has a built-in\r\n", - "static notebook renderer), if you want to run the code in a notebook, the notebook\r\n", - "must be attached to a backend process, know as a Jupyter kernel. The kernel\r\n", - "is really where your code is being run and where all of variables and objects\r\n", - "created in the code are held. The browser is just the viewer for this data.\r\n", - "

\r\n", - "

In Azure ML, the kernel runs on a virtual machine known as an Azure ML Compute.\r\n", - "The Compute instance can support the running of many notebooks simultaneously.

\r\n", - "

\r\n", - "Usually, the creation/attaching of a kernel for your notebook happens\r\n", - "seamlessly - you don't need to do anything manually. One thing that you\r\n", - "may need to check (especially if you are getting errors or the notebook\r\n", - "doesn't seem to be executing) is the version and state of the kernel.

\r\n", - " \r\n", - "
\r\n", - "\r\n", - "For this notebook we are going to be using Python 3.8 (you can also choose the Python 3.6 kernel).\r\n", - "\r\n", - "You can check the kernel name and version is selected by looking at\r\n", - "the drop down in the top left corner of the Workspace window as shown in\r\n", - "the image below.\r\n", - "\r\n", - "\r\n", - "\r\n", - "\r\n", - "\r\n", - "This image also shows the active compute instance (to the right).\r\n", - "\r\n", - "\r\n", - "\r\n", - "\r\n", - "If the selected kernel does not show `Azure ML Python 3.8` you can select the correct kernel by clicking on the Kernel drop-down.\r\n", - "\r\n", - "

Note: the notebook works with Python 3.6 or later.\r\n", - "If you are using this notebook in another\r\n", - "Jupyter environment you can choose any kernel that supports Python 3.6 or later\r\n", - "

\r\n", - "\r\n", - "

Tip\r\n", - "Sometimes, your notebook may \"hang\" or you want to just start over.\r\n", - "To do this you can restart the kernel. Use the \"recycle\" button in the toolbar\r\n", - "in the upper right of the screen above the notebook.\r\n", - "
\r\n", - "You will need to re-run any initialization and authentication cells after doing\r\n", - "this since restarting the kernel wipes all variables and other state.\r\n", - "

\r\n", - "\r\n", - "\r\n", - "\r\n", - "
\r\n", - "
\r\n", - " Troubleshooting...\r\n", - "

\r\n", - "If you are having trouble getting the notebook running you should review\r\n", - "How to run Juptyer notebooks.\r\n", - "

\r\n", - "
\r\n" - ], - "metadata": {} + "---\n", + "\n", + "## How to use a Jupyter notebook?\n", + "\n", + "To use a Jupyter notebook you need a Jupyter server that will render the notebook and execute the code within it.\n", + "This can take the form of a local [Jupyter installation](https://pypi.org/project/jupyter/),\n", + "or a remotely hosted version such as \n", + "[Azure Machine Learning Notebooks](https://docs.microsoft.com/en-us/azure/machine-learning/how-to-run-jupyter-notebooks). \n", + "\n", + "## Using Azure Machine Learning (ML) Notebooks\n", + "\n", + "If you launched this notebook from Azure Sentinel, you will be running it in an Azure ML workspace.\n", + "By default, the notebook is running in the built-in notebook editor. You can also open\n", + "and run the notebook in Jupyterlab or Jupyter classic, if these environments are more familiar\n", + "to you.\n", + "\n", + "
\n", + " Learn more...\n", + "

Although you can view a notebook as a static document (GitHub, for example has a built-in\n", + "static notebook renderer), if you want to run the code in a notebook, the notebook\n", + "must be attached to a backend process, know as a Jupyter kernel. The kernel\n", + "is really where your code is being run and where all of variables and objects\n", + "created in the code are held. The browser is just the viewer for this data.\n", + "

\n", + "

In Azure ML, the kernel runs on a virtual machine known as an Azure ML Compute.\n", + "The Compute instance can support the running of many notebooks simultaneously.

\n", + "

\n", + "Usually, the creation/attaching of a kernel for your notebook happens\n", + "seamlessly - you don't need to do anything manually. One thing that you\n", + "may need to check (especially if you are getting errors or the notebook\n", + "doesn't seem to be executing) is the version and state of the kernel.

\n", + " \n", + "
\n", + "\n", + "For this notebook we are going to be using Python 3.8 (you can also choose the Python 3.6 kernel).\n", + "\n", + "You can check the kernel name and version is selected by looking at\n", + "the drop down in the top left corner of the Workspace window as shown in\n", + "the image below.\n", + "\n", + "\n", + "\n", + "\n", + "\n", + "This image also shows the active compute instance (to the right).\n", + "\n", + "\n", + "\n", + "\n", + "If the selected kernel does not show `Azure ML Python 3.8` you can select the correct kernel by clicking on the Kernel drop-down.\n", + "\n", + "

Note: the notebook works with Python 3.6 or later.\n", + "If you are using this notebook in another\n", + "Jupyter environment you can choose any kernel that supports Python 3.6 or later\n", + "

\n", + "\n", + "

Tip:\n", + "Sometimes, your notebook may \"hang\" or you want to just start over.\n", + "To do this you can restart the kernel. Use the \"recycle\" button in the toolbar\n", + "in the upper right of the screen above the notebook.\n", + "
\n", + "You will need to re-run any initialization and authentication cells after doing\n", + "this since restarting the kernel wipes all variables and other state.\n", + "

\n", + "\n", + "\n", + "\n", + "
\n", + "
\n", + " Troubleshooting...\n", + "

\n", + "If you are having trouble getting the notebook running you should review\n", + "How to run Juptyer notebooks.\n", + "

\n", + "
\n" + ] }, { "cell_type": "markdown", + "metadata": {}, "source": [ "---\r\n", "\r\n", @@ -200,65 +203,65 @@ "In other notebook environments code and markdown cells will have\r\n", "different styles but it's usually easy to distinguish them.\r\n", "

\r\n" - ], - "metadata": {} + ] }, { "cell_type": "code", "execution_count": 27, - "source": [ - "# This is our first code cell, it contains basic Python code.\r\n", - "# You can run a code cell by selecting it and clicking\r\n", - "# the Run button (to the left of the cell), or by pressing Shift + Enter.\r\n", - "# Any output from the code will be displayed directly below it.\r\n", - "print(\"Congratulations you just ran this code cell\")\r\n", - "y = 2 + 2\r\n", - "print(\"2 + 2 =\", y)" - ], + "metadata": {}, "outputs": [ { - "output_type": "stream", "name": "stdout", + "output_type": "stream", "text": [ "Congratulations you just ran this code cell\n", "2 + 2 = 4\n" ] } ], - "metadata": {} + "source": [ + "# This is our first code cell, it contains basic Python code.\r\n", + "# You can run a code cell by selecting it and clicking\r\n", + "# the Run button (to the left of the cell), or by pressing Shift + Enter.\r\n", + "# Any output from the code will be displayed directly below it.\r\n", + "print(\"Congratulations you just ran this code cell\")\r\n", + "y = 2 + 2\r\n", + "print(\"2 + 2 =\", y)" + ] }, { "cell_type": "markdown", + "metadata": {}, "source": [ "Variables set within a code cell persist between cells meaning you can chain cells together.\r\n", "In this example we're using the value of y from the previous cell." - ], - "metadata": {} + ] }, { "cell_type": "code", "execution_count": 28, - "source": [ - "# Note that output from the last line of a cell is automatically\r\n", - "# sent to the output cell, without needing the print() function.\r\n", - "y + 2" - ], + "metadata": {}, "outputs": [ { - "output_type": "execute_result", "data": { "text/plain": [ "6" ] }, + "execution_count": 28, "metadata": {}, - "execution_count": 28 + "output_type": "execute_result" } ], - "metadata": {} + "source": [ + "# Note that output from the last line of a cell is automatically\r\n", + "# sent to the output cell, without needing the print() function.\r\n", + "y + 2" + ] }, { "cell_type": "markdown", + "metadata": {}, "source": [ "Now that you understand the basics we can move onto more complex code.\r\n", "\r\n", @@ -274,11 +277,11 @@ " \r\n", "\r\n", "
\r\n" - ], - "metadata": {} + ] }, { "cell_type": "markdown", + "metadata": {}, "source": [ - "## Load a QueryProvider\r\n", - "To start, we are going to load up a QueryProvider\r\n", - "for Azure Sentinel, pass it the \r\n", - "details for our workspace that we just stored in the msticpyconfig file, and connect.\r\n", - "\r\n", - "
Note:\r\n", - "If you see a warning \"Runtime dependency of PyGObject is missing\" when loading the
\r\n", - "Azure Sentinel driver, please see the FAQ section at the end of this notebook.\r\n", + "## Load a QueryProvider\n", + "To start, we are going to load up a QueryProvider\n", + "for Azure Sentinel, pass it the \n", + "details for our workspace that we just stored in the msticpyconfig file, and connect.\n", + "\n", + "
Note:\n", + "If you see a warning \"Runtime dependency of PyGObject is missing\" when loading the
\n", + "Azure Sentinel driver, please see the FAQ section at the end of this notebook.
\n", + "The warning does not impact any functionality of the notebooks.\n", "
" - ], - "metadata": {} + ] }, { "cell_type": "code", "execution_count": 6, - "source": [ - "# Initalize a QueryProvider for Azure Sentinel\r\n", - "qry_prov = QueryProvider(\"AzureSentinel\")" - ], + "metadata": {}, "outputs": [ { - "output_type": "stream", "name": "stdout", + "output_type": "stream", "text": [ "Please wait. Loading Kqlmagic extension...\n" ] } ], - "metadata": {} + "source": [ + "# Initalize a QueryProvider for Azure Sentinel\r\n", + "qry_prov = QueryProvider(\"AzureSentinel\")" + ] }, { "cell_type": "markdown", + "metadata": {}, "source": [ "## Authenticate\r\n", "\r\n", @@ -1036,31 +918,15 @@ "You will need to re-authenticate if you restart your Compute instance\r\n", "or switch to a different one.\r\n", "

" - ], - "metadata": {} + ] }, { "cell_type": "code", "execution_count": 7, - "source": [ - "# Get the Azure Sentinel workspace details from msticpyconfig\r\n", - "# Loading WorkspaceConfig with no parameters will use the details\r\n", - "# of your \"Default\" workspace (see the Configuring Azure Sentinel settings section earlier)\r\n", - "# If you want to connect to a specific workspace use this syntax:\r\n", - "# ws_config = WorkspaceConfig(workspace=\"WorkspaceName\")\r\n", - "# ('WorkspaceName' should be one of the workspaces defined in msticpyconfig.yaml)\r\n", - "ws_config = WorkspaceConfig()\r\n", - " \r\n", - "# Connect to Azure Sentinel with our QueryProvider and config details\r\n", - "qry_prov.connect(ws_config)" - ], + "metadata": {}, "outputs": [ { - "output_type": "display_data", "data": { - "text/plain": [ - "" - ], "text/html": [ "\n", " \n", @@ -1068,15 +934,31 @@ " popup schema 8ecf8077-cf51-4820-aadd-14040956f35d@loganalytics\n", "
\n", " " + ], + "text/plain": [ + "" ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" } ], - "metadata": {} + "source": [ + "# Get the Azure Sentinel workspace details from msticpyconfig\r\n", + "# Loading WorkspaceConfig with no parameters will use the details\r\n", + "# of your \"Default\" workspace (see the Configuring Azure Sentinel settings section earlier)\r\n", + "# If you want to connect to a specific workspace use this syntax:\r\n", + "# ws_config = WorkspaceConfig(workspace=\"WorkspaceName\")\r\n", + "# ('WorkspaceName' should be one of the workspaces defined in msticpyconfig.yaml)\r\n", + "ws_config = WorkspaceConfig()\r\n", + " \r\n", + "# Connect to Azure Sentinel with our QueryProvider and config details\r\n", + "qry_prov.connect(ws_config)" + ] }, { "cell_type": "markdown", + "metadata": {}, "source": [ "## Test the Azure Sentinel configuration\r\n", "\r\n", @@ -1085,28 +967,21 @@ "You can use the schema to help understand what data is available to query.
\r\n", "The AzureSentinel QueryProvider has a \"schema_tables\" property that lets us get a list of tables\r\n", "as well the schema (column names and data types) for each table." - ], - "metadata": {} + ] }, { "cell_type": "code", "execution_count": 8, - "source": [ - "# Get list of tables in our Workspace with the 'schema_tables' property\r\n", - "print(\"Sample of first 10 tables in the schema\")\r\n", - "qry_prov.schema_tables[:10] # We are outputting only a sample of tables for brevity\r\n", - " # remove the \"[:10]\" to see the whole list\r\n" - ], + "metadata": {}, "outputs": [ { - "output_type": "stream", "name": "stdout", + "output_type": "stream", "text": [ "Sample of first 10 tables in the schema\n" ] }, { - "output_type": "execute_result", "data": { "text/plain": [ "['AACAudit',\n", @@ -1121,40 +996,36 @@ " 'AADManagedIdentitySignInLogs']" ] }, + "execution_count": 8, "metadata": {}, - "execution_count": 8 + "output_type": "execute_result" } ], - "metadata": {} + "source": [ + "# Get list of tables in our Workspace with the 'schema_tables' property\r\n", + "print(\"Sample of first 10 tables in the schema\")\r\n", + "qry_prov.schema_tables[:10] # We are outputting only a sample of tables for brevity\r\n", + " # remove the \"[:10]\" to see the whole list\r\n" + ] }, { "cell_type": "markdown", + "metadata": {}, "source": [ "## Azure Sentinel queries in MSTICPy\r\n", "\r\n", "MSTICPy includes a number of built-in queries that you can run.
\r\n", "You can list available queries with .list_queries() and get specific details about a query by calling it with \"?\" as a parameter" - ], - "metadata": {} + ] }, { "cell_type": "code", "execution_count": 9, - "source": [ - "# Get a sample of available queries\r\n", - "print(\"Sample of queries\")\r\n", - "print(\"=================\")\r\n", - "print(qry_prov.list_queries()[::5]) # showing a sample - remove \"[::5]\" for whole list\r\n", - "\r\n", - "# Get help about a query by passing \"?\" as a parameter\r\n", - "print(\"\\nHelp for 'list_all_signins_geo' query\")\r\n", - "print(\"=====================================\")\r\n", - "qry_prov.Azure.list_all_signins_geo(\"?\")" - ], + "metadata": {}, "outputs": [ { - "output_type": "stream", "name": "stdout", + "output_type": "stream", "text": [ "Sample of queries\n", "=================\n", @@ -1183,79 +1054,56 @@ ] } ], - "metadata": {} + "source": [ + "# Get a sample of available queries\r\n", + "print(\"Sample of queries\")\r\n", + "print(\"=================\")\r\n", + "print(qry_prov.list_queries()[::5]) # showing a sample - remove \"[::5]\" for whole list\r\n", + "\r\n", + "# Get help about a query by passing \"?\" as a parameter\r\n", + "print(\"\\nHelp for 'list_all_signins_geo' query\")\r\n", + "print(\"=====================================\")\r\n", + "qry_prov.Azure.list_all_signins_geo(\"?\")" + ] }, { "cell_type": "markdown", + "metadata": {}, "source": [ - "## Query browser\r\n", - "\r\n", - "The query browser combines both of the previous functions in a scrollable\r\n", - "and filterable list.\r\n" - ], - "metadata": {} + "## Query browser\n", + "\n", + "The query browser combines both of the previous functions in a scrollable
\n", + "and filterable list. For the selected query, it shows the required and
\n", + "optional parameters, together with the full text of the query.
\n", + "\n", + "You cannot execute queries from the browser but you can copy and paste\n", + "the example shown below the help for each query.\n" + ] }, { "cell_type": "code", - "execution_count": 10, - "source": [ - "qry_prov.browse_queries()" - ], + "execution_count": 5, + "metadata": {}, "outputs": [ { - "output_type": "display_data", - "data": { - "text/plain": [ - "VBox(children=(Text(value='', description='Filter:', style=DescriptionStyle(description_width='initial')), Sel…" - ], - "application/vnd.jupyter.widget-view+json": { - "model_id": "a75c6015444b41669e90c4a255657739", - "version_major": 2, - "version_minor": 0 - } - }, - "metadata": {} - }, - { - "output_type": "display_data", - "data": { - "text/plain": [ - "" - ], - "text/html": [ - "
" - ] - }, - "metadata": {} - }, - { - "output_type": "display_data", - "data": { - "text/plain": [ - "" - ], - "text/html": [ - "

Gets Signin data used by morph charts

Parameters

add_query_items: str (optional)
Additional query clauses
end: datetime (optional)
Query end time
start: datetime (optional)
Query start time
(default value is: -5)
table: str (optional)
Table name
(default value is: SigninLogs)

Query

{table} \n",
-       "| where TimeGenerated >= datetime({start}) \n",
-       "| where TimeGenerated <= datetime({end}) \n",
-       "| extend Result = iif(ResultType==0, \"Sucess\", \"Failed\") \n",
-       "| extend Latitude = tostring(parse_json(tostring(LocationDetails.geoCoo\n",
-       "  rdinates)).latitude)\n",
-       "| extend Longitude = tostring(parse_json(tostring(LocationDetails.geoCo\n",
-       "  ordinates)).longitude)

\n", - "

Example

\n", - "

{QueryProvider}[.QueryPath].QueryName(params...)

\n", - " 
qry_prov.Azure.list_all_signins_geo(start=start, end=end, hostname=host)
\n", - " " - ] - }, - "metadata": {} + "output_type": "error", + "ename": "NameError", + "evalue": "name 'qry_prov' is not defined", + "traceback": [ + "\u001b[1;31m---------------------------------------------------------------------------\u001b[0m", + "\u001b[1;31mNameError\u001b[0m Traceback (most recent call last)", + "\u001b[1;32m\u001b[0m in \u001b[0;36m\u001b[1;34m\u001b[0m\n\u001b[1;32m----> 1\u001b[1;33m \u001b[0mqry_prov\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mbrowse_queries\u001b[0m\u001b[1;33m(\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n\u001b[0m", + "\u001b[1;31mNameError\u001b[0m: name 'qry_prov' is not defined" + ] } ], - "metadata": {} + "source": [ + "qry_prov.browse_queries()" + ] }, { "cell_type": "markdown", + "metadata": {}, "source": [ "## Run some queries\r\n", "\r\n", @@ -1267,36 +1115,36 @@ "Each query provider has its own `QueryTime` instance built-in. If the query\r\n", "needs \"start\" and \"end\" parameters and you do not supply them, the query\r\n", "will take the time from this built-in timerange control." - ], - "metadata": {} + ] }, { "cell_type": "code", "execution_count": 11, - "source": [ - "# Open the query time control for our query provider\r\n", - "qry_prov.query_time" - ], + "metadata": {}, "outputs": [ { - "output_type": "display_data", "data": { - "text/plain": [ - "VBox(children=(HTML(value='

Set query time boundaries

'), HBox(children=(DatePicker(value=datetime.date…" - ], "application/vnd.jupyter.widget-view+json": { "model_id": "7a9e1292eba0449dbcaac339234822e1", "version_major": 2, "version_minor": 0 - } + }, + "text/plain": [ + "VBox(children=(HTML(value='

Set query time boundaries

'), HBox(children=(DatePicker(value=datetime.date…" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" } ], - "metadata": {} + "source": [ + "# Open the query time control for our query provider\r\n", + "qry_prov.query_time" + ] }, { "cell_type": "markdown", + "metadata": {}, "source": [ "### Run a query using this time range.\r\n", "\r\n", @@ -1314,230 +1162,25 @@ " \r\n", "

\r\n", "\r\n" - ], - "metadata": {} + ] }, { "cell_type": "code", "execution_count": 13, - "source": [ - "# You can just pass the QueryTime object directly to the query.\r\n", - "# The QueryProvider will automatically\r\n", - "# extract the \"start\" and \"end\" parameters from it to use in the query.\r\n", - "signins_df = qry_prov.Azure.list_all_signins_geo()\r\n", - "\r\n", - "if signins_df.empty:\r\n", - " md(\"The query returned no rows for this time range. You might want to increase the time range\")\r\n", - "\r\n", - "# display first 5 rows of any results\r\n", - "signins_df.head() # If you have no data you will just see the column headings displayed" - ], + "metadata": {}, "outputs": [ { - "output_type": "execute_result", "data": { - "text/plain": [ - " TenantId SourceSystem \\\n", - "0 8ecf8077-cf51-4820-aadd-14040956f35d Azure AD \n", - "1 8ecf8077-cf51-4820-aadd-14040956f35d Azure AD \n", - "2 8ecf8077-cf51-4820-aadd-14040956f35d Azure AD \n", - "3 8ecf8077-cf51-4820-aadd-14040956f35d Azure AD \n", - "4 8ecf8077-cf51-4820-aadd-14040956f35d Azure AD \n", - "\n", - " TimeGenerated \\\n", - "0 2021-06-24 10:54:31.781000+00:00 \n", - "1 2021-06-24 10:59:01.605000+00:00 \n", - "2 2021-06-24 12:13:08.522000+00:00 \n", - "3 2021-06-24 12:54:30.090000+00:00 \n", - "4 2021-06-24 12:54:35.503000+00:00 \n", - "\n", - " ResourceId \\\n", - "0 /tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiam \n", - "1 /tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiam \n", - "2 /tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiam \n", - "3 /tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiam \n", - "4 /tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiam \n", - "\n", - " OperationName OperationVersion Category ResultType ResultSignature \\\n", - "0 Sign-in activity 1.0 SignInLogs 0 None \n", - "1 Sign-in activity 1.0 SignInLogs 0 None \n", - "2 Sign-in activity 1.0 SignInLogs 0 None \n", - "3 Sign-in activity 1.0 SignInLogs 0 None \n", - "4 Sign-in activity 1.0 SignInLogs 0 None \n", - "\n", - " ResultDescription DurationMs CorrelationId \\\n", - "0 0 e4b1520c-f679-43cf-bc75-a6261f2bee64 \n", - "1 0 4959f2c2-ef4e-4581-938a-5235ea2c5e01 \n", - "2 0 4d221809-3717-4d27-8987-2dd38ec7a039 \n", - "3 0 0deab40a-18d3-4ef2-ae1b-978d37f347a3 \n", - "4 0 fe6bf41b-a54f-4a57-b228-91328821aeca \n", - "\n", - " Resource ResourceGroup ResourceProvider \\\n", - "0 Microsoft.aadiam Microsoft.aadiam \n", - "1 Microsoft.aadiam Microsoft.aadiam \n", - "2 Microsoft.aadiam Microsoft.aadiam \n", - "3 Microsoft.aadiam Microsoft.aadiam \n", - "4 Microsoft.aadiam Microsoft.aadiam \n", + "text/html": [ + "
\n", + "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", + " OperationName OperationVersion Category ResultType ResultSignature \\\n", + "0 Sign-in activity 1.0 SignInLogs 0 None \n", + "1 Sign-in activity 1.0 SignInLogs 0 None \n", + "2 Sign-in activity 1.0 SignInLogs 0 None \n", + "3 Sign-in activity 1.0 SignInLogs 0 None \n", + "4 Sign-in activity 1.0 SignInLogs 0 None \n", + "\n", + " ResultDescription DurationMs CorrelationId \\\n", + "0 0 e4b1520c-f679-43cf-bc75-a6261f2bee64 \n", + "1 0 4959f2c2-ef4e-4581-938a-5235ea2c5e01 \n", + "2 0 4d221809-3717-4d27-8987-2dd38ec7a039 \n", + "3 0 0deab40a-18d3-4ef2-ae1b-978d37f347a3 \n", + "4 0 fe6bf41b-a54f-4a57-b228-91328821aeca \n", + "\n", + " Resource ResourceGroup ResourceProvider \\\n", + "0 Microsoft.aadiam Microsoft.aadiam \n", + "1 Microsoft.aadiam Microsoft.aadiam \n", + "2 Microsoft.aadiam Microsoft.aadiam \n", + "3 Microsoft.aadiam Microsoft.aadiam \n", + "4 Microsoft.aadiam Microsoft.aadiam \n", + "\n", + " Identity Level Location \\\n", + "0 On-Premises Directory Synchronization Service Account 4 US \n", + "1 On-Premises Directory Synchronization Service Account 4 \n", + "2 TARDIF Romain 4 FR \n", + "3 On-Premises Directory Synchronization Service Account 4 US \n", + "4 On-Premises Directory Synchronization Service Account 4 US \n", + "\n", + " AlternateSignInName \\\n", + "0 Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com \n", + "1 Sync_ContosoDc_d9f03d5ca7ff@seccxpninja.onmicrosoft.com \n", + "2 \n", + "3 Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com \n", + "4 Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com \n", + "\n", + " AppDisplayName \\\n", + "0 Microsoft Azure Active Directory Connect \n", + "1 Microsoft Azure Active Directory Connect \n", + "2 Azure Portal \n", + "3 Microsoft Azure Active Directory Connect \n", + "4 Microsoft Azure Active Directory Connect \n", + "\n", + " AppId \\\n", + "0 cb1056e2-e479-49de-ae31-7812af012ed8 \n", + "1 cb1056e2-e479-49de-ae31-7812af012ed8 \n", + "2 c44b4083-3bb0-49c1-b47d-974e53cbdf3c \n", + "3 cb1056e2-e479-49de-ae31-7812af012ed8 \n", + "4 cb1056e2-e479-49de-ae31-7812af012ed8 \n", + "\n", + " AuthenticationDetails \\\n", + "0 [\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-06-24T10:54:31.7816708+00:00\",\\r\\n \"authe... \n", + "1 [\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-06-24T10:59:01.605024+00:00\",\\r\\n \"authen... \n", + "2 [\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-06-24T12:13:08.5223794+00:00\",\\r\\n \"authe... \n", + "3 [\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-06-24T12:54:30.090702+00:00\",\\r\\n \"authen... \n", + "4 [\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-06-24T12:54:35.5030915+00:00\",\\r\\n \"authe... \n", + "\n", + " AuthenticationMethodsUsed \\\n", + "0 \n", + "1 \n", + "2 \n", + "3 \n", + "4 \n", + "\n", + " AuthenticationProcessingDetails \\\n", + "0 [\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n] \n", + "1 [\\r\\n {\\r\\n \"key\": \"Azure VNet private IP address\",\\r\\n \"value\": \"10.0.25.6\"\\r\\n },\\r\\n ... \n", + "2 [\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n] \n", + "3 [\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n] \n", + "4 [\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n] \n", + "\n", + " AuthenticationRequirement ... RiskLevelDuringSignIn RiskState \\\n", + "0 singleFactorAuthentication ... none none \n", + "1 singleFactorAuthentication ... none none \n", + "2 singleFactorAuthentication ... none none \n", + "3 singleFactorAuthentication ... none none \n", + "4 singleFactorAuthentication ... none none \n", + "\n", + " ResourceDisplayName ResourceIdentity \\\n", + "0 Windows Azure Active Directory 00000002-0000-0000-c000-000000000000 \n", + "1 Windows Azure Active Directory 00000002-0000-0000-c000-000000000000 \n", + "2 Windows Azure Service Management API 797f4846-ba00-4fd7-ba43-dac1f8f63013 \n", + "3 Windows Azure Active Directory 00000002-0000-0000-c000-000000000000 \n", + "4 Windows Azure Active Directory 00000002-0000-0000-c000-000000000000 \n", + "\n", + " ServicePrincipalId ServicePrincipalName Status TokenIssuerName \\\n", + "0 {'errorCode': 0} \n", + "1 {'errorCode': 0} \n", + "2 {'errorCode': 0} \n", + "3 {'errorCode': 0} \n", + "4 {'errorCode': 0} \n", + "\n", + " TokenIssuerType \\\n", + "0 AzureAD \n", + "1 AzureAD \n", + "2 AzureAD \n", + "3 AzureAD \n", + "4 AzureAD \n", + "\n", + " UserAgent \\\n", + "0 \n", + "1 \n", + "2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.438... \n", + "3 \n", + "4 \n", + "\n", + " UserDisplayName \\\n", + "0 On-Premises Directory Synchronization Service Account \n", + "1 On-Premises Directory Synchronization Service Account \n", + "2 TARDIF Romain \n", + "3 On-Premises Directory Synchronization Service Account \n", + "4 On-Premises Directory Synchronization Service Account \n", + "\n", + " UserId \\\n", + "0 2235a468-ad9c-4375-8008-0a7be76994a7 \n", + "1 6aefab94-ed97-4f02-a063-a4e0eb43272d \n", + "2 8afe91b2-b2f3-4f0e-8fcd-7fe16be389a7 \n", + "3 2235a468-ad9c-4375-8008-0a7be76994a7 \n", + "4 2235a468-ad9c-4375-8008-0a7be76994a7 \n", + "\n", + " UserPrincipalName \\\n", + "0 sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com \n", + "1 sync_contosodc_d9f03d5ca7ff@seccxpninja.onmicrosoft.com \n", + "2 romain.tardif@thalesgroup.com \n", + "3 sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com \n", + "4 sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com \n", + "\n", + " AADTenantId UserType FlaggedForReview \\\n", + "0 4b2462a4-bbee-495a-a0e1-f23ae524cc9c Member None \n", + "1 4b2462a4-bbee-495a-a0e1-f23ae524cc9c Member None \n", + "2 4b2462a4-bbee-495a-a0e1-f23ae524cc9c Guest None \n", + "3 4b2462a4-bbee-495a-a0e1-f23ae524cc9c Member None \n", + "4 4b2462a4-bbee-495a-a0e1-f23ae524cc9c Member None \n", + "\n", + " IPAddressFromResourceProvider \\\n", + "0 \n", + "1 \n", + "2 \n", + "3 \n", + "4 \n", + "\n", + " SignInIdentifier \\\n", + "0 Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com \n", + "1 Sync_ContosoDc_d9f03d5ca7ff@seccxpninja.onmicrosoft.com \n", + "2 \n", + "3 Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com \n", + "4 Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com \n", + "\n", + " SignInIdentifierType ResourceTenantId \\\n", + "0 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", + "1 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", + "2 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", + "3 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", + "4 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", + "\n", + " HomeTenantId Type Result \\\n", + "0 4b2462a4-bbee-495a-a0e1-f23ae524cc9c SigninLogs Sucess \n", + "1 4b2462a4-bbee-495a-a0e1-f23ae524cc9c SigninLogs Sucess \n", + "2 6e603289-5e46-4e26-ac7c-03a85420a9a5 SigninLogs Sucess \n", + "3 4b2462a4-bbee-495a-a0e1-f23ae524cc9c SigninLogs Sucess \n", + "4 4b2462a4-bbee-495a-a0e1-f23ae524cc9c SigninLogs Sucess \n", + "\n", + " Latitude Longitude \n", + "0 38.73078155517578 -78.17196655273438 \n", + "1 \n", + "2 48.782901763916019 1.9601000547409056 \n", + "3 38.73078155517578 -78.17196655273438 \n", + "4 38.73078155517578 -78.17196655273438 \n", + "\n", + "[5 rows x 69 columns]" + ] + }, + "execution_count": 13, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "# You can just pass the QueryTime object directly to the query.\r\n", + "# The QueryProvider will automatically\r\n", + "# extract the \"start\" and \"end\" parameters from it to use in the query.\r\n", + "signins_df = qry_prov.Azure.list_all_signins_geo()\r\n", + "\r\n", + "if signins_df.empty:\r\n", + " md(\"The query returned no rows for this time range. You might want to increase the time range\")\r\n", + "\r\n", + "# display first 5 rows of any results\r\n", + "signins_df.head() # If you have no data you will just see the column headings displayed" + ] + }, + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "## Customizable queries\r\n", + "\r\n", + "Most built-in queries support the \"add_query_items\" parameter.\r\n", + "You can use this to append additional filters or other operations to the built-in queries.\r\n", + "\r\n", + "Azure Sentinel queries use the Kusto Query Language (KQL).\r\n", + "\r\n", + "
Note:\r\n", + "If this query returns too many or too few results you can change the \"28\"\r\n", + "in the query below to a smaller or larger number of days.\r\n", + "
\r\n", + "
\r\n", + "\r\n", + "
\r\n", + " Learn more about KQL query syntax...\r\n", + "

\r\n", + " Kusto Query Language reference
\r\n", + "

\r\n", + "
\r\n", + "
\r\n" + ] + }, + { + "cell_type": "code", + "execution_count": 14, + "metadata": {}, + "outputs": [ + { + "data": { + "text/html": [ + "
\n", + "\n", + "
AlertNameNumAlerts
0Incident and Automation testing 01342
1
\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", " \n", " \n", " \n", @@ -2013,157 +1835,69 @@ " \n", " \n", " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
AlertNameNumAlerts
0Incident and Automation testing 01342
1Malicious credential theft tool execution detected1361
168Mail.Read Permissions Granted to Application1
169Mass Download1
\n", - "

170 rows × 2 columns

\n", - "
" - ] - }, - "metadata": {}, - "execution_count": 14 - } - ], - "metadata": {} - }, - { - "cell_type": "markdown", - "source": [ - "## Custom queries\r\n", - "\r\n", - "Another way to run queries is to pass a full KQL query string to the query provider.\r\n", - "\r\n", - "This will run the query against the workspace connected to above, and will return the data \r\n", - "as DataFrame.\r\n" - ], - "metadata": {} - }, - { - "cell_type": "code", - "execution_count": 15, - "source": [ - "# Define our query\r\n", - "test_query = \"\"\"\r\n", - "OfficeActivity\r\n", - "| where TimeGenerated > ago(1d)\r\n", - "| take 10\r\n", - "\"\"\"\r\n", - "\r\n", - "# Pass that query to our QueryProvider\r\n", - "office_events_df = qry_prov.exec_query(test_query)\r\n", - "display(office_events_df.head())\r\n" - ], - "outputs": [ - { - "output_type": "display_data", - "data": { - "text/plain": [ - " TenantId Application UserDomain UserAgent \\\n", - "0 8ecf8077-cf51-4820-aadd-14040956f35d \n", - "1 8ecf8077-cf51-4820-aadd-14040956f35d \n", - "2 8ecf8077-cf51-4820-aadd-14040956f35d \n", - "3 8ecf8077-cf51-4820-aadd-14040956f35d \n", - "4 8ecf8077-cf51-4820-aadd-14040956f35d \n", - "\n", - " RecordType TimeGenerated Operation \\\n", - "0 50 2021-06-25 11:41:34+00:00 MailItemsAccessed \n", - "1 50 2021-06-25 11:41:34+00:00 MailItemsAccessed \n", - "2 50 2021-06-25 12:10:49+00:00 MailItemsAccessed \n", - "3 50 2021-06-25 12:55:30+00:00 MailItemsAccessed \n", - "4 50 2021-06-25 12:55:30+00:00 MailItemsAccessed \n", - "\n", - " OrganizationId OrganizationId_ \\\n", - "0 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", - "1 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", - "2 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", - "3 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", - "4 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", - "\n", - " UserType UserKey OfficeWorkload ResultStatus ResultReasonType \\\n", - "0 Regular 1003BFFDAAD121E2 Exchange Succeeded Succeeded \n", - "1 Regular 1003BFFDAAD121E2 Exchange Succeeded Succeeded \n", - "2 Regular 100320003F88D275 Exchange Succeeded Succeeded \n", - "3 Regular 100320003F8A6FC7 Exchange Succeeded Succeeded \n", - "4 Regular 100320003F8A6FC7 Exchange Succeeded Succeeded \n", - "\n", - " OfficeObjectId UserId \\\n", - "0 pcadmin@seccxpninja.onmicrosoft.com \n", - "1 pcadmin@seccxpninja.onmicrosoft.com \n", - "2 seb@seccxp.ninja \n", - "3 MeganB@seccxp.ninja \n", - "4 MeganB@seccxp.ninja \n", - "\n", - " UserId_ ClientIP ClientIP_ Scope Site_ \\\n", - "0 pcadmin@seccxpninja.onmicrosoft.com \n", - "1 pcadmin@seccxpninja.onmicrosoft.com \n", - "2 seb@seccxp.ninja \n", - "3 MeganB@seccxp.ninja \n", - "4 MeganB@seccxp.ninja \n", - "\n", - " ItemType EventSource Source_Name MachineDomainInfo ... ChannelType \\\n", - "0 ... \n", - "1 ... \n", - "2 ... \n", - "3 ... \n", - "4 ... \n", - "\n", - " ChannelName ChannelGuid ExtraProperties AddOnType AddonName TabType Name \\\n", - "0 None \n", - "1 None \n", - "2 None \n", - "3 None \n", - "4 None \n", - "\n", - " OldValue NewValue ItemName ChatThreadId ChatName CommunicationType \\\n", - "0 \n", - "1 \n", - "2 \n", - "3 \n", - "4 \n", - "\n", - " AADGroupId AddOnGuid AppDistributionMode TargetUserId OperationScope \\\n", - "0 \n", - "1 \n", - "2 \n", - "3 \n", - "4 \n", - "\n", - " AzureADAppId \\\n", - "0 \n", - "1 \n", - "2 \n", - "3 \n", - "4 \n", - "\n", - " OperationProperties \\\n", - "0 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n", - "1 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n", - "2 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n", - "3 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n", - "4 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n", - "\n", - " AppId ClientAppId \\\n", - "0 7a5fbd1c-3e6d-461a-9075-83049393b3a7 7a5fbd1c-3e6d-461a-9075-83049393b3a7 \n", - "1 7a5fbd1c-3e6d-461a-9075-83049393b3a7 7a5fbd1c-3e6d-461a-9075-83049393b3a7 \n", - "2 7ab7862c-4c57-491e-8a45-d52a7e023983 \n", - "3 414a677a-e50f-46ea-b89c-aebb8a9efbe2 \n", - "4 414a677a-e50f-46ea-b89c-aebb8a9efbe2 \n", - "\n", - " Type _ResourceId \n", - "0 OfficeActivity \n", - "1 OfficeActivity \n", - "2 OfficeActivity \n", - "3 OfficeActivity \n", - "4 OfficeActivity \n", - "\n", - "[5 rows x 131 columns]" + " 1\n", + " \n", + " \n", + " 169\n", + " Mass Download\n", + " 1\n", + " \n", + " \n", + "\n", + "

170 rows × 2 columns

\n", + "" ], + "text/plain": [ + " AlertName NumAlerts\n", + "0 Incident and Automation testing 01 342\n", + "1 Malicious credential theft tool execution detected 1361\n", + "2 TI map IP entity to AzureActivity (enriched) 690\n", + "3 Possible contact with a domain generated by a DGA 24\n", + "4 Potential Password Spray 140\n", + ".. ... ...\n", + "165 PsExec execution detected 1\n", + "166 Rare application consent 1\n", + "167 Investigation priority score increase 2\n", + "168 Mail.Read Permissions Granted to Application 1\n", + "169 Mass Download 1\n", + "\n", + "[170 rows x 2 columns]" + ] + }, + "execution_count": 14, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "from datetime import datetime, timedelta\r\n", + "\r\n", + "qry_prov.SecurityAlert.list_alerts(\r\n", + " start=datetime.utcnow() - timedelta(28),\r\n", + " end=datetime.utcnow(),\r\n", + " add_query_items=\"| summarize NumAlerts=count() by AlertName\"\r\n", + ")" + ] + }, + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "## Custom queries\r\n", + "\r\n", + "Another way to run queries is to pass a full KQL query string to the query provider.\r\n", + "\r\n", + "This will run the query against the workspace connected to above, and will return the data \r\n", + "as DataFrame.\r\n" + ] + }, + { + "cell_type": "code", + "execution_count": 15, + "metadata": {}, + "outputs": [ + { + "data": { "text/html": [ "
\n", "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
TenantIdSourceSystemTimeGeneratedResourceIdOperationNameOperationVersionCategoryResultTypeResultSignatureResultDescriptionDurationMsCorrelationIdResourceResourceGroupResourceProviderIdentityLevelLocationAlternateSignInNameAppDisplayNameAppIdAuthenticationDetailsAuthenticationMethodsUsedAuthenticationProcessingDetailsAuthenticationRequirement...RiskLevelDuringSignInRiskStateResourceDisplayNameResourceIdentityServicePrincipalIdServicePrincipalNameStatusTokenIssuerNameTokenIssuerTypeUserAgentUserDisplayNameUserIdUserPrincipalNameAADTenantIdUserTypeFlaggedForReviewIPAddressFromResourceProviderSignInIdentifierSignInIdentifierTypeResourceTenantIdHomeTenantIdTypeResultLatitudeLongitude
08ecf8077-cf51-4820-aadd-14040956f35dAzure AD2021-06-24 10:54:31.781000+00:00/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiamSign-in activity1.0SignInLogs0None0e4b1520c-f679-43cf-bc75-a6261f2bee64Microsoft.aadiamMicrosoft.aadiamOn-Premises Directory Synchronization Service Account4USSync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.comMicrosoft Azure Active Directory Connectcb1056e2-e479-49de-ae31-7812af012ed8[\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-06-24T10:54:31.7816708+00:00\",\\r\\n \"authe...[\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n]singleFactorAuthentication...nonenoneWindows Azure Active Directory00000002-0000-0000-c000-000000000000{'errorCode': 0}AzureADOn-Premises Directory Synchronization Service Account2235a468-ad9c-4375-8008-0a7be76994a7sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9cMemberNoneSync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cSigninLogsSucess38.73078155517578-78.17196655273438
18ecf8077-cf51-4820-aadd-14040956f35dAzure AD2021-06-24 10:59:01.605000+00:00/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiamSign-in activity1.0SignInLogs0None04959f2c2-ef4e-4581-938a-5235ea2c5e01Microsoft.aadiamMicrosoft.aadiamOn-Premises Directory Synchronization Service Account4Sync_ContosoDc_d9f03d5ca7ff@seccxpninja.onmicrosoft.comMicrosoft Azure Active Directory Connectcb1056e2-e479-49de-ae31-7812af012ed8[\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-06-24T10:59:01.605024+00:00\",\\r\\n \"authen...[\\r\\n {\\r\\n \"key\": \"Azure VNet private IP address\",\\r\\n \"value\": \"10.0.25.6\"\\r\\n },\\r\\n ...singleFactorAuthentication...nonenoneWindows Azure Active Directory00000002-0000-0000-c000-000000000000{'errorCode': 0}AzureADOn-Premises Directory Synchronization Service Account6aefab94-ed97-4f02-a063-a4e0eb43272dsync_contosodc_d9f03d5ca7ff@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9cMemberNoneSync_ContosoDc_d9f03d5ca7ff@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cSigninLogsSucess
28ecf8077-cf51-4820-aadd-14040956f35dAzure AD2021-06-24 12:13:08.522000+00:00/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiamSign-in activity1.0SignInLogs0None04d221809-3717-4d27-8987-2dd38ec7a039Microsoft.aadiamMicrosoft.aadiamTARDIF Romain4FRAzure Portalc44b4083-3bb0-49c1-b47d-974e53cbdf3c[\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-06-24T12:13:08.5223794+00:00\",\\r\\n \"authe...[\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n]singleFactorAuthentication...nonenoneWindows Azure Service Management API797f4846-ba00-4fd7-ba43-dac1f8f63013{'errorCode': 0}AzureADMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.438...TARDIF Romain8afe91b2-b2f3-4f0e-8fcd-7fe16be389a7romain.tardif@thalesgroup.com4b2462a4-bbee-495a-a0e1-f23ae524cc9cGuestNone4b2462a4-bbee-495a-a0e1-f23ae524cc9c6e603289-5e46-4e26-ac7c-03a85420a9a5SigninLogsSucess48.7829017639160191.9601000547409056
38ecf8077-cf51-4820-aadd-14040956f35dAzure AD2021-06-24 12:54:30.090000+00:00/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiamSign-in activity1.0SignInLogs0None00deab40a-18d3-4ef2-ae1b-978d37f347a3Microsoft.aadiamMicrosoft.aadiamOn-Premises Directory Synchronization Service Account4USSync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.comMicrosoft Azure Active Directory Connectcb1056e2-e479-49de-ae31-7812af012ed8[\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-06-24T12:54:30.090702+00:00\",\\r\\n \"authen...[\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n]singleFactorAuthentication...nonenoneWindows Azure Active Directory00000002-0000-0000-c000-000000000000{'errorCode': 0}AzureADOn-Premises Directory Synchronization Service Account2235a468-ad9c-4375-8008-0a7be76994a7sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9cMemberNoneSync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cSigninLogsSucess38.73078155517578-78.17196655273438
48ecf8077-cf51-4820-aadd-14040956f35dAzure AD2021-06-24 12:54:35.503000+00:00/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiamSign-in activity1.0SignInLogs0None0fe6bf41b-a54f-4a57-b228-91328821aecaMicrosoft.aadiamMicrosoft.aadiamOn-Premises Directory Synchronization Service Account4USSync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.comMicrosoft Azure Active Directory Connectcb1056e2-e479-49de-ae31-7812af012ed8[\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-06-24T12:54:35.5030915+00:00\",\\r\\n \"authe...[\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n]singleFactorAuthentication...nonenoneWindows Azure Active Directory00000002-0000-0000-c000-000000000000{'errorCode': 0}AzureADOn-Premises Directory Synchronization Service Account2235a468-ad9c-4375-8008-0a7be76994a7sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9cMemberNoneSync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cSigninLogsSucess38.73078155517578-78.17196655273438
\n", - "

5 rows × 69 columns

\n", - "
" - ], "text/plain": [ " TenantId SourceSystem \\\n", "0 8ecf8077-cf51-4820-aadd-14040956f35d Azure AD \n", @@ -1528,11 +1193,11 @@ "4 8ecf8077-cf51-4820-aadd-14040956f35d Azure AD \n", "\n", " TimeGenerated \\\n", - "0 2021-06-24 10:54:31.781000+00:00 \n", - "1 2021-06-24 10:59:01.605000+00:00 \n", - "2 2021-06-24 12:13:08.522000+00:00 \n", - "3 2021-06-24 12:54:30.090000+00:00 \n", - "4 2021-06-24 12:54:35.503000+00:00 \n", + "0 2021-07-14 10:56:30.062000+00:00 \n", + "1 2021-07-14 10:56:34.868000+00:00 \n", + "2 2021-07-14 10:58:50.835000+00:00 \n", + "3 2021-07-14 10:58:56.135000+00:00 \n", + "4 2021-07-14 11:26:30.812000+00:00 \n", "\n", " ResourceId \\\n", "0 /tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiam \n", @@ -1549,11 +1214,11 @@ "4 Sign-in activity 1.0 SignInLogs 0 None \n", "\n", " ResultDescription DurationMs CorrelationId \\\n", - "0 0 e4b1520c-f679-43cf-bc75-a6261f2bee64 \n", - "1 0 4959f2c2-ef4e-4581-938a-5235ea2c5e01 \n", - "2 0 4d221809-3717-4d27-8987-2dd38ec7a039 \n", - "3 0 0deab40a-18d3-4ef2-ae1b-978d37f347a3 \n", - "4 0 fe6bf41b-a54f-4a57-b228-91328821aeca \n", + "0 0 0a4ca097-b33d-4ed7-a19e-ad34bc299cd0 \n", + "1 0 dc57cafa-79fc-4c8e-83bc-c98e2ea9e3d8 \n", + "2 0 c08798f2-1c1e-4aba-a21b-74f8980ba40b \n", + "3 0 7c229664-97a5-4621-b5f9-31fa223c5952 \n", + "4 0 5d31f207-8c2f-4c19-ada8-4a89630a7b1e \n", "\n", " Resource ResourceGroup ResourceProvider \\\n", "0 Microsoft.aadiam Microsoft.aadiam \n", @@ -1564,38 +1229,38 @@ "\n", " Identity Level Location \\\n", "0 On-Premises Directory Synchronization Service Account 4 US \n", - "1 On-Premises Directory Synchronization Service Account 4 \n", - "2 TARDIF Romain 4 FR \n", + "1 On-Premises Directory Synchronization Service Account 4 US \n", + "2 On-Premises Directory Synchronization Service Account 4 US \n", "3 On-Premises Directory Synchronization Service Account 4 US \n", "4 On-Premises Directory Synchronization Service Account 4 US \n", "\n", - " AlternateSignInName \\\n", - "0 Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com \n", - "1 Sync_ContosoDc_d9f03d5ca7ff@seccxpninja.onmicrosoft.com \n", - "2 \n", - "3 Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com \n", - "4 Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com \n", + " AlternateSignInName \\\n", + "0 Sync_DC01_3862ce34675f@seccxpninja.onmicrosoft.com \n", + "1 Sync_DC01_3862ce34675f@seccxpninja.onmicrosoft.com \n", + "2 Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com \n", + "3 Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com \n", + "4 Sync_DC01_3862ce34675f@seccxpninja.onmicrosoft.com \n", "\n", " AppDisplayName \\\n", "0 Microsoft Azure Active Directory Connect \n", "1 Microsoft Azure Active Directory Connect \n", - "2 Azure Portal \n", + "2 Microsoft Azure Active Directory Connect \n", "3 Microsoft Azure Active Directory Connect \n", "4 Microsoft Azure Active Directory Connect \n", "\n", " AppId \\\n", "0 cb1056e2-e479-49de-ae31-7812af012ed8 \n", "1 cb1056e2-e479-49de-ae31-7812af012ed8 \n", - "2 c44b4083-3bb0-49c1-b47d-974e53cbdf3c \n", + "2 cb1056e2-e479-49de-ae31-7812af012ed8 \n", "3 cb1056e2-e479-49de-ae31-7812af012ed8 \n", "4 cb1056e2-e479-49de-ae31-7812af012ed8 \n", "\n", " AuthenticationDetails \\\n", - "0 [\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-06-24T10:54:31.7816708+00:00\",\\r\\n \"authe... \n", - "1 [\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-06-24T10:59:01.605024+00:00\",\\r\\n \"authen... \n", - "2 [\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-06-24T12:13:08.5223794+00:00\",\\r\\n \"authe... \n", - "3 [\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-06-24T12:54:30.090702+00:00\",\\r\\n \"authen... \n", - "4 [\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-06-24T12:54:35.5030915+00:00\",\\r\\n \"authe... \n", + "0 [\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-07-14T10:56:30.0626249+00:00\",\\r\\n \"authe... \n", + "1 [\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-07-14T10:56:34.8688399+00:00\",\\r\\n \"authe... \n", + "2 [\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-07-14T10:58:50.8358827+00:00\",\\r\\n \"authe... \n", + "3 [\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-07-14T10:58:56.1354096+00:00\",\\r\\n \"authe... \n", + "4 [\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-07-14T11:26:30.8128251+00:00\",\\r\\n \"authe... \n", "\n", " AuthenticationMethodsUsed \\\n", "0 \n", @@ -1604,12 +1269,12 @@ "3 \n", "4 \n", "\n", - " AuthenticationProcessingDetails \\\n", - "0 [\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n] \n", - "1 [\\r\\n {\\r\\n \"key\": \"Azure VNet private IP address\",\\r\\n \"value\": \"10.0.25.6\"\\r\\n },\\r\\n ... \n", - "2 [\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n] \n", - "3 [\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n] \n", - "4 [\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n] \n", + " AuthenticationProcessingDetails \\\n", + "0 [\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n] \n", + "1 [\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n] \n", + "2 [\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n] \n", + "3 [\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n] \n", + "4 [\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n] \n", "\n", " AuthenticationRequirement ... RiskLevelDuringSignIn RiskState \\\n", "0 singleFactorAuthentication ... none none \n", @@ -1618,12 +1283,12 @@ "3 singleFactorAuthentication ... none none \n", "4 singleFactorAuthentication ... none none \n", "\n", - " ResourceDisplayName ResourceIdentity \\\n", - "0 Windows Azure Active Directory 00000002-0000-0000-c000-000000000000 \n", - "1 Windows Azure Active Directory 00000002-0000-0000-c000-000000000000 \n", - "2 Windows Azure Service Management API 797f4846-ba00-4fd7-ba43-dac1f8f63013 \n", - "3 Windows Azure Active Directory 00000002-0000-0000-c000-000000000000 \n", - "4 Windows Azure Active Directory 00000002-0000-0000-c000-000000000000 \n", + " ResourceDisplayName ResourceIdentity \\\n", + "0 Windows Azure Active Directory 00000002-0000-0000-c000-000000000000 \n", + "1 Windows Azure Active Directory 00000002-0000-0000-c000-000000000000 \n", + "2 Windows Azure Active Directory 00000002-0000-0000-c000-000000000000 \n", + "3 Windows Azure Active Directory 00000002-0000-0000-c000-000000000000 \n", + "4 Windows Azure Active Directory 00000002-0000-0000-c000-000000000000 \n", "\n", " ServicePrincipalId ServicePrincipalName Status TokenIssuerName \\\n", "0 {'errorCode': 0} \n", @@ -1632,45 +1297,38 @@ "3 {'errorCode': 0} \n", "4 {'errorCode': 0} \n", "\n", - " TokenIssuerType \\\n", - "0 AzureAD \n", - "1 AzureAD \n", - "2 AzureAD \n", - "3 AzureAD \n", - "4 AzureAD \n", - "\n", - " UserAgent \\\n", - "0 \n", - "1 \n", - "2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.438... \n", - "3 \n", - "4 \n", + " TokenIssuerType UserAgent \\\n", + "0 AzureAD \n", + "1 AzureAD \n", + "2 AzureAD \n", + "3 AzureAD \n", + "4 AzureAD \n", "\n", " UserDisplayName \\\n", "0 On-Premises Directory Synchronization Service Account \n", "1 On-Premises Directory Synchronization Service Account \n", - "2 TARDIF Romain \n", + "2 On-Premises Directory Synchronization Service Account \n", "3 On-Premises Directory Synchronization Service Account \n", "4 On-Premises Directory Synchronization Service Account \n", "\n", " UserId \\\n", - "0 2235a468-ad9c-4375-8008-0a7be76994a7 \n", - "1 6aefab94-ed97-4f02-a063-a4e0eb43272d \n", - "2 8afe91b2-b2f3-4f0e-8fcd-7fe16be389a7 \n", + "0 ee856d98-cecd-4dbe-8833-bdeec67847d0 \n", + "1 ee856d98-cecd-4dbe-8833-bdeec67847d0 \n", + "2 2235a468-ad9c-4375-8008-0a7be76994a7 \n", "3 2235a468-ad9c-4375-8008-0a7be76994a7 \n", - "4 2235a468-ad9c-4375-8008-0a7be76994a7 \n", + "4 ee856d98-cecd-4dbe-8833-bdeec67847d0 \n", "\n", - " UserPrincipalName \\\n", - "0 sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com \n", - "1 sync_contosodc_d9f03d5ca7ff@seccxpninja.onmicrosoft.com \n", - "2 romain.tardif@thalesgroup.com \n", - "3 sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com \n", - "4 sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com \n", + " UserPrincipalName \\\n", + "0 sync_dc01_3862ce34675f@seccxpninja.onmicrosoft.com \n", + "1 sync_dc01_3862ce34675f@seccxpninja.onmicrosoft.com \n", + "2 sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com \n", + "3 sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com \n", + "4 sync_dc01_3862ce34675f@seccxpninja.onmicrosoft.com \n", "\n", " AADTenantId UserType FlaggedForReview \\\n", "0 4b2462a4-bbee-495a-a0e1-f23ae524cc9c Member None \n", "1 4b2462a4-bbee-495a-a0e1-f23ae524cc9c Member None \n", - "2 4b2462a4-bbee-495a-a0e1-f23ae524cc9c Guest None \n", + "2 4b2462a4-bbee-495a-a0e1-f23ae524cc9c Member None \n", "3 4b2462a4-bbee-495a-a0e1-f23ae524cc9c Member None \n", "4 4b2462a4-bbee-495a-a0e1-f23ae524cc9c Member None \n", "\n", @@ -1681,52 +1339,44 @@ "3 \n", "4 \n", "\n", - " SignInIdentifier \\\n", - "0 Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com \n", - "1 Sync_ContosoDc_d9f03d5ca7ff@seccxpninja.onmicrosoft.com \n", - "2 \n", - "3 Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com \n", - "4 Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com \n", - "\n", - " SignInIdentifierType ResourceTenantId \\\n", - "0 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", - "1 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", - "2 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", - "3 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", - "4 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", + " SignInIdentifier SignInIdentifierType \\\n", + "0 Sync_DC01_3862ce34675f@seccxpninja.onmicrosoft.com \n", + "1 Sync_DC01_3862ce34675f@seccxpninja.onmicrosoft.com \n", + "2 Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com \n", + "3 Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com \n", + "4 Sync_DC01_3862ce34675f@seccxpninja.onmicrosoft.com \n", "\n", - " HomeTenantId Type Result \\\n", - "0 4b2462a4-bbee-495a-a0e1-f23ae524cc9c SigninLogs Sucess \n", - "1 4b2462a4-bbee-495a-a0e1-f23ae524cc9c SigninLogs Sucess \n", - "2 6e603289-5e46-4e26-ac7c-03a85420a9a5 SigninLogs Sucess \n", - "3 4b2462a4-bbee-495a-a0e1-f23ae524cc9c SigninLogs Sucess \n", - "4 4b2462a4-bbee-495a-a0e1-f23ae524cc9c SigninLogs Sucess \n", + " ResourceTenantId HomeTenantId \\\n", + "0 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", + "1 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", + "2 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", + "3 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", + "4 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", "\n", - " Latitude Longitude \n", - "0 38.73078155517578 -78.17196655273438 \n", - "1 \n", - "2 48.782901763916019 1.9601000547409056 \n", - "3 38.73078155517578 -78.17196655273438 \n", - "4 38.73078155517578 -78.17196655273438 \n", + " Type Result Latitude Longitude \n", + "0 SigninLogs Sucess 38.73078155517578 -78.17196655273438 \n", + "1 SigninLogs Sucess 38.73078155517578 -78.17196655273438 \n", + "2 SigninLogs Sucess 38.7130012512207 -78.15899658203125 \n", + "3 SigninLogs Sucess 38.7130012512207 -78.15899658203125 \n", + "4 SigninLogs Sucess 38.7130012512207 -78.15899658203125 \n", "\n", "[5 rows x 69 columns]" - ] + ], + "text/html": "
\n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
TenantIdSourceSystemTimeGeneratedResourceIdOperationNameOperationVersionCategoryResultTypeResultSignatureResultDescriptionDurationMsCorrelationIdResourceResourceGroupResourceProviderIdentityLevelLocationAlternateSignInNameAppDisplayNameAppIdAuthenticationDetailsAuthenticationMethodsUsedAuthenticationProcessingDetailsAuthenticationRequirement...RiskLevelDuringSignInRiskStateResourceDisplayNameResourceIdentityServicePrincipalIdServicePrincipalNameStatusTokenIssuerNameTokenIssuerTypeUserAgentUserDisplayNameUserIdUserPrincipalNameAADTenantIdUserTypeFlaggedForReviewIPAddressFromResourceProviderSignInIdentifierSignInIdentifierTypeResourceTenantIdHomeTenantIdTypeResultLatitudeLongitude
08ecf8077-cf51-4820-aadd-14040956f35dAzure AD2021-07-14 10:56:30.062000+00:00/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiamSign-in activity1.0SignInLogs0None00a4ca097-b33d-4ed7-a19e-ad34bc299cd0Microsoft.aadiamMicrosoft.aadiamOn-Premises Directory Synchronization Service Account4USSync_DC01_3862ce34675f@seccxpninja.onmicrosoft.comMicrosoft Azure Active Directory Connectcb1056e2-e479-49de-ae31-7812af012ed8[\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-07-14T10:56:30.0626249+00:00\",\\r\\n \"authe...[\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n]singleFactorAuthentication...nonenoneWindows Azure Active Directory00000002-0000-0000-c000-000000000000{'errorCode': 0}AzureADOn-Premises Directory Synchronization Service Accountee856d98-cecd-4dbe-8833-bdeec67847d0sync_dc01_3862ce34675f@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9cMemberNoneSync_DC01_3862ce34675f@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cSigninLogsSucess38.73078155517578-78.17196655273438
18ecf8077-cf51-4820-aadd-14040956f35dAzure AD2021-07-14 10:56:34.868000+00:00/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiamSign-in activity1.0SignInLogs0None0dc57cafa-79fc-4c8e-83bc-c98e2ea9e3d8Microsoft.aadiamMicrosoft.aadiamOn-Premises Directory Synchronization Service Account4USSync_DC01_3862ce34675f@seccxpninja.onmicrosoft.comMicrosoft Azure Active Directory Connectcb1056e2-e479-49de-ae31-7812af012ed8[\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-07-14T10:56:34.8688399+00:00\",\\r\\n \"authe...[\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n]singleFactorAuthentication...nonenoneWindows Azure Active Directory00000002-0000-0000-c000-000000000000{'errorCode': 0}AzureADOn-Premises Directory Synchronization Service Accountee856d98-cecd-4dbe-8833-bdeec67847d0sync_dc01_3862ce34675f@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9cMemberNoneSync_DC01_3862ce34675f@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cSigninLogsSucess38.73078155517578-78.17196655273438
28ecf8077-cf51-4820-aadd-14040956f35dAzure AD2021-07-14 10:58:50.835000+00:00/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiamSign-in activity1.0SignInLogs0None0c08798f2-1c1e-4aba-a21b-74f8980ba40bMicrosoft.aadiamMicrosoft.aadiamOn-Premises Directory Synchronization Service Account4USSync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.comMicrosoft Azure Active Directory Connectcb1056e2-e479-49de-ae31-7812af012ed8[\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-07-14T10:58:50.8358827+00:00\",\\r\\n \"authe...[\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n]singleFactorAuthentication...nonenoneWindows Azure Active Directory00000002-0000-0000-c000-000000000000{'errorCode': 0}AzureADOn-Premises Directory Synchronization Service Account2235a468-ad9c-4375-8008-0a7be76994a7sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9cMemberNoneSync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cSigninLogsSucess38.7130012512207-78.15899658203125
38ecf8077-cf51-4820-aadd-14040956f35dAzure AD2021-07-14 10:58:56.135000+00:00/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiamSign-in activity1.0SignInLogs0None07c229664-97a5-4621-b5f9-31fa223c5952Microsoft.aadiamMicrosoft.aadiamOn-Premises Directory Synchronization Service Account4USSync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.comMicrosoft Azure Active Directory Connectcb1056e2-e479-49de-ae31-7812af012ed8[\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-07-14T10:58:56.1354096+00:00\",\\r\\n \"authe...[\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n]singleFactorAuthentication...nonenoneWindows Azure Active Directory00000002-0000-0000-c000-000000000000{'errorCode': 0}AzureADOn-Premises Directory Synchronization Service Account2235a468-ad9c-4375-8008-0a7be76994a7sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9cMemberNoneSync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cSigninLogsSucess38.7130012512207-78.15899658203125
48ecf8077-cf51-4820-aadd-14040956f35dAzure AD2021-07-14 11:26:30.812000+00:00/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiamSign-in activity1.0SignInLogs0None05d31f207-8c2f-4c19-ada8-4a89630a7b1eMicrosoft.aadiamMicrosoft.aadiamOn-Premises Directory Synchronization Service Account4USSync_DC01_3862ce34675f@seccxpninja.onmicrosoft.comMicrosoft Azure Active Directory Connectcb1056e2-e479-49de-ae31-7812af012ed8[\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-07-14T11:26:30.8128251+00:00\",\\r\\n \"authe...[\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n]singleFactorAuthentication...nonenoneWindows Azure Active Directory00000002-0000-0000-c000-000000000000{'errorCode': 0}AzureADOn-Premises Directory Synchronization Service Accountee856d98-cecd-4dbe-8833-bdeec67847d0sync_dc01_3862ce34675f@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9cMemberNoneSync_DC01_3862ce34675f@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cSigninLogsSucess38.7130012512207-78.15899658203125
\n

5 rows × 69 columns

\n
" }, - "execution_count": 13, "metadata": {}, - "output_type": "execute_result" + "execution_count": 12 } ], "source": [ - "# You can just pass the QueryTime object directly to the query.\r\n", - "# The QueryProvider will automatically\r\n", - "# extract the \"start\" and \"end\" parameters from it to use in the query.\r\n", - "signins_df = qry_prov.Azure.list_all_signins_geo()\r\n", - "\r\n", - "if signins_df.empty:\r\n", - " md(\"The query returned no rows for this time range. You might want to increase the time range\")\r\n", - "\r\n", - "# display first 5 rows of any results\r\n", + "# The time parameters are taken from the qry_prov time settings\n", + "# but you can override this by supplying explict \"start\" and \"end\" datetimes\n", + "signins_df = qry_prov.Azure.list_all_signins_geo()\n", + "\n", + "if signins_df.empty:\n", + " md(\"The query returned no rows for this time range. You might want to increase the time range\")\n", + "\n", + "# display first 5 rows of any results\n", "signins_df.head() # If you have no data you will just see the column headings displayed" ] }, @@ -1758,124 +1408,62 @@ }, { "cell_type": "code", - "execution_count": 14, + "execution_count": 13, "metadata": {}, "outputs": [ { + "output_type": "display_data", + "data": { + "text/plain": "", + "application/javascript": "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}" + }, + "metadata": {} + }, + { + "output_type": "execute_result", "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
AlertNameNumAlerts
0Incident and Automation testing 01342
1Malicious credential theft tool execution detected1361
2TI map IP entity to AzureActivity (enriched)690
3Possible contact with a domain generated by a DGA24
4Potential Password Spray140
.........
165PsExec execution detected1
166Rare application consent1
167Investigation priority score increase2
168Mail.Read Permissions Granted to Application1
169Mass Download1
\n", - "

170 rows × 2 columns

\n", - "
" + "[178 rows x 2 columns]" ], - "text/plain": [ - " AlertName NumAlerts\n", - "0 Incident and Automation testing 01 342\n", - "1 Malicious credential theft tool execution detected 1361\n", - "2 TI map IP entity to AzureActivity (enriched) 690\n", - "3 Possible contact with a domain generated by a DGA 24\n", - "4 Potential Password Spray 140\n", - ".. ... ...\n", - "165 PsExec execution detected 1\n", - "166 Rare application consent 1\n", - "167 Investigation priority score increase 2\n", - "168 Mail.Read Permissions Granted to Application 1\n", - "169 Mass Download 1\n", - "\n", - "[170 rows x 2 columns]" - ] + "text/html": "
\n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
AlertNameNumAlerts
0Malicious credential theft tool execution detected47
1Suspicious PowerShell command line22
2Suspected DCSync attack (replication of directory services)13
3Suspicious service registration15
4Irregular creation of Azure resources13
.........
173Password set to never expires1
174test1
175Suspicion of NotPetya Malware - Illegal SMB Transaction Detected1
176Suspicion of NotPetya Malware - Illegal SMB Parameters Detected1
177Invalid SMB Message (DoublePulsar Backdoor Implant)1
\n

178 rows × 2 columns

\n
" }, - "execution_count": 14, "metadata": {}, - "output_type": "execute_result" + "execution_count": 13 } ], "source": [ - "from datetime import datetime, timedelta\r\n", - "\r\n", - "qry_prov.SecurityAlert.list_alerts(\r\n", - " start=datetime.utcnow() - timedelta(28),\r\n", - " end=datetime.utcnow(),\r\n", - " add_query_items=\"| summarize NumAlerts=count() by AlertName\"\r\n", + "from datetime import datetime, timedelta\n", + "\n", + "qry_prov.SecurityAlert.list_alerts(\n", + " start=datetime.utcnow() - timedelta(28),\n", + " end=datetime.utcnow(),\n", + " add_query_items=\"| summarize NumAlerts=count() by AlertName\"\n", ")" ] }, @@ -1893,476 +1481,37 @@ }, { "cell_type": "code", - "execution_count": 15, + "execution_count": 14, "metadata": {}, "outputs": [ { + "output_type": "display_data", "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
TenantIdApplicationUserDomainUserAgentRecordTypeTimeGeneratedOperationOrganizationIdOrganizationId_UserTypeUserKeyOfficeWorkloadResultStatusResultReasonTypeOfficeObjectIdUserIdUserId_ClientIPClientIP_ScopeSite_ItemTypeEventSourceSource_NameMachineDomainInfo...ChannelTypeChannelNameChannelGuidExtraPropertiesAddOnTypeAddonNameTabTypeNameOldValueNewValueItemNameChatThreadIdChatNameCommunicationTypeAADGroupIdAddOnGuidAppDistributionModeTargetUserIdOperationScopeAzureADAppIdOperationPropertiesAppIdClientAppIdType_ResourceId
08ecf8077-cf51-4820-aadd-14040956f35d502021-06-25 11:41:34+00:00MailItemsAccessed4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cRegular1003BFFDAAD121E2ExchangeSucceededSucceededpcadmin@seccxpninja.onmicrosoft.compcadmin@seccxpninja.onmicrosoft.com...None[{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}]7a5fbd1c-3e6d-461a-9075-83049393b3a77a5fbd1c-3e6d-461a-9075-83049393b3a7OfficeActivity
18ecf8077-cf51-4820-aadd-14040956f35d502021-06-25 11:41:34+00:00MailItemsAccessed4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cRegular1003BFFDAAD121E2ExchangeSucceededSucceededpcadmin@seccxpninja.onmicrosoft.compcadmin@seccxpninja.onmicrosoft.com...None[{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}]7a5fbd1c-3e6d-461a-9075-83049393b3a77a5fbd1c-3e6d-461a-9075-83049393b3a7OfficeActivity
28ecf8077-cf51-4820-aadd-14040956f35d502021-06-25 12:10:49+00:00MailItemsAccessed4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cRegular100320003F88D275ExchangeSucceededSucceededseb@seccxp.ninjaseb@seccxp.ninja...None[{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}]7ab7862c-4c57-491e-8a45-d52a7e023983OfficeActivity
38ecf8077-cf51-4820-aadd-14040956f35d502021-06-25 12:55:30+00:00MailItemsAccessed4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cRegular100320003F8A6FC7ExchangeSucceededSucceededMeganB@seccxp.ninjaMeganB@seccxp.ninja...None[{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}]414a677a-e50f-46ea-b89c-aebb8a9efbe2OfficeActivity
48ecf8077-cf51-4820-aadd-14040956f35d502021-06-25 12:55:30+00:00MailItemsAccessed4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cRegular100320003F8A6FC7ExchangeSucceededSucceededMeganB@seccxp.ninjaMeganB@seccxp.ninja...None[{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}]414a677a-e50f-46ea-b89c-aebb8a9efbe2OfficeActivity
\n", - "

5 rows × 131 columns

\n", - "
" - ], - "text/plain": [ - " TenantId Application UserDomain UserAgent \\\n", - "0 8ecf8077-cf51-4820-aadd-14040956f35d \n", - "1 8ecf8077-cf51-4820-aadd-14040956f35d \n", - "2 8ecf8077-cf51-4820-aadd-14040956f35d \n", - "3 8ecf8077-cf51-4820-aadd-14040956f35d \n", - "4 8ecf8077-cf51-4820-aadd-14040956f35d \n", - "\n", - " RecordType TimeGenerated Operation \\\n", - "0 50 2021-06-25 11:41:34+00:00 MailItemsAccessed \n", - "1 50 2021-06-25 11:41:34+00:00 MailItemsAccessed \n", - "2 50 2021-06-25 12:10:49+00:00 MailItemsAccessed \n", - "3 50 2021-06-25 12:55:30+00:00 MailItemsAccessed \n", - "4 50 2021-06-25 12:55:30+00:00 MailItemsAccessed \n", - "\n", - " OrganizationId OrganizationId_ \\\n", - "0 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", - "1 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", - "2 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", - "3 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", - "4 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", - "\n", - " UserType UserKey OfficeWorkload ResultStatus ResultReasonType \\\n", - "0 Regular 1003BFFDAAD121E2 Exchange Succeeded Succeeded \n", - "1 Regular 1003BFFDAAD121E2 Exchange Succeeded Succeeded \n", - "2 Regular 100320003F88D275 Exchange Succeeded Succeeded \n", - "3 Regular 100320003F8A6FC7 Exchange Succeeded Succeeded \n", - "4 Regular 100320003F8A6FC7 Exchange Succeeded Succeeded \n", - "\n", - " OfficeObjectId UserId \\\n", - "0 pcadmin@seccxpninja.onmicrosoft.com \n", - "1 pcadmin@seccxpninja.onmicrosoft.com \n", - "2 seb@seccxp.ninja \n", - "3 MeganB@seccxp.ninja \n", - "4 MeganB@seccxp.ninja \n", - "\n", - " UserId_ ClientIP ClientIP_ Scope Site_ \\\n", - "0 pcadmin@seccxpninja.onmicrosoft.com \n", - "1 pcadmin@seccxpninja.onmicrosoft.com \n", - "2 seb@seccxp.ninja \n", - "3 MeganB@seccxp.ninja \n", - "4 MeganB@seccxp.ninja \n", - "\n", - " ItemType EventSource Source_Name MachineDomainInfo ... ChannelType \\\n", - "0 ... \n", - "1 ... \n", - "2 ... \n", - "3 ... \n", - "4 ... \n", - "\n", - " ChannelName ChannelGuid ExtraProperties AddOnType AddonName TabType Name \\\n", - "0 None \n", - "1 None \n", - "2 None \n", - "3 None \n", - "4 None \n", - "\n", - " OldValue NewValue ItemName ChatThreadId ChatName CommunicationType \\\n", - "0 \n", - "1 \n", - "2 \n", - "3 \n", - "4 \n", - "\n", - " AADGroupId AddOnGuid AppDistributionMode TargetUserId OperationScope \\\n", - "0 \n", - "1 \n", - "2 \n", - "3 \n", - "4 \n", - "\n", - " AzureADAppId \\\n", - "0 \n", - "1 \n", - "2 \n", - "3 \n", - "4 \n", - "\n", - " OperationProperties \\\n", - "0 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n", - "1 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n", - "2 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n", - "3 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n", - "4 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n", - "\n", - " AppId ClientAppId \\\n", - "0 7a5fbd1c-3e6d-461a-9075-83049393b3a7 7a5fbd1c-3e6d-461a-9075-83049393b3a7 \n", - "1 7a5fbd1c-3e6d-461a-9075-83049393b3a7 7a5fbd1c-3e6d-461a-9075-83049393b3a7 \n", - "2 7ab7862c-4c57-491e-8a45-d52a7e023983 \n", - "3 414a677a-e50f-46ea-b89c-aebb8a9efbe2 \n", - "4 414a677a-e50f-46ea-b89c-aebb8a9efbe2 \n", - "\n", - " Type _ResourceId \n", - "0 OfficeActivity \n", - "1 OfficeActivity \n", - "2 OfficeActivity \n", - "3 OfficeActivity \n", - "4 OfficeActivity \n", - "\n", - "[5 rows x 131 columns]" - ] + "text/plain": "", + "application/javascript": "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}" }, - "metadata": {}, - "output_type": "display_data" + "metadata": {} + }, + { + "output_type": "display_data", + "data": { + "text/plain": " TenantId Application UserDomain UserAgent \\\n0 8ecf8077-cf51-4820-aadd-14040956f35d \n1 8ecf8077-cf51-4820-aadd-14040956f35d \n2 8ecf8077-cf51-4820-aadd-14040956f35d \n3 8ecf8077-cf51-4820-aadd-14040956f35d \n4 8ecf8077-cf51-4820-aadd-14040956f35d \n\n RecordType TimeGenerated Operation \\\n0 50 2021-07-14 11:20:44+00:00 MailItemsAccessed \n1 50 2021-07-14 11:20:44+00:00 MailItemsAccessed \n2 50 2021-07-14 12:38:41+00:00 MailItemsAccessed \n3 50 2021-07-14 12:38:41+00:00 MailItemsAccessed \n4 50 2021-07-14 12:38:41+00:00 MailItemsAccessed \n\n OrganizationId OrganizationId_ \\\n0 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n1 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n2 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n3 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n4 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n\n UserType UserKey OfficeWorkload ResultStatus ResultReasonType \\\n0 Regular 100320003C017CC9 Exchange Succeeded Succeeded \n1 Regular 100320003C017CC9 Exchange Succeeded Succeeded \n2 Regular 100320003F8A6FC7 Exchange Succeeded Succeeded \n3 Regular 100320003F8A6FC7 Exchange Succeeded Succeeded \n4 Regular 100320003F8A6FC7 Exchange Succeeded Succeeded \n\n OfficeObjectId UserId \\\n0 FMorris@seccxpninja.onmicrosoft.com \n1 FMorris@seccxpninja.onmicrosoft.com \n2 MeganB@seccxp.ninja \n3 MeganB@seccxp.ninja \n4 MeganB@seccxp.ninja \n\n UserId_ ClientIP ClientIP_ Scope Site_ \\\n0 FMorris@seccxpninja.onmicrosoft.com \n1 FMorris@seccxpninja.onmicrosoft.com \n2 MeganB@seccxp.ninja \n3 MeganB@seccxp.ninja \n4 MeganB@seccxp.ninja \n\n ItemType EventSource Source_Name MachineDomainInfo ... ChannelType \\\n0 ... \n1 ... \n2 ... \n3 ... \n4 ... \n\n ChannelName ChannelGuid ExtraProperties AddOnType AddonName TabType Name \\\n0 None \n1 None \n2 None \n3 None \n4 None \n\n OldValue NewValue ItemName ChatThreadId ChatName CommunicationType \\\n0 \n1 \n2 \n3 \n4 \n\n AADGroupId AddOnGuid AppDistributionMode TargetUserId OperationScope \\\n0 \n1 \n2 \n3 \n4 \n\n AzureADAppId \\\n0 \n1 \n2 \n3 \n4 \n\n OperationProperties \\\n0 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n1 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n2 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n3 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n4 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n\n AppId ClientAppId \\\n0 7a5fbd1c-3e6d-461a-9075-83049393b3a7 7a5fbd1c-3e6d-461a-9075-83049393b3a7 \n1 7a5fbd1c-3e6d-461a-9075-83049393b3a7 7a5fbd1c-3e6d-461a-9075-83049393b3a7 \n2 414a677a-e50f-46ea-b89c-aebb8a9efbe2 \n3 414a677a-e50f-46ea-b89c-aebb8a9efbe2 \n4 414a677a-e50f-46ea-b89c-aebb8a9efbe2 \n\n Type _ResourceId \n0 OfficeActivity \n1 OfficeActivity \n2 OfficeActivity \n3 OfficeActivity \n4 OfficeActivity \n\n[5 rows x 131 columns]", + "text/html": "
\n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
TenantIdApplicationUserDomainUserAgentRecordTypeTimeGeneratedOperationOrganizationIdOrganizationId_UserTypeUserKeyOfficeWorkloadResultStatusResultReasonTypeOfficeObjectIdUserIdUserId_ClientIPClientIP_ScopeSite_ItemTypeEventSourceSource_NameMachineDomainInfo...ChannelTypeChannelNameChannelGuidExtraPropertiesAddOnTypeAddonNameTabTypeNameOldValueNewValueItemNameChatThreadIdChatNameCommunicationTypeAADGroupIdAddOnGuidAppDistributionModeTargetUserIdOperationScopeAzureADAppIdOperationPropertiesAppIdClientAppIdType_ResourceId
08ecf8077-cf51-4820-aadd-14040956f35d502021-07-14 11:20:44+00:00MailItemsAccessed4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cRegular100320003C017CC9ExchangeSucceededSucceededFMorris@seccxpninja.onmicrosoft.comFMorris@seccxpninja.onmicrosoft.com...None[{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}]7a5fbd1c-3e6d-461a-9075-83049393b3a77a5fbd1c-3e6d-461a-9075-83049393b3a7OfficeActivity
18ecf8077-cf51-4820-aadd-14040956f35d502021-07-14 11:20:44+00:00MailItemsAccessed4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cRegular100320003C017CC9ExchangeSucceededSucceededFMorris@seccxpninja.onmicrosoft.comFMorris@seccxpninja.onmicrosoft.com...None[{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}]7a5fbd1c-3e6d-461a-9075-83049393b3a77a5fbd1c-3e6d-461a-9075-83049393b3a7OfficeActivity
28ecf8077-cf51-4820-aadd-14040956f35d502021-07-14 12:38:41+00:00MailItemsAccessed4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cRegular100320003F8A6FC7ExchangeSucceededSucceededMeganB@seccxp.ninjaMeganB@seccxp.ninja...None[{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}]414a677a-e50f-46ea-b89c-aebb8a9efbe2OfficeActivity
38ecf8077-cf51-4820-aadd-14040956f35d502021-07-14 12:38:41+00:00MailItemsAccessed4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cRegular100320003F8A6FC7ExchangeSucceededSucceededMeganB@seccxp.ninjaMeganB@seccxp.ninja...None[{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}]414a677a-e50f-46ea-b89c-aebb8a9efbe2OfficeActivity
48ecf8077-cf51-4820-aadd-14040956f35d502021-07-14 12:38:41+00:00MailItemsAccessed4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cRegular100320003F8A6FC7ExchangeSucceededSucceededMeganB@seccxp.ninjaMeganB@seccxp.ninja...None[{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}]414a677a-e50f-46ea-b89c-aebb8a9efbe2OfficeActivity
\n

5 rows × 131 columns

\n
" + }, + "metadata": {} } ], "source": [ - "# Define our query\r\n", - "test_query = \"\"\"\r\n", - "OfficeActivity\r\n", - "| where TimeGenerated > ago(1d)\r\n", - "| take 10\r\n", - "\"\"\"\r\n", - "\r\n", - "# Pass that query to our QueryProvider\r\n", - "office_events_df = qry_prov.exec_query(test_query)\r\n", - "display(office_events_df.head())\r\n" + "# Define our query\n", + "test_query = \"\"\"\n", + "OfficeActivity\n", + "| where TimeGenerated > ago(1d)\n", + "| take 10\n", + "\"\"\"\n", + "\n", + "# Pass that query to our QueryProvider\n", + "office_events_df = qry_prov.exec_query(test_query)\n", + "display(office_events_df.head())\n" ] }, { @@ -2412,76 +1561,53 @@ }, { "cell_type": "code", - "execution_count": 16, + "execution_count": 15, "metadata": {}, "outputs": [ { - "name": "stdout", "output_type": "stream", + "name": "stdout", "text": [ "Using Open PageRank. See https://www.domcop.com/openpagerank/what-is-openpagerank\n" ] }, { + "output_type": "display_data", "data": { + "text/plain": "VBox(children=(Text(value='', description='Filter:', style=DescriptionStyle(description_width='initial')), Sel…", "application/vnd.jupyter.widget-view+json": { - "model_id": "86ae0b3d161e44bba3b683502da63452", "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "VBox(children=(Text(value='', description='Filter:', style=DescriptionStyle(description_width='initial')), Sel…" - ] + "version_minor": 0, + "model_id": "15c64b7a9491458f9607b6454d52c055" + } }, - "metadata": {}, - "output_type": "display_data" + "metadata": {} }, { + "output_type": "display_data", "data": { - "text/html": [ - "
" - ], - "text/plain": [ - "" - ] + "text/plain": "", + "text/html": "
" }, - "metadata": {}, - "output_type": "display_data" + "metadata": {} }, { + "output_type": "display_data", "data": { - "text/html": [ - "

85.214.149.236

Type: 'ipv4', Provider: VirusTotal, severity: high

Details

\n", - "\n", - "
VirusTotal
verbose_msgIP address in dataset
response_code1
positives346
detected_urls['http://85.214.149.236/sugarcrm/themes/default/images/', 'http://dockerupdate.anondns.net/', 'http://85.214.149.236/', 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/', 'http://85.214.149.236:443/sugarcrm/themes/default/images/', 'http://85.214.149.236:443/sugarcrm/themes/default/images/kube.jpg', 'http://85.214.149.236:443/sugarcrm/themes/default/images/mod.jpg', 'http://85.214.149.236:443/', 'http://85.214.149.236:443/sugarcrm/themes/default/images/bioset.jpg', 'https://85.214.149.236/sugarcrm/themes/default/images', 'https://85.214.149.236/sugarcrm/themes/default/images/', 'http://85.214.149.236:443/sugarcrm/themes/default/images/tshd.jpg', 'http://85.214.149.236:443/sugarcrm/themes/default/images', 'http://85.214.149.236:443/sugarcrm/themes/default/images/default.jpg']
detected_downloaded_samples['a506c6cf25de202e6b2bf60fe0236911a6ff8aa33f12a78edad9165ab0851caf', 'e15550481e89dbd154b875ce50cc5af4b49f9ff7b837d9ac5b5594e5d63966a3', '252bf8c685289759b90c1de6f9db345c2cfe62e6f8aad9a7f44dfb3c8508487a', '139f393594aabb20543543bd7d3192422b886f58e04a910637b41f14d0cad375']
detected_communicating_samples['ab12b5d03f8467a1089d3d40ef9c4a54fb16ee61bb68714040e9edf96b5e763f', '1aaf7bc48ff75e870db4fe6ec0b3ed9d99876d7e2fb3d5c4613cca92bbb95e1b', '36bf7b2ab7968880ccc696927c03167b6056e73043fd97a33d2468383a5bafce']

Reference:

https://www.virustotal.com/vtapi/v2/ip-address/report

Raw Results

\n", - "
\n", - " Raw results from provider...\n", - " 
{'as_owner': 'Strato AG',
 'asn': 6724,
 'country': 'DE',
 'detected_communicating_samples': [{'date': '2021-06-11 01:23:22',
                                     'positives': 13,
                                     'sha256': 'ab12b5d03f8467a1089d3d40ef9c4a54fb16ee61bb68714040e9edf96b5e763f',
                                     'total': 74},
                                    {'date': '2021-06-10 07:31:53',
                                     'positives': 30,
                                     'sha256': '1aaf7bc48ff75e870db4fe6ec0b3ed9d99876d7e2fb3d5c4613cca92bbb95e1b',
                                     'total': 75},
                                    {'date': '2021-06-09 02:36:09',
                                     'positives': 30,
                                     'sha256': '36bf7b2ab7968880ccc696927c03167b6056e73043fd97a33d2468383a5bafce',
                                     'total': 75},
                                    {'date': '2021-05-17 21:40:23',
                                     'positives': 13,
                                     'sha256': '39ac019520a278e350065d12ebc0c24201584390724f3d8e0dc828664fee6cae',
                                     'total': 74},
                                    {'date': '2021-05-12 12:46:23',
                                     'positives': 6,
                                     'sha256': 'b60ffcc7153650d6a232b1cb249924b0c6384c27681860eb13b12f4705bc0a05',
                                     'total': 75},
                                    {'date': '2021-05-11 08:32:51',
                                     'positives': 14,
                                     'sha256': '1ad0104478301e73e3f49cdeb10f8c1a1d54bccf9248e34ff81352598f112e6b',
                                     'total': 75},
                                    {'date': '2021-04-21 10:08:11',
                                     'positives': 16,
                                     'sha256': '7b6f7c48256a8df2041e8726c3490ccb6987e1a76fee947e148ea68eee036889',
                                     'total': 76},
                                    {'date': '2021-03-31 15:34:40',
                                     'positives': 20,
                                     'sha256': 'ae3e4a1c8a2b661265e6c8c756e3ba472dc7177cae79fe1861ab0c2d1af5167a',
                                     'total': 75},
                                    {'date': '2021-03-27 04:35:12',
                                     'positives': 22,
                                     'sha256': '3b280a4017ef2c2aef4b3ed8bb47516b816166998462899935afb39b533890ad',
                                     'total': 75},
                                    {'date': '2020-08-18 19:53:07',
                                     'positives': 3,
                                     'sha256': '0742efecbd7af343213a50cc5fd5cd2f8475613cfe6fb51f4296a7ec4533940d',
                                     'total': 74}],
 'detected_downloaded_samples': [{'date': '2021-06-10 07:31:49',
                                  'positives': 34,
                                  'sha256': 'a506c6cf25de202e6b2bf60fe0236911a6ff8aa33f12a78edad9165ab0851caf',
                                  'total': 75},
                                 {'date': '2021-06-09 02:33:10',
                                  'positives': 39,
                                  'sha256': 'e15550481e89dbd154b875ce50cc5af4b49f9ff7b837d9ac5b5594e5d63966a3',
                                  'total': 75},
                                 {'date': '2021-06-09 02:33:23',
                                  'positives': 37,
                                  'sha256': '252bf8c685289759b90c1de6f9db345c2cfe62e6f8aad9a7f44dfb3c8508487a',
                                  'total': 75},
                                 {'date': '2021-06-08 14:22:25',
                                  'positives': 35,
                                  'sha256': '139f393594aabb20543543bd7d3192422b886f58e04a910637b41f14d0cad375',
                                  'total': 75},
                                 {'date': '2021-03-02 07:13:18',
                                  'positives': 33,
                                  'sha256': 'feb0a0f5ffba9d7b7d6878a8890a6d67d3f8ef6106e4e88719a63c3351e46a06',
                                  'total': 76},
                                 {'date': '2021-02-08 02:39:20',
                                  'positives': 18,
                                  'sha256': '230e2a06df2cd7574ee15cb13714d77182f28d50f83a6ed58af39f1966177769',
                                  'total': 76},
                                 {'date': '2020-10-31 16:15:20',
                                  'positives': 30,
                                  'sha256': '36bf7b2ab7968880ccc696927c03167b6056e73043fd97a33d2468383a5bafce',
                                  'total': 76},
                                 {'date': '2020-10-19 16:08:06',
                                  'positives': 28,
                                  'sha256': '1aaf7bc48ff75e870db4fe6ec0b3ed9d99876d7e2fb3d5c4613cca92bbb95e1b',
                                  'total': 75},
                                 {'date': '2020-09-09 11:54:11',
                                  'positives': 24,
                                  'sha256': '9750b3be953bd31322dd173ca18f29e5997029b28b24fbeb5fec7ebb1974cb09',
                                  'total': 73},
                                 {'date': '2020-09-06 07:41:39',
                                  'positives': 23,
                                  'sha256': 'c0ab7d1caabdd090b2399cd1193d2cc2334218d3f3f0d3164b61b6014fd308e9',
                                  'total': 73},
                                 {'date': '2020-09-09 11:30:10',
                                  'positives': 1,
                                  'sha256': '767fc7ae032403bce2dbcefa525cf1a9fd02bbb185e45aa88d9bc28a5f22a2b6',
                                  'total': 73},
                                 {'date': '2020-07-22 02:02:29',
                                  'positives': 26,
                                  'sha256': '132df864f6750d29bf9f762b298f377c13b899aa8d07c0a6bda58adcffd0d6f7',
                                  'total': 76},
                                 {'date': '2020-08-20 06:57:04',
                                  'positives': 30,
                                  'sha256': '2c40b76408d59f906f60db97ea36503bfc59aed22a154f5d564d8449c300594f',
                                  'total': 75}],
 'detected_referrer_samples': [{'date': '2020-09-09 11:30:10',
                                'positives': 1,
                                'sha256': '767fc7ae032403bce2dbcefa525cf1a9fd02bbb185e45aa88d9bc28a5f22a2b6',
                                'total': 73}],
 'detected_urls': [{'positives': 10,
                    'scan_date': '2021-06-25 14:23:59',
                    'total': 89,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images/'},
                   {'positives': 12,
                    'scan_date': '2021-06-23 12:00:19',
                    'total': 88,
                    'url': 'http://dockerupdate.anondns.net/'},
                   {'positives': 8,
                    'scan_date': '2021-06-23 11:49:31',
                    'total': 89,
                    'url': 'http://85.214.149.236/'},
                   {'positives': 12,
                    'scan_date': '2021-06-21 01:57:07',
                    'total': 88,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/'},
                   {'positives': 8,
                    'scan_date': '2021-06-21 01:50:52',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/'},
                   {'positives': 9,
                    'scan_date': '2021-06-19 00:07:04',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/kube.jpg'},
                   {'positives': 8,
                    'scan_date': '2021-06-18 06:32:59',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/mod.jpg'},
                   {'positives': 7,
                    'scan_date': '2021-06-16 08:08:57',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/'},
                   {'positives': 12,
                    'scan_date': '2021-06-09 15:47:20',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/bioset.jpg'},
                   {'positives': 8,
                    'scan_date': '2021-06-09 03:40:07',
                    'total': 89,
                    'url': 'https://85.214.149.236/sugarcrm/themes/default/images'},
                   {'positives': 7,
                    'scan_date': '2021-06-09 03:18:37',
                    'total': 89,
                    'url': 'https://85.214.149.236/sugarcrm/themes/default/images/'},
                   {'positives': 11,
                    'scan_date': '2021-06-09 02:36:55',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/tshd.jpg'},
                   {'positives': 8,
                    'scan_date': '2021-06-08 15:50:06',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images'},
                   {'positives': 8,
                    'scan_date': '2021-06-08 14:23:47',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/default.jpg'},
                   {'positives': 6,
                    'scan_date': '2021-04-21 00:07:34',
                    'total': 87,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images/stock.jpg'},
                   {'positives': 5,
                    'scan_date': '2021-04-01 13:42:58',
                    'total': 85,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images/mod.jpg'},
                   {'positives': 9,
                    'scan_date': '2021-03-19 18:12:09',
                    'total': 85,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/Carray.jpg'},
                   {'positives': 6,
                    'scan_date': '2021-01-12 10:34:27',
                    'total': 83,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images/kube.jpg'},
                   {'positives': 10,
                    'scan_date': '2020-12-28 02:17:00',
                    'total': 83,
                    'url': 'http://dockerupdate.anondns.net/sugarcrm/themes/default/images/'},
                   {'positives': 6,
                    'scan_date': '2020-12-19 10:34:37',
                    'total': 83,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images/default.jpg'},
                   {'positives': 6,
                    'scan_date': '2020-11-12 16:50:51',
                    'total': 81,
                    'url': 'http://85.214.149.236/sugarcrm/themes'},
                   {'positives': 14,
                    'scan_date': '2020-11-10 11:01:42',
                    'total': 81,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/mos.jpg'},
                   {'positives': 14,
                    'scan_date': '2020-11-08 15:00:49',
                    'total': 81,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/nk.jpg'},
                   {'positives': 6,
                    'scan_date': '2020-11-04 19:21:25',
                    'total': 81,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default'},
                   {'positives': 6,
                    'scan_date': '2020-10-29 00:55:07',
                    'total': 81,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images'},
                   {'positives': 12,
                    'scan_date': '2020-09-28 03:26:34',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm'},
                   {'positives': 9,
                    'scan_date': '2020-09-28 03:06:19',
                    'total': 80,
                    'url': 'http://85.214.149.236/sugarcrm/.../dns'},
                   {'positives': 11,
                    'scan_date': '2020-09-24 14:01:08',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net/sugarcrm/themes/default/images'},
                   {'positives': 12,
                    'scan_date': '2020-09-21 17:20:19',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/carray.jpg'},
                   {'positives': 6,
                    'scan_date': '2020-09-20 16:04:57',
                    'total': 80,
                    'url': 'http://85.214.149.236/sugarcrm'},
                   {'positives': 9,
                    'scan_date': '2020-09-17 17:36:08',
                    'total': 80,
                    'url': 'http://85.214.149.236:443/sugarcrm/banner.php'},
                   {'positives': 11,
                    'scan_date': '2020-09-10 07:55:21',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/'},
                   {'positives': 10,
                    'scan_date': '2020-09-09 12:06:14',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/Carray.jpg/'},
                   {'positives': 4,
                    'scan_date': '2020-09-09 12:05:12',
                    'total': 80,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/bioset.jpg/'},
                   {'positives': 11,
                    'scan_date': '2020-09-09 11:59:35',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net/sugarcrm/themes/default/images/mos.jpg'},
                   {'positives': 5,
                    'scan_date': '2020-09-09 11:48:55',
                    'total': 80,
                    'url': 'http://85.214.149.236:443/sugarcrm/.../run'},
                   {'positives': 4,
                    'scan_date': '2020-09-09 11:44:28',
                    'total': 80,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/mod.js'},
                   {'positives': 6,
                    'scan_date': '2020-09-09 11:35:26',
                    'total': 80,
                    'url': 'http://85.214.149.236:443/sugarcrm/.../cron.sh'},
                   {'positives': 11,
                    'scan_date': '2020-09-09 11:30:00',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net/sugarcrm/themes/default/images/nk.jpg'},
                   {'positives': 5,
                    'scan_date': '2020-09-05 03:44:35',
                    'total': 80,
                    'url': 'http://85.214.149.236/sugarcrm/...'},
                   {'positives': 8,
                    'scan_date': '2020-09-02 06:09:23',
                    'total': 80,
                    'url': 'https://dockerupdate.anondns.net/'},
                   {'positives': 6,
                    'scan_date': '2020-09-01 17:37:50',
                    'total': 79,
                    'url': 'http://85.214.149.236:443/sugarcrm/.../dns'},
                   {'positives': 1,
                    'scan_date': '2020-08-28 08:15:47',
                    'total': 78,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/mod.js\"'},
                   {'positives': 2,
                    'scan_date': '2020-08-27 13:22:06',
                    'total': 78,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/zgrab.jpg'},
                   {'positives': 7,
                    'scan_date': '2020-08-25 14:52:00',
                    'total': 79,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/portjoe.jpg'},
                   {'positives': 7,
                    'scan_date': '2020-08-25 07:02:55',
                    'total': 79,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images'},
                   {'positives': 4,
                    'scan_date': '2020-08-24 07:34:44',
                    'total': 79,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/01.jpg'},
                   {'positives': 2,
                    'scan_date': '2020-08-20 16:37:39',
                    'total': 78,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/stock.jpg'}],
 'resolutions': [{'hostname': 'dockerupdate.anondns.net',
                  'last_resolved': '2020-08-14 18:56:08'},
                 {'hostname': 'h2381205.stratoserver.net',
                  'last_resolved': '2020-08-06 12:19:57'}],
 'response_code': 1,
 'undetected_communicating_samples': [{'date': '2021-06-09 10:51:49',
                                       'positives': 0,
                                       'sha256': '45cc4f38340bf1d4bb0010114ccf03112d14dee7815aa797d20854605fdca2d2',
                                       'total': 74},
                                      {'date': '2021-06-12 19:00:20',
                                       'positives': 0,
                                       'sha256': '020531aef7e069ee6e384f2fe9c49db9d99292d559c72da95276c2788b17d386',
                                       'total': 74},
                                      {'date': '2020-12-10 15:39:02',
                                       'positives': 0,
                                       'sha256': 'd9c46904d5bb808f2f0c28e819a31703f5155c4df66c4c4669f5d9e81f25dc66',
                                       'total': 75},
                                      {'date': '2020-08-28 07:36:29',
                                       'positives': 0,
                                       'sha256': 'd333c3cfb8b9ad1da5ee50f96a55dfbe70196f05fd88b5f04e925e32305cfff8',
                                       'total': 73},
                                      {'date': '2020-08-28 07:40:32',
                                       'positives': 0,
                                       'sha256': '18c178fb224ec17718e5f70a92041e721d9e380e70063cc4bfe3f61d6feb72d9',
                                       'total': 73},
                                      {'date': '2020-08-28 07:35:10',
                                       'positives': 0,
                                       'sha256': 'a5d14bb053b03e81e58101516c782360fe64d6469852c6aa06fc47c08b30b127',
                                       'total': 73},
                                      {'date': '2020-08-26 22:30:40',
                                       'positives': 0,
                                       'sha256': 'ba16f24e6294e8da28782c1d8e00189950dd4cbbb061ef13d1a4d84305651768',
                                       'total': 73},
                                      {'date': '2020-08-26 14:29:14',
                                       'positives': 0,
                                       'sha256': '1861eee8333dadcfe0d0dc10461f5f82fada8e42db9aa9efba6f258182e9c546',
                                       'total': 73},
                                      {'date': '2020-08-24 07:12:27',
                                       'positives': 0,
                                       'sha256': 'b485e6ccc9cfeb9c2034cebfeaf1bb3b3db0ac9996e5260fc1e95ce852b757c4',
                                       'total': 73}],
 'undetected_downloaded_samples': [{'date': '2020-09-09 11:44:35',
                                    'positives': 0,
                                    'sha256': 'e8812c8ff47b0542c7ee4d6bdff5bfbfd488a8e363d884074089c54b6ffc9789',
                                    'total': 73},
                                   {'date': '2020-07-16 04:03:02',
                                    'positives': 0,
                                    'sha256': '1474298ed7a5c63ca8098794cd743a276807cca0e678e046160718626bb038f3',
                                    'total': 76}],
 'undetected_referrer_samples': [],
 'undetected_urls': [['http://h2381205.stratoserver.net/',
                      '011bcc2795245bb9fac15c54e0e189b0c6e2f24c42c57fec7cfc654a8bb95106',
                      0,
                      80,
                      '2020-11-02 13:02:39'],
                     ['http://85.214.149.236:443/sugarcrm/.../',
                      '9ffbd9455f6aa190b4270b0d8bfe2c863c6495b94b0f510169999135476e4ed4',
                      0,
                      79,
                      '2020-07-14 10:52:05']],
 'verbose_msg': 'IP address in dataset'}
\n", - "
\n", - " " - ], - "text/plain": [ - "" - ] + "text/plain": "", + "text/html": "

85.214.149.236

Type: 'ipv4', Provider: VirusTotal, severity: high

Details

\n\n
VirusTotal
verbose_msgIP address in dataset
response_code1
positives217
detected_urls['http://85.214.149.236/sugarcrm/themes/default/images/', 'http://85.214.149.236:443/sugarcrm/themes/default/images/stock.jpg', 'http://85.214.149.236:443/sugarcrm/themes/default/images/tshd.jpg', 'http://85.214.149.236/', 'http://85.214.149.236:443/sugarcrm/themes/default/images/bioset.jpg', 'http://85.214.149.236:443/sugarcrm/themes/default/images/mod.jpg', 'http://85.214.149.236:443/sugarcrm/themes/default/images/default.jpg', 'http://dockerupdate.anondns.net/', 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/', 'http://85.214.149.236:443/sugarcrm/themes/default/images/', 'http://85.214.149.236:443/sugarcrm/themes/default/images/kube.jpg', 'http://85.214.149.236:443/']
detected_downloaded_samples['75a733d99d72d1d0d6ca99ec852d97ae8c515ed136e12195e96adf6df7bbad41', '252bf8c685289759b90c1de6f9db345c2cfe62e6f8aad9a7f44dfb3c8508487a', 'e15550481e89dbd154b875ce50cc5af4b49f9ff7b837d9ac5b5594e5d63966a3']
detected_communicating_samples[]

Reference:

https://www.virustotal.com/vtapi/v2/ip-address/report

Raw Results

\n
\n Raw results from provider...\n 
{'as_owner': 'Strato AG',
 'asn': 6724,
 'country': 'DE',
 'detected_communicating_samples': [{'date': '2021-06-11 01:23:22',
                                     'positives': 13,
                                     'sha256': 'ab12b5d03f8467a1089d3d40ef9c4a54fb16ee61bb68714040e9edf96b5e763f',
                                     'total': 74},
                                    {'date': '2021-06-10 07:31:53',
                                     'positives': 30,
                                     'sha256': '1aaf7bc48ff75e870db4fe6ec0b3ed9d99876d7e2fb3d5c4613cca92bbb95e1b',
                                     'total': 75},
                                    {'date': '2021-06-09 02:36:09',
                                     'positives': 30,
                                     'sha256': '36bf7b2ab7968880ccc696927c03167b6056e73043fd97a33d2468383a5bafce',
                                     'total': 75},
                                    {'date': '2021-05-17 21:40:23',
                                     'positives': 13,
                                     'sha256': '39ac019520a278e350065d12ebc0c24201584390724f3d8e0dc828664fee6cae',
                                     'total': 74},
                                    {'date': '2021-05-12 12:46:23',
                                     'positives': 6,
                                     'sha256': 'b60ffcc7153650d6a232b1cb249924b0c6384c27681860eb13b12f4705bc0a05',
                                     'total': 75},
                                    {'date': '2021-05-11 08:32:51',
                                     'positives': 14,
                                     'sha256': '1ad0104478301e73e3f49cdeb10f8c1a1d54bccf9248e34ff81352598f112e6b',
                                     'total': 75},
                                    {'date': '2021-04-21 10:08:11',
                                     'positives': 16,
                                     'sha256': '7b6f7c48256a8df2041e8726c3490ccb6987e1a76fee947e148ea68eee036889',
                                     'total': 76},
                                    {'date': '2021-03-31 15:34:40',
                                     'positives': 20,
                                     'sha256': 'ae3e4a1c8a2b661265e6c8c756e3ba472dc7177cae79fe1861ab0c2d1af5167a',
                                     'total': 75},
                                    {'date': '2021-03-27 04:35:12',
                                     'positives': 22,
                                     'sha256': '3b280a4017ef2c2aef4b3ed8bb47516b816166998462899935afb39b533890ad',
                                     'total': 75},
                                    {'date': '2020-08-18 19:53:07',
                                     'positives': 3,
                                     'sha256': '0742efecbd7af343213a50cc5fd5cd2f8475613cfe6fb51f4296a7ec4533940d',
                                     'total': 74}],
 'detected_downloaded_samples': [{'date': '2021-06-29 11:54:16',
                                  'positives': 26,
                                  'sha256': '75a733d99d72d1d0d6ca99ec852d97ae8c515ed136e12195e96adf6df7bbad41',
                                  'total': 75},
                                 {'date': '2021-07-08 08:53:31',
                                  'positives': 36,
                                  'sha256': '252bf8c685289759b90c1de6f9db345c2cfe62e6f8aad9a7f44dfb3c8508487a',
                                  'total': 74},
                                 {'date': '2021-07-08 08:53:30',
                                  'positives': 38,
                                  'sha256': 'e15550481e89dbd154b875ce50cc5af4b49f9ff7b837d9ac5b5594e5d63966a3',
                                  'total': 74},
                                 {'date': '2021-06-10 07:32:43',
                                  'positives': 33,
                                  'sha256': '139f393594aabb20543543bd7d3192422b886f58e04a910637b41f14d0cad375',
                                  'total': 75},
                                 {'date': '2021-06-10 07:31:49',
                                  'positives': 34,
                                  'sha256': 'a506c6cf25de202e6b2bf60fe0236911a6ff8aa33f12a78edad9165ab0851caf',
                                  'total': 75},
                                 {'date': '2021-03-02 07:13:18',
                                  'positives': 33,
                                  'sha256': 'feb0a0f5ffba9d7b7d6878a8890a6d67d3f8ef6106e4e88719a63c3351e46a06',
                                  'total': 76},
                                 {'date': '2021-02-08 02:39:20',
                                  'positives': 18,
                                  'sha256': '230e2a06df2cd7574ee15cb13714d77182f28d50f83a6ed58af39f1966177769',
                                  'total': 76},
                                 {'date': '2020-10-31 16:15:20',
                                  'positives': 30,
                                  'sha256': '36bf7b2ab7968880ccc696927c03167b6056e73043fd97a33d2468383a5bafce',
                                  'total': 76},
                                 {'date': '2020-10-19 16:08:06',
                                  'positives': 28,
                                  'sha256': '1aaf7bc48ff75e870db4fe6ec0b3ed9d99876d7e2fb3d5c4613cca92bbb95e1b',
                                  'total': 75},
                                 {'date': '2020-09-09 11:54:11',
                                  'positives': 24,
                                  'sha256': '9750b3be953bd31322dd173ca18f29e5997029b28b24fbeb5fec7ebb1974cb09',
                                  'total': 73},
                                 {'date': '2020-09-06 07:41:39',
                                  'positives': 23,
                                  'sha256': 'c0ab7d1caabdd090b2399cd1193d2cc2334218d3f3f0d3164b61b6014fd308e9',
                                  'total': 73},
                                 {'date': '2020-09-09 11:30:10',
                                  'positives': 1,
                                  'sha256': '767fc7ae032403bce2dbcefa525cf1a9fd02bbb185e45aa88d9bc28a5f22a2b6',
                                  'total': 73},
                                 {'date': '2020-07-22 02:02:29',
                                  'positives': 26,
                                  'sha256': '132df864f6750d29bf9f762b298f377c13b899aa8d07c0a6bda58adcffd0d6f7',
                                  'total': 76},
                                 {'date': '2020-08-20 06:57:04',
                                  'positives': 30,
                                  'sha256': '2c40b76408d59f906f60db97ea36503bfc59aed22a154f5d564d8449c300594f',
                                  'total': 75}],
 'detected_referrer_samples': [{'date': '2020-09-09 11:30:10',
                                'positives': 1,
                                'sha256': '767fc7ae032403bce2dbcefa525cf1a9fd02bbb185e45aa88d9bc28a5f22a2b6',
                                'total': 73}],
 'detected_urls': [{'positives': 10,
                    'scan_date': '2021-07-14 02:19:07',
                    'total': 89,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images/'},
                   {'positives': 9,
                    'scan_date': '2021-07-14 00:09:39',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/stock.jpg'},
                   {'positives': 11,
                    'scan_date': '2021-07-09 11:00:43',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/tshd.jpg'},
                   {'positives': 8,
                    'scan_date': '2021-07-08 11:39:22',
                    'total': 89,
                    'url': 'http://85.214.149.236/'},
                   {'positives': 12,
                    'scan_date': '2021-07-08 08:55:14',
                    'total': 90,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/bioset.jpg'},
                   {'positives': 9,
                    'scan_date': '2021-06-28 02:32:40',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/mod.jpg'},
                   {'positives': 10,
                    'scan_date': '2021-06-26 00:05:01',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/default.jpg'},
                   {'positives': 12,
                    'scan_date': '2021-06-23 12:00:19',
                    'total': 88,
                    'url': 'http://dockerupdate.anondns.net/'},
                   {'positives': 12,
                    'scan_date': '2021-06-21 01:57:07',
                    'total': 88,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/'},
                   {'positives': 8,
                    'scan_date': '2021-06-21 01:50:52',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/'},
                   {'positives': 9,
                    'scan_date': '2021-06-19 00:07:04',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/kube.jpg'},
                   {'positives': 7,
                    'scan_date': '2021-06-16 08:08:57',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/'},
                   {'positives': 8,
                    'scan_date': '2021-06-09 03:40:07',
                    'total': 89,
                    'url': 'https://85.214.149.236/sugarcrm/themes/default/images'},
                   {'positives': 7,
                    'scan_date': '2021-06-09 03:18:37',
                    'total': 89,
                    'url': 'https://85.214.149.236/sugarcrm/themes/default/images/'},
                   {'positives': 8,
                    'scan_date': '2021-06-08 15:50:06',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images'},
                   {'positives': 6,
                    'scan_date': '2021-04-21 00:07:34',
                    'total': 87,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images/stock.jpg'},
                   {'positives': 5,
                    'scan_date': '2021-04-01 13:42:58',
                    'total': 85,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images/mod.jpg'},
                   {'positives': 9,
                    'scan_date': '2021-03-19 18:12:09',
                    'total': 85,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/Carray.jpg'},
                   {'positives': 6,
                    'scan_date': '2021-01-12 10:34:27',
                    'total': 83,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images/kube.jpg'},
                   {'positives': 10,
                    'scan_date': '2020-12-28 02:17:00',
                    'total': 83,
                    'url': 'http://dockerupdate.anondns.net/sugarcrm/themes/default/images/'},
                   {'positives': 6,
                    'scan_date': '2020-12-19 10:34:37',
                    'total': 83,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images/default.jpg'},
                   {'positives': 6,
                    'scan_date': '2020-11-12 16:50:51',
                    'total': 81,
                    'url': 'http://85.214.149.236/sugarcrm/themes'},
                   {'positives': 14,
                    'scan_date': '2020-11-10 11:01:42',
                    'total': 81,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/mos.jpg'},
                   {'positives': 14,
                    'scan_date': '2020-11-08 15:00:49',
                    'total': 81,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/nk.jpg'},
                   {'positives': 6,
                    'scan_date': '2020-11-04 19:21:25',
                    'total': 81,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default'},
                   {'positives': 6,
                    'scan_date': '2020-10-29 00:55:07',
                    'total': 81,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images'},
                   {'positives': 12,
                    'scan_date': '2020-09-28 03:26:34',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm'},
                   {'positives': 9,
                    'scan_date': '2020-09-28 03:06:19',
                    'total': 80,
                    'url': 'http://85.214.149.236/sugarcrm/.../dns'},
                   {'positives': 11,
                    'scan_date': '2020-09-24 14:01:08',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net/sugarcrm/themes/default/images'},
                   {'positives': 12,
                    'scan_date': '2020-09-21 17:20:19',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/carray.jpg'},
                   {'positives': 6,
                    'scan_date': '2020-09-20 16:04:57',
                    'total': 80,
                    'url': 'http://85.214.149.236/sugarcrm'},
                   {'positives': 9,
                    'scan_date': '2020-09-17 17:36:08',
                    'total': 80,
                    'url': 'http://85.214.149.236:443/sugarcrm/banner.php'},
                   {'positives': 11,
                    'scan_date': '2020-09-10 07:55:21',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/'},
                   {'positives': 10,
                    'scan_date': '2020-09-09 12:06:14',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/Carray.jpg/'},
                   {'positives': 4,
                    'scan_date': '2020-09-09 12:05:12',
                    'total': 80,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/bioset.jpg/'},
                   {'positives': 11,
                    'scan_date': '2020-09-09 11:59:35',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net/sugarcrm/themes/default/images/mos.jpg'},
                   {'positives': 5,
                    'scan_date': '2020-09-09 11:48:55',
                    'total': 80,
                    'url': 'http://85.214.149.236:443/sugarcrm/.../run'},
                   {'positives': 4,
                    'scan_date': '2020-09-09 11:44:28',
                    'total': 80,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/mod.js'},
                   {'positives': 6,
                    'scan_date': '2020-09-09 11:35:26',
                    'total': 80,
                    'url': 'http://85.214.149.236:443/sugarcrm/.../cron.sh'},
                   {'positives': 11,
                    'scan_date': '2020-09-09 11:30:00',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net/sugarcrm/themes/default/images/nk.jpg'},
                   {'positives': 5,
                    'scan_date': '2020-09-05 03:44:35',
                    'total': 80,
                    'url': 'http://85.214.149.236/sugarcrm/...'},
                   {'positives': 8,
                    'scan_date': '2020-09-02 06:09:23',
                    'total': 80,
                    'url': 'https://dockerupdate.anondns.net/'},
                   {'positives': 6,
                    'scan_date': '2020-09-01 17:37:50',
                    'total': 79,
                    'url': 'http://85.214.149.236:443/sugarcrm/.../dns'},
                   {'positives': 1,
                    'scan_date': '2020-08-28 08:15:47',
                    'total': 78,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/mod.js\"'},
                   {'positives': 2,
                    'scan_date': '2020-08-27 13:22:06',
                    'total': 78,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/zgrab.jpg'},
                   {'positives': 7,
                    'scan_date': '2020-08-25 14:52:00',
                    'total': 79,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/portjoe.jpg'},
                   {'positives': 7,
                    'scan_date': '2020-08-25 07:02:55',
                    'total': 79,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images'},
                   {'positives': 4,
                    'scan_date': '2020-08-24 07:34:44',
                    'total': 79,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/01.jpg'}],
 'resolutions': [{'hostname': 'dockerupdate.anondns.net',
                  'last_resolved': '2020-08-14 18:56:08'},
                 {'hostname': 'h2381205.stratoserver.net',
                  'last_resolved': '2020-08-06 12:19:57'}],
 'response_code': 1,
 'undetected_communicating_samples': [{'date': '2021-06-24 10:15:37',
                                       'positives': 0,
                                       'sha256': '7149b53e4a3f9de2a7d47190af64f8b609618ed09f8440a64175049a90336775',
                                       'total': 75},
                                      {'date': '2021-06-09 10:51:49',
                                       'positives': 0,
                                       'sha256': '45cc4f38340bf1d4bb0010114ccf03112d14dee7815aa797d20854605fdca2d2',
                                       'total': 74},
                                      {'date': '2021-06-12 19:00:20',
                                       'positives': 0,
                                       'sha256': '020531aef7e069ee6e384f2fe9c49db9d99292d559c72da95276c2788b17d386',
                                       'total': 74},
                                      {'date': '2020-12-10 15:39:02',
                                       'positives': 0,
                                       'sha256': 'd9c46904d5bb808f2f0c28e819a31703f5155c4df66c4c4669f5d9e81f25dc66',
                                       'total': 75},
                                      {'date': '2020-08-28 07:36:29',
                                       'positives': 0,
                                       'sha256': 'd333c3cfb8b9ad1da5ee50f96a55dfbe70196f05fd88b5f04e925e32305cfff8',
                                       'total': 73},
                                      {'date': '2020-08-28 07:40:32',
                                       'positives': 0,
                                       'sha256': '18c178fb224ec17718e5f70a92041e721d9e380e70063cc4bfe3f61d6feb72d9',
                                       'total': 73},
                                      {'date': '2020-08-28 07:35:10',
                                       'positives': 0,
                                       'sha256': 'a5d14bb053b03e81e58101516c782360fe64d6469852c6aa06fc47c08b30b127',
                                       'total': 73},
                                      {'date': '2020-08-26 22:30:40',
                                       'positives': 0,
                                       'sha256': 'ba16f24e6294e8da28782c1d8e00189950dd4cbbb061ef13d1a4d84305651768',
                                       'total': 73},
                                      {'date': '2020-08-26 14:29:14',
                                       'positives': 0,
                                       'sha256': '1861eee8333dadcfe0d0dc10461f5f82fada8e42db9aa9efba6f258182e9c546',
                                       'total': 73},
                                      {'date': '2020-08-24 07:12:27',
                                       'positives': 0,
                                       'sha256': 'b485e6ccc9cfeb9c2034cebfeaf1bb3b3db0ac9996e5260fc1e95ce852b757c4',
                                       'total': 73}],
 'undetected_downloaded_samples': [{'date': '2020-09-09 11:44:35',
                                    'positives': 0,
                                    'sha256': 'e8812c8ff47b0542c7ee4d6bdff5bfbfd488a8e363d884074089c54b6ffc9789',
                                    'total': 73},
                                   {'date': '2020-07-16 04:03:02',
                                    'positives': 0,
                                    'sha256': '1474298ed7a5c63ca8098794cd743a276807cca0e678e046160718626bb038f3',
                                    'total': 76}],
 'undetected_referrer_samples': [],
 'undetected_urls': [['http://h2381205.stratoserver.net/',
                      '011bcc2795245bb9fac15c54e0e189b0c6e2f24c42c57fec7cfc654a8bb95106',
                      0,
                      80,
                      '2020-11-02 13:02:39'],
                     ['http://85.214.149.236:443/sugarcrm/.../',
                      '9ffbd9455f6aa190b4270b0d8bfe2c863c6495b94b0f510169999135476e4ed4',
                      0,
                      79,
                      '2020-07-14 10:52:05']],
 'verbose_msg': 'IP address in dataset'}
\n
\n " }, - "metadata": {}, - "output_type": "display_data" + "metadata": {} } ], "source": [ - "# Create our TI provider\r\n", - "ti = TILookup()\r\n", - "\r\n", - "# Lookup an IP Address\r\n", - "ti_resp = ti.lookup_ioc(\"85.214.149.236\", providers=[\"VirusTotal\"])\r\n", - "\r\n", - "ti_df = ti.result_to_df(ti_resp)\r\n", + "# Create our TI provider\n", + "ti = TILookup()\n", + "\n", + "# Lookup an IP Address\n", + "ti_resp = ti.lookup_ioc(\"85.214.149.236\", providers=[\"VirusTotal\"])\n", + "\n", + "ti_df = ti.result_to_df(ti_resp)\n", "ti.browse_results(ti_df, severities=\"all\")" ] }, @@ -2506,27 +1632,29 @@ }, { "cell_type": "code", - "execution_count": 18, + "execution_count": 16, "metadata": {}, "outputs": [ { + "output_type": "display_data", "data": { - "text/html": [ - "

ipaddress

{ 'AdditionalData': {},
  'Address': '85.214.149.236',
  'Location': { 'AdditionalData': {},
                'CountryCode': 'DE',
                'CountryName': 'Germany',
                'Latitude': 51.2993,
                'Longitude': 9.491,
                'Type': 'geolocation',
                'edges': set()},
  'ThreatIntelligence': [],
  'Type': 'ipaddress',
  'edges': set()}" - ], - "text/plain": [ - "IpAddress(Address=85.214.149.236, Location={ 'AdditionalData': {},\n", - " 'CountryCode': 'DE',\n", - "...)" - ] + "text/plain": "", + "text/html": "\nThis product includes GeoLite2 data created by MaxMind, available from\nhttps://www.maxmind.com.\n" }, - "metadata": {}, - "output_type": "display_data" + "metadata": {} + }, + { + "output_type": "display_data", + "data": { + "text/plain": "IpAddress(Address=85.214.149.236, Location={ 'AdditionalData': {},\n 'CountryCode': 'DE',\n...)", + "text/html": "

ipaddress

{ 'AdditionalData': {},
  'Address': '85.214.149.236',
  'Location': { 'AdditionalData': {},
                'CountryCode': 'DE',
                'CountryName': 'Germany',
                'Latitude': 51.2993,
                'Longitude': 9.491,
                'Type': 'geolocation',
                'edges': set()},
  'ThreatIntelligence': [],
  'Type': 'ipaddress',
  'edges': set()}" + }, + "metadata": {} } ], "source": [ - "geo_ip = GeoLiteLookup()\r\n", - "raw_res, ip_entity = geo_ip.lookup_ip(\"85.214.149.236\")\r\n", + "geo_ip = GeoLiteLookup()\n", + "raw_res, ip_entity = geo_ip.lookup_ip(\"85.214.149.236\")\n", "display(ip_entity[0])" ] }, From f4062105182eab912736d657de94bb904866d3fc Mon Sep 17 00:00:00 2001 From: Ian Hellen Date: Mon, 19 Jul 2021 11:45:51 -0700 Subject: [PATCH 3/3] Minor change to Maxmind licensing wording. Fixed an unbalanced

tag --- ...uide For Azure Sentinel ML Notebooks.ipynb | 1604 ++++++++++++++--- 1 file changed, 1383 insertions(+), 221 deletions(-) diff --git a/A Getting Started Guide For Azure Sentinel ML Notebooks.ipynb b/A Getting Started Guide For Azure Sentinel ML Notebooks.ipynb index 5e92fb7..a97a4ce 100644 --- a/A Getting Started Guide For Azure Sentinel ML Notebooks.ipynb +++ b/A Getting Started Guide For Azure Sentinel ML Notebooks.ipynb @@ -4,52 +4,52 @@ "cell_type": "markdown", "metadata": {}, "source": [ - "# Getting Started with Azure ML Notebooks and Azure Sentinel\r\n", - "\r\n", - "---\r\n", - "\r\n", - "# Contents\r\n", - "\r\n", - "- Introduction\r\n", - "- What is a Jupyter Notebook\r\n", - "- Setting up the notebook environment\r\n", - "- Notebook/MSTICPy configuration\r\n", - "- Querying data from Azure Sentinel\r\n", - "- Testing Threat Intelligence and IP Geolocation lookups\r\n", - "- Further Resources\r\n", - "- FAQs - Frequently Asked Questions\r\n", - "\r\n", - "---\r\n", - "\r\n", - "# Introduction\r\n", - "\r\n", - "This notebook takes you through the basics needed to get started with Azure Machine Learning (ML) Notebooks and Azure Sentinel.\r\n", - "\r\n", - "It focuses on getting things set up and basic steps to query data.\r\n", - "\r\n", - "After you've finished running this notebook you can go on to look at the following notebooks:\r\n", - "\r\n", - "- **A Tour of Cybersec notebook features** - this takes you through some of the basic\r\n", - " features for CyberSec investigation/hunting available to you in notebooks.\r\n", - "- **Configuring your environment** - this covers all of the configuration options for \r\n", - " accessing external cybersec resources\r\n", - "\r\n", - "\r\n", - "Each topic includes 'learn more' sections to provide you with the resource to deep\r\n", - "dive into each of these topics. We encourage you to work through the notebook from start\r\n", - "to finish.\r\n", - "\r\n", - "

Note: \r\n", - "This notebook assumes that you are running in Azure ML\r\n", - "but most of the guidance is applicable to other notebook environments, include local notebooks.\r\n", - "\r\n", - "\r\n", - "
\r\n", - "\r\n", - "

\r\n", - "

Please run the the code cells in sequence. Skipping cells will result in errors.

\r\n", - "\r\n", - "If you encounter any unexpected errors please see the FAQ at the end of this notebook.
\r\n", + "# Getting Started with Azure ML Notebooks and Azure Sentinel\n", + "\n", + "---\n", + "\n", + "# Contents\n", + "\n", + "- Introduction\n", + "- What is a Jupyter Notebook\n", + "- Setting up the notebook environment\n", + "- Notebook/MSTICPy configuration\n", + "- Querying data from Azure Sentinel\n", + "- Testing Threat Intelligence and IP Geolocation lookups\n", + "- Further Resources\n", + "- FAQs - Frequently Asked Questions\n", + "\n", + "---\n", + "\n", + "# Introduction\n", + "\n", + "This notebook takes you through the basics needed to get started with Azure Machine Learning (ML) Notebooks and Azure Sentinel.\n", + "\n", + "It focuses on getting things set up and basic steps to query data.\n", + "\n", + "After you've finished running this notebook you can go on to look at the following notebooks:\n", + "\n", + "- **A Tour of Cybersec notebook features** - this takes you through some of the basic\n", + " features for CyberSec investigation/hunting available to you in notebooks.\n", + "- **Configuring your environment** - this covers all of the configuration options for \n", + " accessing external cybersec resources\n", + "\n", + "\n", + "Each topic includes 'learn more' sections to provide you with the resource to deep\n", + "dive into each of these topics. We encourage you to work through the notebook from start\n", + "to finish.\n", + "\n", + "

Note: \n", + "This notebook assumes that you are running in Azure ML\n", + "but most of the guidance is applicable to other notebook environments, include local notebooks.\n", + "

\n", + "\n", + "
\n", + "\n", + "
\n", + "

Please run the the code cells in sequence. Skipping cells will result in errors.

\n", + "\n", + "If you encounter any unexpected errors please see the FAQ at the end of this notebook.
\n", "
" ] }, @@ -332,76 +332,112 @@ "metadata": {}, "outputs": [ { - "output_type": "display_data", "data": { - "text/plain": "", - "text/html": "Checking upgrade to latest msticpy version" + "text/html": [ + "Checking upgrade to latest msticpy version" + ], + "text/plain": [ + "" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" }, { - "output_type": "display_data", "data": { - "text/plain": "", - "text/html": "

Starting Notebook initialization...

" + "text/html": [ + "

Starting Notebook initialization...

" + ], + "text/plain": [ + "" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" }, { - "output_type": "display_data", "data": { - "text/plain": "", - "text/html": "msticpy version installed: 1.2.4 latest published: 1.2.3
Latest version is installed.

" + "text/html": [ + "msticpy version installed: 1.2.4 latest published: 1.2.3
Latest version is installed.

" + ], + "text/plain": [ + "" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" }, { - "output_type": "display_data", "data": { - "text/plain": "", - "text/html": "Processing imports....
" + "text/html": [ + "Processing imports....
" + ], + "text/plain": [ + "" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" }, { - "output_type": "display_data", "data": { - "text/plain": "", - "text/html": "Imported: pd (pandas), IPython.get_ipython, IPython.display.display, IPython.display.HTML, IPython.display.Markdown, widgets (ipywidgets), pathlib.Path, plt (matplotlib.pyplot), matplotlib.MatplotlibDeprecationWarning, sns (seaborn), np (numpy), msticpy.data.QueryProvider, msticpy.nbtools.foliummap.FoliumMap, msticpy.common.utility.md, msticpy.common.utility.md_warn, msticpy.common.wsconfig.WorkspaceConfig, msticpy.datamodel.pivot.Pivot, msticpy.datamodel.entities, urllib.request.urlretrieve
" + "text/html": [ + "Imported: pd (pandas), IPython.get_ipython, IPython.display.display, IPython.display.HTML, IPython.display.Markdown, widgets (ipywidgets), pathlib.Path, plt (matplotlib.pyplot), matplotlib.MatplotlibDeprecationWarning, sns (seaborn), np (numpy), msticpy.data.QueryProvider, msticpy.nbtools.foliummap.FoliumMap, msticpy.common.utility.md, msticpy.common.utility.md_warn, msticpy.common.wsconfig.WorkspaceConfig, msticpy.datamodel.pivot.Pivot, msticpy.datamodel.entities, urllib.request.urlretrieve
" + ], + "text/plain": [ + "" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" }, { - "output_type": "display_data", "data": { - "text/plain": "", - "text/html": "Checking configuration....
" + "text/html": [ + "Checking configuration....
" + ], + "text/plain": [ + "" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" }, { - "output_type": "display_data", "data": { - "text/plain": "", - "text/html": "Setting notebook options....
" + "text/html": [ + "Setting notebook options....
" + ], + "text/plain": [ + "" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" }, { - "output_type": "display_data", "data": { - "text/plain": "", - "text/html": "
" + "text/html": [ + "
" + ], + "text/plain": [ + "" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" }, { - "output_type": "display_data", "data": { - "text/plain": "", - "text/html": "

Notebook initialization complete

" + "text/html": [ + "

Notebook initialization complete

" + ], + "text/plain": [ + "" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" } ], "source": [ @@ -520,16 +556,18 @@ "metadata": {}, "outputs": [ { - "output_type": "display_data", "data": { - "text/plain": "VBox(children=(Tab(children=(VBox(children=(Label(value='Azure Sentinel workspace settings'), HBox(children=(V…", "application/vnd.jupyter.widget-view+json": { + "model_id": "b5f6c73f8b6343fabbc42866b360008b", "version_major": 2, - "version_minor": 0, - "model_id": "b5f6c73f8b6343fabbc42866b360008b" - } + "version_minor": 0 + }, + "text/plain": [ + "VBox(children=(Tab(children=(VBox(children=(Label(value='Azure Sentinel workspace settings'), HBox(children=(V…" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" } ], "source": [ @@ -622,16 +660,18 @@ "metadata": {}, "outputs": [ { - "output_type": "display_data", "data": { - "text/plain": "VBox(children=(Tab(children=(VBox(children=(Label(value='Azure Sentinel workspace settings'), HBox(children=(V…", "application/vnd.jupyter.widget-view+json": { + "model_id": "b5f6c73f8b6343fabbc42866b360008b", "version_major": 2, - "version_minor": 0, - "model_id": "b5f6c73f8b6343fabbc42866b360008b" - } + "version_minor": 0 + }, + "text/plain": [ + "VBox(children=(Tab(children=(VBox(children=(Label(value='Azure Sentinel workspace settings'), HBox(children=(V…" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" } ], "source": [ @@ -643,34 +683,34 @@ "cell_type": "markdown", "metadata": {}, "source": [ - "Our notebooks commonly use IP geo-location information. \r\n", - "In order to enable this we are going to set up [MaxMind GeoLite2](https://www.maxmind.com)\r\n", - "to provide geolocation lookup services for IP addresses.\r\n", - "\r\n", - "GeoLite2 uses a downloaded database which requires an account key to download.\r\n", - "You can sign up for a free account and API key at \r\n", - "[The Maxmind signup page - https://www.maxmind.com/en/geolite2/signup](https://www.maxmind.com/en/geolite2/signup).\r\n", - "
\r\n", - "\r\n", - "
\r\n", - " Using IPStack as an alernative to GeoLite2...\r\n", - "

\r\n", - " For more details see the\r\n", - " \r\n", - " MSTICPy GeoIP Providers documentation\r\n", - "

\r\n", - "
\r\n", - "
\r\n", - "\r\n", - "Once, you have an account, run the following cell to add the Maxmind GeopIP Lite details to your configuration.\r\n", - "\r\n", - "The procedure is similar to the one we used for VirusTotal:\r\n", - "\r\n", - "1. Select the \"GeoIPLite\" provider from the **Add prov** drop-down\r\n", - "2. Click **Add**\r\n", - "3. Select **Text** Storage and paste the key into the text box\r\n", - "4. Click **Update**\r\n", - "5. Click **Save Settings** to write your settings to your configuration.\r\n" + "Our notebooks commonly use IP geo-location information. \n", + "In order to enable this we are going to set up [MaxMind GeoLite2](https://www.maxmind.com)\n", + "to provide geolocation lookup services for IP addresses.\n", + "\n", + "GeoLite2 uses a downloaded database which requires an account key to download.\n", + "You can sign up for a free account and a license key at \n", + "[The Maxmind signup page - https://www.maxmind.com/en/geolite2/signup](https://www.maxmind.com/en/geolite2/signup).\n", + "
\n", + "\n", + "
\n", + " Using IPStack as an alernative to GeoLite2...\n", + "

\n", + " For more details see the\n", + " \n", + " MSTICPy GeoIP Providers documentation\n", + "

\n", + "
\n", + "
\n", + "\n", + "Once, you have an account, run the following cell to add the Maxmind GeopIP Lite details to your configuration.\n", + "\n", + "The procedure is similar to the one we used for VirusTotal:\n", + "\n", + "1. Select the \"GeoIPLite\" provider from the **Add prov** drop-down\n", + "2. Click **Add**\n", + "3. Select **Text** Storage and paste the license (API/Auth) key into the text box\n", + "4. Click **Update**\n", + "5. Click **Save Settings** to write your settings to your configuration.\n" ] }, { @@ -679,16 +719,18 @@ "metadata": {}, "outputs": [ { - "output_type": "display_data", "data": { - "text/plain": "VBox(children=(Tab(children=(VBox(children=(Label(value='Azure Sentinel workspace settings'), HBox(children=(V…", "application/vnd.jupyter.widget-view+json": { + "model_id": "b5f6c73f8b6343fabbc42866b360008b", "version_major": 2, - "version_minor": 0, - "model_id": "b5f6c73f8b6343fabbc42866b360008b" - } + "version_minor": 0 + }, + "text/plain": [ + "VBox(children=(Tab(children=(VBox(children=(Label(value='Azure Sentinel workspace settings'), HBox(children=(V…" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" } ], "source": [ @@ -846,27 +888,35 @@ "metadata": {}, "outputs": [ { - "output_type": "stream", "name": "stdout", + "output_type": "stream", "text": [ "Please wait. Loading Kqlmagic extension...\n" ] }, { - "output_type": "display_data", "data": { - "text/plain": "", - "application/javascript": "try {IPython.notebook.kernel.reconnect();} catch(err) {;}" + "application/javascript": [ + "try {IPython.notebook.kernel.reconnect();} catch(err) {;}" + ], + "text/plain": [ + "" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" }, { - "output_type": "display_data", "data": { - "text/plain": "", - "application/javascript": "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}" + "application/javascript": [ + "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}" + ], + "text/plain": [ + "" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" } ], "source": [ @@ -931,28 +981,158 @@ "metadata": {}, "outputs": [ { - "output_type": "display_data", "data": { - "text/plain": "", - "application/javascript": "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}" + "application/javascript": [ + "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}" + ], + "text/plain": [ + "" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" }, { - "output_type": "display_data", "data": { - "text/plain": "", - "text/html": "\n \n
\n \n \n
\n\n \n\n " + "text/html": [ + "\n", + " \n", + "
\n", + " \n", + " \n", + "
\n", + "\n", + " \n", + "\n", + " " + ], + "text/plain": [ + "" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" }, { - "output_type": "display_data", "data": { - "text/plain": "", - "application/javascript": "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}" + "application/javascript": [ + "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}" + ], + "text/plain": [ + "" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" } ], "source": [ @@ -987,14 +1167,13 @@ "metadata": {}, "outputs": [ { - "output_type": "stream", "name": "stdout", + "output_type": "stream", "text": [ "Sample of first 10 tables in the schema\n" ] }, { - "output_type": "execute_result", "data": { "text/plain": [ "['AACAudit',\n", @@ -1009,8 +1188,9 @@ " 'AADManagedIdentitySignInLogs']" ] }, + "execution_count": 8, "metadata": {}, - "execution_count": 8 + "output_type": "execute_result" } ], "source": [ @@ -1036,10 +1216,33 @@ "metadata": {}, "outputs": [ { - "output_type": "stream", "name": "stdout", + "output_type": "stream", "text": [ - "Sample of queries\n=================\n['Azure.get_vmcomputer_for_host', 'Azure.list_azure_activity_for_account', 'AzureNetwork.az_net_analytics', 'AzureNetwork.get_heartbeat_for_ip', 'AzureSentinel.get_bookmark_by_id', 'Heartbeat.get_heartbeat_for_host', 'LinuxSyslog.all_syslog', 'LinuxSyslog.list_logon_failures', 'LinuxSyslog.sudo_activity', 'MultiDataSource.get_timeseries_decompose', 'Network.get_host_for_ip', 'Office365.list_activity_for_ip', 'SecurityAlert.list_alerts_for_ip', 'ThreatIntelligence.list_indicators_by_filepath', 'WindowsSecurity.get_parent_process', 'WindowsSecurity.list_host_events', 'WindowsSecurity.list_hosts_matching_commandline', 'WindowsSecurity.list_other_events']\n\nHelp for 'list_all_signins_geo' query\n=====================================\nQuery: list_all_signins_geo\nData source: AzureSentinel\nGets Signin data used by morph charts\n\nParameters\n----------\nadd_query_items: str (optional)\n Additional query clauses\nend: datetime (optional)\n Query end time\nstart: datetime (optional)\n Query start time\n (default value is: -5)\ntable: str (optional)\n Table name\n (default value is: SigninLogs)\nQuery:\n {table} | where TimeGenerated >= datetime({start}) | where TimeGenerated <= datetime({end}) | extend Result = iif(ResultType==0, \"Sucess\", \"Failed\") | extend Latitude = tostring(parse_json(tostring(LocationDetails.geoCoordinates)).latitude) | extend Longitude = tostring(parse_json(tostring(LocationDetails.geoCoordinates)).longitude)\n" + "Sample of queries\n", + "=================\n", + "['Azure.get_vmcomputer_for_host', 'Azure.list_azure_activity_for_account', 'AzureNetwork.az_net_analytics', 'AzureNetwork.get_heartbeat_for_ip', 'AzureSentinel.get_bookmark_by_id', 'Heartbeat.get_heartbeat_for_host', 'LinuxSyslog.all_syslog', 'LinuxSyslog.list_logon_failures', 'LinuxSyslog.sudo_activity', 'MultiDataSource.get_timeseries_decompose', 'Network.get_host_for_ip', 'Office365.list_activity_for_ip', 'SecurityAlert.list_alerts_for_ip', 'ThreatIntelligence.list_indicators_by_filepath', 'WindowsSecurity.get_parent_process', 'WindowsSecurity.list_host_events', 'WindowsSecurity.list_hosts_matching_commandline', 'WindowsSecurity.list_other_events']\n", + "\n", + "Help for 'list_all_signins_geo' query\n", + "=====================================\n", + "Query: list_all_signins_geo\n", + "Data source: AzureSentinel\n", + "Gets Signin data used by morph charts\n", + "\n", + "Parameters\n", + "----------\n", + "add_query_items: str (optional)\n", + " Additional query clauses\n", + "end: datetime (optional)\n", + " Query end time\n", + "start: datetime (optional)\n", + " Query start time\n", + " (default value is: -5)\n", + "table: str (optional)\n", + " Table name\n", + " (default value is: SigninLogs)\n", + "Query:\n", + " {table} | where TimeGenerated >= datetime({start}) | where TimeGenerated <= datetime({end}) | extend Result = iif(ResultType==0, \"Sucess\", \"Failed\") | extend Latitude = tostring(parse_json(tostring(LocationDetails.geoCoordinates)).latitude) | extend Longitude = tostring(parse_json(tostring(LocationDetails.geoCoordinates)).longitude)\n" ] } ], @@ -1075,32 +1278,53 @@ "metadata": {}, "outputs": [ { - "output_type": "display_data", "data": { - "text/plain": "VBox(children=(Text(value='', description='Filter:', style=DescriptionStyle(description_width='initial')), Sel…", "application/vnd.jupyter.widget-view+json": { + "model_id": "7bc27562a44d4b2ca7c1abe2b7503abf", "version_major": 2, - "version_minor": 0, - "model_id": "7bc27562a44d4b2ca7c1abe2b7503abf" - } + "version_minor": 0 + }, + "text/plain": [ + "VBox(children=(Text(value='', description='Filter:', style=DescriptionStyle(description_width='initial')), Sel…" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" }, { - "output_type": "display_data", "data": { - "text/plain": "", - "text/html": "
" + "text/html": [ + "
" + ], + "text/plain": [ + "" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" }, { - "output_type": "display_data", "data": { - "text/plain": "", - "text/html": "

Retrieves a single Bookmark by BookmarkId

Parameters

add_query_items: str (optional)
Additional query clauses
bookmark_id: str
Identitifier of bookmark
end: datetime (optional)
Query end time
query_project: str (optional)
Column project statement
start: datetime (optional)
Query start time
(default value is: -30)
table: str (optional)
Table name
(default value is: HuntingBookmark)

Query

{table} {query_project} HuntingBookmark \n| where BookmarkId =~ \"{bookmark_id}\" \n| extend QryResults = todynamic(QueryResultRow) \n| extend Computer = QryResults[\"Computer\"] \n| extend Account = QryResults[\"Account\"] \n| extend Entities = QryResults.__entityMapping \n| project-away QryResults \n| where SoftDeleted == false {add_query_items}

\n

Example

\n

{QueryProvider}[.QueryPath].QueryName(params...)

\n 
qry_prov.AzureSentinel.get_bookmark_by_id(start=start, end=end, hostname=host)
\n " + "text/html": [ + "

Retrieves a single Bookmark by BookmarkId

Parameters

add_query_items: str (optional)
Additional query clauses
bookmark_id: str
Identitifier of bookmark
end: datetime (optional)
Query end time
query_project: str (optional)
Column project statement
start: datetime (optional)
Query start time
(default value is: -30)
table: str (optional)
Table name
(default value is: HuntingBookmark)

Query

{table} {query_project} HuntingBookmark \n",
+       "| where BookmarkId =~ \"{bookmark_id}\" \n",
+       "| extend QryResults = todynamic(QueryResultRow) \n",
+       "| extend Computer = QryResults[\"Computer\"] \n",
+       "| extend Account = QryResults[\"Account\"] \n",
+       "| extend Entities = QryResults.__entityMapping \n",
+       "| project-away QryResults \n",
+       "| where SoftDeleted == false {add_query_items}

\n", + "

Example

\n", + "

{QueryProvider}[.QueryPath].QueryName(params...)

\n", + " 
qry_prov.AzureSentinel.get_bookmark_by_id(start=start, end=end, hostname=host)
\n", + " " + ], + "text/plain": [ + "" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" } ], "source": [ @@ -1129,16 +1353,18 @@ "metadata": {}, "outputs": [ { - "output_type": "display_data", "data": { - "text/plain": "VBox(children=(HTML(value='

Set query time boundaries

'), HBox(children=(DatePicker(value=datetime.date…", "application/vnd.jupyter.widget-view+json": { + "model_id": "fcd9ef03f87648ad9184fd7e057213c5", "version_major": 2, - "version_minor": 0, - "model_id": "fcd9ef03f87648ad9184fd7e057213c5" - } + "version_minor": 0 + }, + "text/plain": [ + "VBox(children=(HTML(value='

Set query time boundaries

'), HBox(children=(DatePicker(value=datetime.date…" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" } ], "source": [ @@ -1174,16 +1400,367 @@ "metadata": {}, "outputs": [ { - "output_type": "display_data", "data": { - "text/plain": "", - "application/javascript": "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}" + "application/javascript": [ + "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}" + ], + "text/plain": [ + "" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" }, { - "output_type": "execute_result", "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
TenantIdSourceSystemTimeGeneratedResourceIdOperationNameOperationVersionCategoryResultTypeResultSignatureResultDescriptionDurationMsCorrelationIdResourceResourceGroupResourceProviderIdentityLevelLocationAlternateSignInNameAppDisplayNameAppIdAuthenticationDetailsAuthenticationMethodsUsedAuthenticationProcessingDetailsAuthenticationRequirement...RiskLevelDuringSignInRiskStateResourceDisplayNameResourceIdentityServicePrincipalIdServicePrincipalNameStatusTokenIssuerNameTokenIssuerTypeUserAgentUserDisplayNameUserIdUserPrincipalNameAADTenantIdUserTypeFlaggedForReviewIPAddressFromResourceProviderSignInIdentifierSignInIdentifierTypeResourceTenantIdHomeTenantIdTypeResultLatitudeLongitude
08ecf8077-cf51-4820-aadd-14040956f35dAzure AD2021-07-14 10:56:30.062000+00:00/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiamSign-in activity1.0SignInLogs0None00a4ca097-b33d-4ed7-a19e-ad34bc299cd0Microsoft.aadiamMicrosoft.aadiamOn-Premises Directory Synchronization Service Account4USSync_DC01_3862ce34675f@seccxpninja.onmicrosoft.comMicrosoft Azure Active Directory Connectcb1056e2-e479-49de-ae31-7812af012ed8[\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-07-14T10:56:30.0626249+00:00\",\\r\\n \"authe...[\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n]singleFactorAuthentication...nonenoneWindows Azure Active Directory00000002-0000-0000-c000-000000000000{'errorCode': 0}AzureADOn-Premises Directory Synchronization Service Accountee856d98-cecd-4dbe-8833-bdeec67847d0sync_dc01_3862ce34675f@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9cMemberNoneSync_DC01_3862ce34675f@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cSigninLogsSucess38.73078155517578-78.17196655273438
18ecf8077-cf51-4820-aadd-14040956f35dAzure AD2021-07-14 10:56:34.868000+00:00/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiamSign-in activity1.0SignInLogs0None0dc57cafa-79fc-4c8e-83bc-c98e2ea9e3d8Microsoft.aadiamMicrosoft.aadiamOn-Premises Directory Synchronization Service Account4USSync_DC01_3862ce34675f@seccxpninja.onmicrosoft.comMicrosoft Azure Active Directory Connectcb1056e2-e479-49de-ae31-7812af012ed8[\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-07-14T10:56:34.8688399+00:00\",\\r\\n \"authe...[\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n]singleFactorAuthentication...nonenoneWindows Azure Active Directory00000002-0000-0000-c000-000000000000{'errorCode': 0}AzureADOn-Premises Directory Synchronization Service Accountee856d98-cecd-4dbe-8833-bdeec67847d0sync_dc01_3862ce34675f@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9cMemberNoneSync_DC01_3862ce34675f@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cSigninLogsSucess38.73078155517578-78.17196655273438
28ecf8077-cf51-4820-aadd-14040956f35dAzure AD2021-07-14 10:58:50.835000+00:00/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiamSign-in activity1.0SignInLogs0None0c08798f2-1c1e-4aba-a21b-74f8980ba40bMicrosoft.aadiamMicrosoft.aadiamOn-Premises Directory Synchronization Service Account4USSync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.comMicrosoft Azure Active Directory Connectcb1056e2-e479-49de-ae31-7812af012ed8[\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-07-14T10:58:50.8358827+00:00\",\\r\\n \"authe...[\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n]singleFactorAuthentication...nonenoneWindows Azure Active Directory00000002-0000-0000-c000-000000000000{'errorCode': 0}AzureADOn-Premises Directory Synchronization Service Account2235a468-ad9c-4375-8008-0a7be76994a7sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9cMemberNoneSync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cSigninLogsSucess38.7130012512207-78.15899658203125
38ecf8077-cf51-4820-aadd-14040956f35dAzure AD2021-07-14 10:58:56.135000+00:00/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiamSign-in activity1.0SignInLogs0None07c229664-97a5-4621-b5f9-31fa223c5952Microsoft.aadiamMicrosoft.aadiamOn-Premises Directory Synchronization Service Account4USSync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.comMicrosoft Azure Active Directory Connectcb1056e2-e479-49de-ae31-7812af012ed8[\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-07-14T10:58:56.1354096+00:00\",\\r\\n \"authe...[\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n]singleFactorAuthentication...nonenoneWindows Azure Active Directory00000002-0000-0000-c000-000000000000{'errorCode': 0}AzureADOn-Premises Directory Synchronization Service Account2235a468-ad9c-4375-8008-0a7be76994a7sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9cMemberNoneSync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cSigninLogsSucess38.7130012512207-78.15899658203125
48ecf8077-cf51-4820-aadd-14040956f35dAzure AD2021-07-14 11:26:30.812000+00:00/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiamSign-in activity1.0SignInLogs0None05d31f207-8c2f-4c19-ada8-4a89630a7b1eMicrosoft.aadiamMicrosoft.aadiamOn-Premises Directory Synchronization Service Account4USSync_DC01_3862ce34675f@seccxpninja.onmicrosoft.comMicrosoft Azure Active Directory Connectcb1056e2-e479-49de-ae31-7812af012ed8[\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-07-14T11:26:30.8128251+00:00\",\\r\\n \"authe...[\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n]singleFactorAuthentication...nonenoneWindows Azure Active Directory00000002-0000-0000-c000-000000000000{'errorCode': 0}AzureADOn-Premises Directory Synchronization Service Accountee856d98-cecd-4dbe-8833-bdeec67847d0sync_dc01_3862ce34675f@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9cMemberNoneSync_DC01_3862ce34675f@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cSigninLogsSucess38.7130012512207-78.15899658203125
\n", + "

5 rows × 69 columns

\n", + "
" + ], "text/plain": [ " TenantId SourceSystem \\\n", "0 8ecf8077-cf51-4820-aadd-14040956f35d Azure AD \n", @@ -1361,11 +1938,11 @@ "4 SigninLogs Sucess 38.7130012512207 -78.15899658203125 \n", "\n", "[5 rows x 69 columns]" - ], - "text/html": "
\n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
TenantIdSourceSystemTimeGeneratedResourceIdOperationNameOperationVersionCategoryResultTypeResultSignatureResultDescriptionDurationMsCorrelationIdResourceResourceGroupResourceProviderIdentityLevelLocationAlternateSignInNameAppDisplayNameAppIdAuthenticationDetailsAuthenticationMethodsUsedAuthenticationProcessingDetailsAuthenticationRequirement...RiskLevelDuringSignInRiskStateResourceDisplayNameResourceIdentityServicePrincipalIdServicePrincipalNameStatusTokenIssuerNameTokenIssuerTypeUserAgentUserDisplayNameUserIdUserPrincipalNameAADTenantIdUserTypeFlaggedForReviewIPAddressFromResourceProviderSignInIdentifierSignInIdentifierTypeResourceTenantIdHomeTenantIdTypeResultLatitudeLongitude
08ecf8077-cf51-4820-aadd-14040956f35dAzure AD2021-07-14 10:56:30.062000+00:00/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiamSign-in activity1.0SignInLogs0None00a4ca097-b33d-4ed7-a19e-ad34bc299cd0Microsoft.aadiamMicrosoft.aadiamOn-Premises Directory Synchronization Service Account4USSync_DC01_3862ce34675f@seccxpninja.onmicrosoft.comMicrosoft Azure Active Directory Connectcb1056e2-e479-49de-ae31-7812af012ed8[\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-07-14T10:56:30.0626249+00:00\",\\r\\n \"authe...[\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n]singleFactorAuthentication...nonenoneWindows Azure Active Directory00000002-0000-0000-c000-000000000000{'errorCode': 0}AzureADOn-Premises Directory Synchronization Service Accountee856d98-cecd-4dbe-8833-bdeec67847d0sync_dc01_3862ce34675f@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9cMemberNoneSync_DC01_3862ce34675f@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cSigninLogsSucess38.73078155517578-78.17196655273438
18ecf8077-cf51-4820-aadd-14040956f35dAzure AD2021-07-14 10:56:34.868000+00:00/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiamSign-in activity1.0SignInLogs0None0dc57cafa-79fc-4c8e-83bc-c98e2ea9e3d8Microsoft.aadiamMicrosoft.aadiamOn-Premises Directory Synchronization Service Account4USSync_DC01_3862ce34675f@seccxpninja.onmicrosoft.comMicrosoft Azure Active Directory Connectcb1056e2-e479-49de-ae31-7812af012ed8[\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-07-14T10:56:34.8688399+00:00\",\\r\\n \"authe...[\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n]singleFactorAuthentication...nonenoneWindows Azure Active Directory00000002-0000-0000-c000-000000000000{'errorCode': 0}AzureADOn-Premises Directory Synchronization Service Accountee856d98-cecd-4dbe-8833-bdeec67847d0sync_dc01_3862ce34675f@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9cMemberNoneSync_DC01_3862ce34675f@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cSigninLogsSucess38.73078155517578-78.17196655273438
28ecf8077-cf51-4820-aadd-14040956f35dAzure AD2021-07-14 10:58:50.835000+00:00/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiamSign-in activity1.0SignInLogs0None0c08798f2-1c1e-4aba-a21b-74f8980ba40bMicrosoft.aadiamMicrosoft.aadiamOn-Premises Directory Synchronization Service Account4USSync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.comMicrosoft Azure Active Directory Connectcb1056e2-e479-49de-ae31-7812af012ed8[\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-07-14T10:58:50.8358827+00:00\",\\r\\n \"authe...[\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n]singleFactorAuthentication...nonenoneWindows Azure Active Directory00000002-0000-0000-c000-000000000000{'errorCode': 0}AzureADOn-Premises Directory Synchronization Service Account2235a468-ad9c-4375-8008-0a7be76994a7sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9cMemberNoneSync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cSigninLogsSucess38.7130012512207-78.15899658203125
38ecf8077-cf51-4820-aadd-14040956f35dAzure AD2021-07-14 10:58:56.135000+00:00/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiamSign-in activity1.0SignInLogs0None07c229664-97a5-4621-b5f9-31fa223c5952Microsoft.aadiamMicrosoft.aadiamOn-Premises Directory Synchronization Service Account4USSync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.comMicrosoft Azure Active Directory Connectcb1056e2-e479-49de-ae31-7812af012ed8[\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-07-14T10:58:56.1354096+00:00\",\\r\\n \"authe...[\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n]singleFactorAuthentication...nonenoneWindows Azure Active Directory00000002-0000-0000-c000-000000000000{'errorCode': 0}AzureADOn-Premises Directory Synchronization Service Account2235a468-ad9c-4375-8008-0a7be76994a7sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9cMemberNoneSync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cSigninLogsSucess38.7130012512207-78.15899658203125
48ecf8077-cf51-4820-aadd-14040956f35dAzure AD2021-07-14 11:26:30.812000+00:00/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiamSign-in activity1.0SignInLogs0None05d31f207-8c2f-4c19-ada8-4a89630a7b1eMicrosoft.aadiamMicrosoft.aadiamOn-Premises Directory Synchronization Service Account4USSync_DC01_3862ce34675f@seccxpninja.onmicrosoft.comMicrosoft Azure Active Directory Connectcb1056e2-e479-49de-ae31-7812af012ed8[\\r\\n {\\r\\n \"authenticationStepDateTime\": \"2021-07-14T11:26:30.8128251+00:00\",\\r\\n \"authe...[\\r\\n {\\r\\n \"key\": \"IsCAEToken\",\\r\\n \"value\": \"False\"\\r\\n }\\r\\n]singleFactorAuthentication...nonenoneWindows Azure Active Directory00000002-0000-0000-c000-000000000000{'errorCode': 0}AzureADOn-Premises Directory Synchronization Service Accountee856d98-cecd-4dbe-8833-bdeec67847d0sync_dc01_3862ce34675f@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9cMemberNoneSync_DC01_3862ce34675f@seccxpninja.onmicrosoft.com4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cSigninLogsSucess38.7130012512207-78.15899658203125
\n

5 rows × 69 columns

\n
" + ] }, + "execution_count": 12, "metadata": {}, - "execution_count": 12 + "output_type": "execute_result" } ], "source": [ @@ -1412,16 +1989,103 @@ "metadata": {}, "outputs": [ { - "output_type": "display_data", "data": { - "text/plain": "", - "application/javascript": "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}" + "application/javascript": [ + "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}" + ], + "text/plain": [ + "" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" }, { - "output_type": "execute_result", "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
AlertNameNumAlerts
0Malicious credential theft tool execution detected47
1Suspicious PowerShell command line22
2Suspected DCSync attack (replication of directory services)13
3Suspicious service registration15
4Irregular creation of Azure resources13
.........
173Password set to never expires1
174test1
175Suspicion of NotPetya Malware - Illegal SMB Transaction Detected1
176Suspicion of NotPetya Malware - Illegal SMB Parameters Detected1
177Invalid SMB Message (DoublePulsar Backdoor Implant)1
\n", + "

178 rows × 2 columns

\n", + "
" + ], "text/plain": [ " AlertName \\\n", "0 Malicious credential theft tool execution detected \n", @@ -1450,11 +2114,11 @@ "177 1 \n", "\n", "[178 rows x 2 columns]" - ], - "text/html": "
\n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
AlertNameNumAlerts
0Malicious credential theft tool execution detected47
1Suspicious PowerShell command line22
2Suspected DCSync attack (replication of directory services)13
3Suspicious service registration15
4Irregular creation of Azure resources13
.........
173Password set to never expires1
174test1
175Suspicion of NotPetya Malware - Illegal SMB Transaction Detected1
176Suspicion of NotPetya Malware - Illegal SMB Parameters Detected1
177Invalid SMB Message (DoublePulsar Backdoor Implant)1
\n

178 rows × 2 columns

\n
" + ] }, + "execution_count": 13, "metadata": {}, - "execution_count": 13 + "output_type": "execute_result" } ], "source": [ @@ -1485,20 +2149,471 @@ "metadata": {}, "outputs": [ { - "output_type": "display_data", "data": { - "text/plain": "", - "application/javascript": "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}" + "application/javascript": [ + "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}" + ], + "text/plain": [ + "" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" }, { - "output_type": "display_data", "data": { - "text/plain": " TenantId Application UserDomain UserAgent \\\n0 8ecf8077-cf51-4820-aadd-14040956f35d \n1 8ecf8077-cf51-4820-aadd-14040956f35d \n2 8ecf8077-cf51-4820-aadd-14040956f35d \n3 8ecf8077-cf51-4820-aadd-14040956f35d \n4 8ecf8077-cf51-4820-aadd-14040956f35d \n\n RecordType TimeGenerated Operation \\\n0 50 2021-07-14 11:20:44+00:00 MailItemsAccessed \n1 50 2021-07-14 11:20:44+00:00 MailItemsAccessed \n2 50 2021-07-14 12:38:41+00:00 MailItemsAccessed \n3 50 2021-07-14 12:38:41+00:00 MailItemsAccessed \n4 50 2021-07-14 12:38:41+00:00 MailItemsAccessed \n\n OrganizationId OrganizationId_ \\\n0 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n1 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n2 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n3 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n4 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n\n UserType UserKey OfficeWorkload ResultStatus ResultReasonType \\\n0 Regular 100320003C017CC9 Exchange Succeeded Succeeded \n1 Regular 100320003C017CC9 Exchange Succeeded Succeeded \n2 Regular 100320003F8A6FC7 Exchange Succeeded Succeeded \n3 Regular 100320003F8A6FC7 Exchange Succeeded Succeeded \n4 Regular 100320003F8A6FC7 Exchange Succeeded Succeeded \n\n OfficeObjectId UserId \\\n0 FMorris@seccxpninja.onmicrosoft.com \n1 FMorris@seccxpninja.onmicrosoft.com \n2 MeganB@seccxp.ninja \n3 MeganB@seccxp.ninja \n4 MeganB@seccxp.ninja \n\n UserId_ ClientIP ClientIP_ Scope Site_ \\\n0 FMorris@seccxpninja.onmicrosoft.com \n1 FMorris@seccxpninja.onmicrosoft.com \n2 MeganB@seccxp.ninja \n3 MeganB@seccxp.ninja \n4 MeganB@seccxp.ninja \n\n ItemType EventSource Source_Name MachineDomainInfo ... ChannelType \\\n0 ... \n1 ... \n2 ... \n3 ... \n4 ... \n\n ChannelName ChannelGuid ExtraProperties AddOnType AddonName TabType Name \\\n0 None \n1 None \n2 None \n3 None \n4 None \n\n OldValue NewValue ItemName ChatThreadId ChatName CommunicationType \\\n0 \n1 \n2 \n3 \n4 \n\n AADGroupId AddOnGuid AppDistributionMode TargetUserId OperationScope \\\n0 \n1 \n2 \n3 \n4 \n\n AzureADAppId \\\n0 \n1 \n2 \n3 \n4 \n\n OperationProperties \\\n0 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n1 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n2 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n3 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n4 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n\n AppId ClientAppId \\\n0 7a5fbd1c-3e6d-461a-9075-83049393b3a7 7a5fbd1c-3e6d-461a-9075-83049393b3a7 \n1 7a5fbd1c-3e6d-461a-9075-83049393b3a7 7a5fbd1c-3e6d-461a-9075-83049393b3a7 \n2 414a677a-e50f-46ea-b89c-aebb8a9efbe2 \n3 414a677a-e50f-46ea-b89c-aebb8a9efbe2 \n4 414a677a-e50f-46ea-b89c-aebb8a9efbe2 \n\n Type _ResourceId \n0 OfficeActivity \n1 OfficeActivity \n2 OfficeActivity \n3 OfficeActivity \n4 OfficeActivity \n\n[5 rows x 131 columns]", - "text/html": "
\n\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
TenantIdApplicationUserDomainUserAgentRecordTypeTimeGeneratedOperationOrganizationIdOrganizationId_UserTypeUserKeyOfficeWorkloadResultStatusResultReasonTypeOfficeObjectIdUserIdUserId_ClientIPClientIP_ScopeSite_ItemTypeEventSourceSource_NameMachineDomainInfo...ChannelTypeChannelNameChannelGuidExtraPropertiesAddOnTypeAddonNameTabTypeNameOldValueNewValueItemNameChatThreadIdChatNameCommunicationTypeAADGroupIdAddOnGuidAppDistributionModeTargetUserIdOperationScopeAzureADAppIdOperationPropertiesAppIdClientAppIdType_ResourceId
08ecf8077-cf51-4820-aadd-14040956f35d502021-07-14 11:20:44+00:00MailItemsAccessed4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cRegular100320003C017CC9ExchangeSucceededSucceededFMorris@seccxpninja.onmicrosoft.comFMorris@seccxpninja.onmicrosoft.com...None[{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}]7a5fbd1c-3e6d-461a-9075-83049393b3a77a5fbd1c-3e6d-461a-9075-83049393b3a7OfficeActivity
18ecf8077-cf51-4820-aadd-14040956f35d502021-07-14 11:20:44+00:00MailItemsAccessed4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cRegular100320003C017CC9ExchangeSucceededSucceededFMorris@seccxpninja.onmicrosoft.comFMorris@seccxpninja.onmicrosoft.com...None[{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}]7a5fbd1c-3e6d-461a-9075-83049393b3a77a5fbd1c-3e6d-461a-9075-83049393b3a7OfficeActivity
28ecf8077-cf51-4820-aadd-14040956f35d502021-07-14 12:38:41+00:00MailItemsAccessed4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cRegular100320003F8A6FC7ExchangeSucceededSucceededMeganB@seccxp.ninjaMeganB@seccxp.ninja...None[{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}]414a677a-e50f-46ea-b89c-aebb8a9efbe2OfficeActivity
38ecf8077-cf51-4820-aadd-14040956f35d502021-07-14 12:38:41+00:00MailItemsAccessed4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cRegular100320003F8A6FC7ExchangeSucceededSucceededMeganB@seccxp.ninjaMeganB@seccxp.ninja...None[{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}]414a677a-e50f-46ea-b89c-aebb8a9efbe2OfficeActivity
48ecf8077-cf51-4820-aadd-14040956f35d502021-07-14 12:38:41+00:00MailItemsAccessed4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cRegular100320003F8A6FC7ExchangeSucceededSucceededMeganB@seccxp.ninjaMeganB@seccxp.ninja...None[{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}]414a677a-e50f-46ea-b89c-aebb8a9efbe2OfficeActivity
\n

5 rows × 131 columns

\n
" + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
TenantIdApplicationUserDomainUserAgentRecordTypeTimeGeneratedOperationOrganizationIdOrganizationId_UserTypeUserKeyOfficeWorkloadResultStatusResultReasonTypeOfficeObjectIdUserIdUserId_ClientIPClientIP_ScopeSite_ItemTypeEventSourceSource_NameMachineDomainInfo...ChannelTypeChannelNameChannelGuidExtraPropertiesAddOnTypeAddonNameTabTypeNameOldValueNewValueItemNameChatThreadIdChatNameCommunicationTypeAADGroupIdAddOnGuidAppDistributionModeTargetUserIdOperationScopeAzureADAppIdOperationPropertiesAppIdClientAppIdType_ResourceId
08ecf8077-cf51-4820-aadd-14040956f35d502021-07-14 11:20:44+00:00MailItemsAccessed4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cRegular100320003C017CC9ExchangeSucceededSucceededFMorris@seccxpninja.onmicrosoft.comFMorris@seccxpninja.onmicrosoft.com...None[{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}]7a5fbd1c-3e6d-461a-9075-83049393b3a77a5fbd1c-3e6d-461a-9075-83049393b3a7OfficeActivity
18ecf8077-cf51-4820-aadd-14040956f35d502021-07-14 11:20:44+00:00MailItemsAccessed4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cRegular100320003C017CC9ExchangeSucceededSucceededFMorris@seccxpninja.onmicrosoft.comFMorris@seccxpninja.onmicrosoft.com...None[{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}]7a5fbd1c-3e6d-461a-9075-83049393b3a77a5fbd1c-3e6d-461a-9075-83049393b3a7OfficeActivity
28ecf8077-cf51-4820-aadd-14040956f35d502021-07-14 12:38:41+00:00MailItemsAccessed4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cRegular100320003F8A6FC7ExchangeSucceededSucceededMeganB@seccxp.ninjaMeganB@seccxp.ninja...None[{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}]414a677a-e50f-46ea-b89c-aebb8a9efbe2OfficeActivity
38ecf8077-cf51-4820-aadd-14040956f35d502021-07-14 12:38:41+00:00MailItemsAccessed4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cRegular100320003F8A6FC7ExchangeSucceededSucceededMeganB@seccxp.ninjaMeganB@seccxp.ninja...None[{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}]414a677a-e50f-46ea-b89c-aebb8a9efbe2OfficeActivity
48ecf8077-cf51-4820-aadd-14040956f35d502021-07-14 12:38:41+00:00MailItemsAccessed4b2462a4-bbee-495a-a0e1-f23ae524cc9c4b2462a4-bbee-495a-a0e1-f23ae524cc9cRegular100320003F8A6FC7ExchangeSucceededSucceededMeganB@seccxp.ninjaMeganB@seccxp.ninja...None[{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}]414a677a-e50f-46ea-b89c-aebb8a9efbe2OfficeActivity
\n", + "

5 rows × 131 columns

\n", + "
" + ], + "text/plain": [ + " TenantId Application UserDomain UserAgent \\\n", + "0 8ecf8077-cf51-4820-aadd-14040956f35d \n", + "1 8ecf8077-cf51-4820-aadd-14040956f35d \n", + "2 8ecf8077-cf51-4820-aadd-14040956f35d \n", + "3 8ecf8077-cf51-4820-aadd-14040956f35d \n", + "4 8ecf8077-cf51-4820-aadd-14040956f35d \n", + "\n", + " RecordType TimeGenerated Operation \\\n", + "0 50 2021-07-14 11:20:44+00:00 MailItemsAccessed \n", + "1 50 2021-07-14 11:20:44+00:00 MailItemsAccessed \n", + "2 50 2021-07-14 12:38:41+00:00 MailItemsAccessed \n", + "3 50 2021-07-14 12:38:41+00:00 MailItemsAccessed \n", + "4 50 2021-07-14 12:38:41+00:00 MailItemsAccessed \n", + "\n", + " OrganizationId OrganizationId_ \\\n", + "0 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", + "1 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", + "2 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", + "3 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", + "4 4b2462a4-bbee-495a-a0e1-f23ae524cc9c 4b2462a4-bbee-495a-a0e1-f23ae524cc9c \n", + "\n", + " UserType UserKey OfficeWorkload ResultStatus ResultReasonType \\\n", + "0 Regular 100320003C017CC9 Exchange Succeeded Succeeded \n", + "1 Regular 100320003C017CC9 Exchange Succeeded Succeeded \n", + "2 Regular 100320003F8A6FC7 Exchange Succeeded Succeeded \n", + "3 Regular 100320003F8A6FC7 Exchange Succeeded Succeeded \n", + "4 Regular 100320003F8A6FC7 Exchange Succeeded Succeeded \n", + "\n", + " OfficeObjectId UserId \\\n", + "0 FMorris@seccxpninja.onmicrosoft.com \n", + "1 FMorris@seccxpninja.onmicrosoft.com \n", + "2 MeganB@seccxp.ninja \n", + "3 MeganB@seccxp.ninja \n", + "4 MeganB@seccxp.ninja \n", + "\n", + " UserId_ ClientIP ClientIP_ Scope Site_ \\\n", + "0 FMorris@seccxpninja.onmicrosoft.com \n", + "1 FMorris@seccxpninja.onmicrosoft.com \n", + "2 MeganB@seccxp.ninja \n", + "3 MeganB@seccxp.ninja \n", + "4 MeganB@seccxp.ninja \n", + "\n", + " ItemType EventSource Source_Name MachineDomainInfo ... ChannelType \\\n", + "0 ... \n", + "1 ... \n", + "2 ... \n", + "3 ... \n", + "4 ... \n", + "\n", + " ChannelName ChannelGuid ExtraProperties AddOnType AddonName TabType Name \\\n", + "0 None \n", + "1 None \n", + "2 None \n", + "3 None \n", + "4 None \n", + "\n", + " OldValue NewValue ItemName ChatThreadId ChatName CommunicationType \\\n", + "0 \n", + "1 \n", + "2 \n", + "3 \n", + "4 \n", + "\n", + " AADGroupId AddOnGuid AppDistributionMode TargetUserId OperationScope \\\n", + "0 \n", + "1 \n", + "2 \n", + "3 \n", + "4 \n", + "\n", + " AzureADAppId \\\n", + "0 \n", + "1 \n", + "2 \n", + "3 \n", + "4 \n", + "\n", + " OperationProperties \\\n", + "0 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n", + "1 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n", + "2 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n", + "3 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n", + "4 [{'Name': 'MailAccessType', 'Value': 'Bind'}, {'Name': 'IsThrottled', 'Value': 'False'}] \n", + "\n", + " AppId ClientAppId \\\n", + "0 7a5fbd1c-3e6d-461a-9075-83049393b3a7 7a5fbd1c-3e6d-461a-9075-83049393b3a7 \n", + "1 7a5fbd1c-3e6d-461a-9075-83049393b3a7 7a5fbd1c-3e6d-461a-9075-83049393b3a7 \n", + "2 414a677a-e50f-46ea-b89c-aebb8a9efbe2 \n", + "3 414a677a-e50f-46ea-b89c-aebb8a9efbe2 \n", + "4 414a677a-e50f-46ea-b89c-aebb8a9efbe2 \n", + "\n", + " Type _ResourceId \n", + "0 OfficeActivity \n", + "1 OfficeActivity \n", + "2 OfficeActivity \n", + "3 OfficeActivity \n", + "4 OfficeActivity \n", + "\n", + "[5 rows x 131 columns]" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" } ], "source": [ @@ -1565,39 +2680,62 @@ "metadata": {}, "outputs": [ { - "output_type": "stream", "name": "stdout", + "output_type": "stream", "text": [ "Using Open PageRank. See https://www.domcop.com/openpagerank/what-is-openpagerank\n" ] }, { - "output_type": "display_data", "data": { - "text/plain": "VBox(children=(Text(value='', description='Filter:', style=DescriptionStyle(description_width='initial')), Sel…", "application/vnd.jupyter.widget-view+json": { + "model_id": "15c64b7a9491458f9607b6454d52c055", "version_major": 2, - "version_minor": 0, - "model_id": "15c64b7a9491458f9607b6454d52c055" - } + "version_minor": 0 + }, + "text/plain": [ + "VBox(children=(Text(value='', description='Filter:', style=DescriptionStyle(description_width='initial')), Sel…" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" }, { - "output_type": "display_data", "data": { - "text/plain": "", - "text/html": "
" + "text/html": [ + "
" + ], + "text/plain": [ + "" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" }, { - "output_type": "display_data", "data": { - "text/plain": "", - "text/html": "

85.214.149.236

Type: 'ipv4', Provider: VirusTotal, severity: high

Details

\n\n
VirusTotal
verbose_msgIP address in dataset
response_code1
positives217
detected_urls['http://85.214.149.236/sugarcrm/themes/default/images/', 'http://85.214.149.236:443/sugarcrm/themes/default/images/stock.jpg', 'http://85.214.149.236:443/sugarcrm/themes/default/images/tshd.jpg', 'http://85.214.149.236/', 'http://85.214.149.236:443/sugarcrm/themes/default/images/bioset.jpg', 'http://85.214.149.236:443/sugarcrm/themes/default/images/mod.jpg', 'http://85.214.149.236:443/sugarcrm/themes/default/images/default.jpg', 'http://dockerupdate.anondns.net/', 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/', 'http://85.214.149.236:443/sugarcrm/themes/default/images/', 'http://85.214.149.236:443/sugarcrm/themes/default/images/kube.jpg', 'http://85.214.149.236:443/']
detected_downloaded_samples['75a733d99d72d1d0d6ca99ec852d97ae8c515ed136e12195e96adf6df7bbad41', '252bf8c685289759b90c1de6f9db345c2cfe62e6f8aad9a7f44dfb3c8508487a', 'e15550481e89dbd154b875ce50cc5af4b49f9ff7b837d9ac5b5594e5d63966a3']
detected_communicating_samples[]

Reference:

https://www.virustotal.com/vtapi/v2/ip-address/report

Raw Results

\n
\n Raw results from provider...\n 
{'as_owner': 'Strato AG',
 'asn': 6724,
 'country': 'DE',
 'detected_communicating_samples': [{'date': '2021-06-11 01:23:22',
                                     'positives': 13,
                                     'sha256': 'ab12b5d03f8467a1089d3d40ef9c4a54fb16ee61bb68714040e9edf96b5e763f',
                                     'total': 74},
                                    {'date': '2021-06-10 07:31:53',
                                     'positives': 30,
                                     'sha256': '1aaf7bc48ff75e870db4fe6ec0b3ed9d99876d7e2fb3d5c4613cca92bbb95e1b',
                                     'total': 75},
                                    {'date': '2021-06-09 02:36:09',
                                     'positives': 30,
                                     'sha256': '36bf7b2ab7968880ccc696927c03167b6056e73043fd97a33d2468383a5bafce',
                                     'total': 75},
                                    {'date': '2021-05-17 21:40:23',
                                     'positives': 13,
                                     'sha256': '39ac019520a278e350065d12ebc0c24201584390724f3d8e0dc828664fee6cae',
                                     'total': 74},
                                    {'date': '2021-05-12 12:46:23',
                                     'positives': 6,
                                     'sha256': 'b60ffcc7153650d6a232b1cb249924b0c6384c27681860eb13b12f4705bc0a05',
                                     'total': 75},
                                    {'date': '2021-05-11 08:32:51',
                                     'positives': 14,
                                     'sha256': '1ad0104478301e73e3f49cdeb10f8c1a1d54bccf9248e34ff81352598f112e6b',
                                     'total': 75},
                                    {'date': '2021-04-21 10:08:11',
                                     'positives': 16,
                                     'sha256': '7b6f7c48256a8df2041e8726c3490ccb6987e1a76fee947e148ea68eee036889',
                                     'total': 76},
                                    {'date': '2021-03-31 15:34:40',
                                     'positives': 20,
                                     'sha256': 'ae3e4a1c8a2b661265e6c8c756e3ba472dc7177cae79fe1861ab0c2d1af5167a',
                                     'total': 75},
                                    {'date': '2021-03-27 04:35:12',
                                     'positives': 22,
                                     'sha256': '3b280a4017ef2c2aef4b3ed8bb47516b816166998462899935afb39b533890ad',
                                     'total': 75},
                                    {'date': '2020-08-18 19:53:07',
                                     'positives': 3,
                                     'sha256': '0742efecbd7af343213a50cc5fd5cd2f8475613cfe6fb51f4296a7ec4533940d',
                                     'total': 74}],
 'detected_downloaded_samples': [{'date': '2021-06-29 11:54:16',
                                  'positives': 26,
                                  'sha256': '75a733d99d72d1d0d6ca99ec852d97ae8c515ed136e12195e96adf6df7bbad41',
                                  'total': 75},
                                 {'date': '2021-07-08 08:53:31',
                                  'positives': 36,
                                  'sha256': '252bf8c685289759b90c1de6f9db345c2cfe62e6f8aad9a7f44dfb3c8508487a',
                                  'total': 74},
                                 {'date': '2021-07-08 08:53:30',
                                  'positives': 38,
                                  'sha256': 'e15550481e89dbd154b875ce50cc5af4b49f9ff7b837d9ac5b5594e5d63966a3',
                                  'total': 74},
                                 {'date': '2021-06-10 07:32:43',
                                  'positives': 33,
                                  'sha256': '139f393594aabb20543543bd7d3192422b886f58e04a910637b41f14d0cad375',
                                  'total': 75},
                                 {'date': '2021-06-10 07:31:49',
                                  'positives': 34,
                                  'sha256': 'a506c6cf25de202e6b2bf60fe0236911a6ff8aa33f12a78edad9165ab0851caf',
                                  'total': 75},
                                 {'date': '2021-03-02 07:13:18',
                                  'positives': 33,
                                  'sha256': 'feb0a0f5ffba9d7b7d6878a8890a6d67d3f8ef6106e4e88719a63c3351e46a06',
                                  'total': 76},
                                 {'date': '2021-02-08 02:39:20',
                                  'positives': 18,
                                  'sha256': '230e2a06df2cd7574ee15cb13714d77182f28d50f83a6ed58af39f1966177769',
                                  'total': 76},
                                 {'date': '2020-10-31 16:15:20',
                                  'positives': 30,
                                  'sha256': '36bf7b2ab7968880ccc696927c03167b6056e73043fd97a33d2468383a5bafce',
                                  'total': 76},
                                 {'date': '2020-10-19 16:08:06',
                                  'positives': 28,
                                  'sha256': '1aaf7bc48ff75e870db4fe6ec0b3ed9d99876d7e2fb3d5c4613cca92bbb95e1b',
                                  'total': 75},
                                 {'date': '2020-09-09 11:54:11',
                                  'positives': 24,
                                  'sha256': '9750b3be953bd31322dd173ca18f29e5997029b28b24fbeb5fec7ebb1974cb09',
                                  'total': 73},
                                 {'date': '2020-09-06 07:41:39',
                                  'positives': 23,
                                  'sha256': 'c0ab7d1caabdd090b2399cd1193d2cc2334218d3f3f0d3164b61b6014fd308e9',
                                  'total': 73},
                                 {'date': '2020-09-09 11:30:10',
                                  'positives': 1,
                                  'sha256': '767fc7ae032403bce2dbcefa525cf1a9fd02bbb185e45aa88d9bc28a5f22a2b6',
                                  'total': 73},
                                 {'date': '2020-07-22 02:02:29',
                                  'positives': 26,
                                  'sha256': '132df864f6750d29bf9f762b298f377c13b899aa8d07c0a6bda58adcffd0d6f7',
                                  'total': 76},
                                 {'date': '2020-08-20 06:57:04',
                                  'positives': 30,
                                  'sha256': '2c40b76408d59f906f60db97ea36503bfc59aed22a154f5d564d8449c300594f',
                                  'total': 75}],
 'detected_referrer_samples': [{'date': '2020-09-09 11:30:10',
                                'positives': 1,
                                'sha256': '767fc7ae032403bce2dbcefa525cf1a9fd02bbb185e45aa88d9bc28a5f22a2b6',
                                'total': 73}],
 'detected_urls': [{'positives': 10,
                    'scan_date': '2021-07-14 02:19:07',
                    'total': 89,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images/'},
                   {'positives': 9,
                    'scan_date': '2021-07-14 00:09:39',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/stock.jpg'},
                   {'positives': 11,
                    'scan_date': '2021-07-09 11:00:43',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/tshd.jpg'},
                   {'positives': 8,
                    'scan_date': '2021-07-08 11:39:22',
                    'total': 89,
                    'url': 'http://85.214.149.236/'},
                   {'positives': 12,
                    'scan_date': '2021-07-08 08:55:14',
                    'total': 90,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/bioset.jpg'},
                   {'positives': 9,
                    'scan_date': '2021-06-28 02:32:40',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/mod.jpg'},
                   {'positives': 10,
                    'scan_date': '2021-06-26 00:05:01',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/default.jpg'},
                   {'positives': 12,
                    'scan_date': '2021-06-23 12:00:19',
                    'total': 88,
                    'url': 'http://dockerupdate.anondns.net/'},
                   {'positives': 12,
                    'scan_date': '2021-06-21 01:57:07',
                    'total': 88,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/'},
                   {'positives': 8,
                    'scan_date': '2021-06-21 01:50:52',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/'},
                   {'positives': 9,
                    'scan_date': '2021-06-19 00:07:04',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/kube.jpg'},
                   {'positives': 7,
                    'scan_date': '2021-06-16 08:08:57',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/'},
                   {'positives': 8,
                    'scan_date': '2021-06-09 03:40:07',
                    'total': 89,
                    'url': 'https://85.214.149.236/sugarcrm/themes/default/images'},
                   {'positives': 7,
                    'scan_date': '2021-06-09 03:18:37',
                    'total': 89,
                    'url': 'https://85.214.149.236/sugarcrm/themes/default/images/'},
                   {'positives': 8,
                    'scan_date': '2021-06-08 15:50:06',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images'},
                   {'positives': 6,
                    'scan_date': '2021-04-21 00:07:34',
                    'total': 87,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images/stock.jpg'},
                   {'positives': 5,
                    'scan_date': '2021-04-01 13:42:58',
                    'total': 85,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images/mod.jpg'},
                   {'positives': 9,
                    'scan_date': '2021-03-19 18:12:09',
                    'total': 85,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/Carray.jpg'},
                   {'positives': 6,
                    'scan_date': '2021-01-12 10:34:27',
                    'total': 83,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images/kube.jpg'},
                   {'positives': 10,
                    'scan_date': '2020-12-28 02:17:00',
                    'total': 83,
                    'url': 'http://dockerupdate.anondns.net/sugarcrm/themes/default/images/'},
                   {'positives': 6,
                    'scan_date': '2020-12-19 10:34:37',
                    'total': 83,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images/default.jpg'},
                   {'positives': 6,
                    'scan_date': '2020-11-12 16:50:51',
                    'total': 81,
                    'url': 'http://85.214.149.236/sugarcrm/themes'},
                   {'positives': 14,
                    'scan_date': '2020-11-10 11:01:42',
                    'total': 81,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/mos.jpg'},
                   {'positives': 14,
                    'scan_date': '2020-11-08 15:00:49',
                    'total': 81,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/nk.jpg'},
                   {'positives': 6,
                    'scan_date': '2020-11-04 19:21:25',
                    'total': 81,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default'},
                   {'positives': 6,
                    'scan_date': '2020-10-29 00:55:07',
                    'total': 81,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images'},
                   {'positives': 12,
                    'scan_date': '2020-09-28 03:26:34',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm'},
                   {'positives': 9,
                    'scan_date': '2020-09-28 03:06:19',
                    'total': 80,
                    'url': 'http://85.214.149.236/sugarcrm/.../dns'},
                   {'positives': 11,
                    'scan_date': '2020-09-24 14:01:08',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net/sugarcrm/themes/default/images'},
                   {'positives': 12,
                    'scan_date': '2020-09-21 17:20:19',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/carray.jpg'},
                   {'positives': 6,
                    'scan_date': '2020-09-20 16:04:57',
                    'total': 80,
                    'url': 'http://85.214.149.236/sugarcrm'},
                   {'positives': 9,
                    'scan_date': '2020-09-17 17:36:08',
                    'total': 80,
                    'url': 'http://85.214.149.236:443/sugarcrm/banner.php'},
                   {'positives': 11,
                    'scan_date': '2020-09-10 07:55:21',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/'},
                   {'positives': 10,
                    'scan_date': '2020-09-09 12:06:14',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/Carray.jpg/'},
                   {'positives': 4,
                    'scan_date': '2020-09-09 12:05:12',
                    'total': 80,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/bioset.jpg/'},
                   {'positives': 11,
                    'scan_date': '2020-09-09 11:59:35',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net/sugarcrm/themes/default/images/mos.jpg'},
                   {'positives': 5,
                    'scan_date': '2020-09-09 11:48:55',
                    'total': 80,
                    'url': 'http://85.214.149.236:443/sugarcrm/.../run'},
                   {'positives': 4,
                    'scan_date': '2020-09-09 11:44:28',
                    'total': 80,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/mod.js'},
                   {'positives': 6,
                    'scan_date': '2020-09-09 11:35:26',
                    'total': 80,
                    'url': 'http://85.214.149.236:443/sugarcrm/.../cron.sh'},
                   {'positives': 11,
                    'scan_date': '2020-09-09 11:30:00',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net/sugarcrm/themes/default/images/nk.jpg'},
                   {'positives': 5,
                    'scan_date': '2020-09-05 03:44:35',
                    'total': 80,
                    'url': 'http://85.214.149.236/sugarcrm/...'},
                   {'positives': 8,
                    'scan_date': '2020-09-02 06:09:23',
                    'total': 80,
                    'url': 'https://dockerupdate.anondns.net/'},
                   {'positives': 6,
                    'scan_date': '2020-09-01 17:37:50',
                    'total': 79,
                    'url': 'http://85.214.149.236:443/sugarcrm/.../dns'},
                   {'positives': 1,
                    'scan_date': '2020-08-28 08:15:47',
                    'total': 78,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/mod.js\"'},
                   {'positives': 2,
                    'scan_date': '2020-08-27 13:22:06',
                    'total': 78,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/zgrab.jpg'},
                   {'positives': 7,
                    'scan_date': '2020-08-25 14:52:00',
                    'total': 79,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/portjoe.jpg'},
                   {'positives': 7,
                    'scan_date': '2020-08-25 07:02:55',
                    'total': 79,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images'},
                   {'positives': 4,
                    'scan_date': '2020-08-24 07:34:44',
                    'total': 79,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/01.jpg'}],
 'resolutions': [{'hostname': 'dockerupdate.anondns.net',
                  'last_resolved': '2020-08-14 18:56:08'},
                 {'hostname': 'h2381205.stratoserver.net',
                  'last_resolved': '2020-08-06 12:19:57'}],
 'response_code': 1,
 'undetected_communicating_samples': [{'date': '2021-06-24 10:15:37',
                                       'positives': 0,
                                       'sha256': '7149b53e4a3f9de2a7d47190af64f8b609618ed09f8440a64175049a90336775',
                                       'total': 75},
                                      {'date': '2021-06-09 10:51:49',
                                       'positives': 0,
                                       'sha256': '45cc4f38340bf1d4bb0010114ccf03112d14dee7815aa797d20854605fdca2d2',
                                       'total': 74},
                                      {'date': '2021-06-12 19:00:20',
                                       'positives': 0,
                                       'sha256': '020531aef7e069ee6e384f2fe9c49db9d99292d559c72da95276c2788b17d386',
                                       'total': 74},
                                      {'date': '2020-12-10 15:39:02',
                                       'positives': 0,
                                       'sha256': 'd9c46904d5bb808f2f0c28e819a31703f5155c4df66c4c4669f5d9e81f25dc66',
                                       'total': 75},
                                      {'date': '2020-08-28 07:36:29',
                                       'positives': 0,
                                       'sha256': 'd333c3cfb8b9ad1da5ee50f96a55dfbe70196f05fd88b5f04e925e32305cfff8',
                                       'total': 73},
                                      {'date': '2020-08-28 07:40:32',
                                       'positives': 0,
                                       'sha256': '18c178fb224ec17718e5f70a92041e721d9e380e70063cc4bfe3f61d6feb72d9',
                                       'total': 73},
                                      {'date': '2020-08-28 07:35:10',
                                       'positives': 0,
                                       'sha256': 'a5d14bb053b03e81e58101516c782360fe64d6469852c6aa06fc47c08b30b127',
                                       'total': 73},
                                      {'date': '2020-08-26 22:30:40',
                                       'positives': 0,
                                       'sha256': 'ba16f24e6294e8da28782c1d8e00189950dd4cbbb061ef13d1a4d84305651768',
                                       'total': 73},
                                      {'date': '2020-08-26 14:29:14',
                                       'positives': 0,
                                       'sha256': '1861eee8333dadcfe0d0dc10461f5f82fada8e42db9aa9efba6f258182e9c546',
                                       'total': 73},
                                      {'date': '2020-08-24 07:12:27',
                                       'positives': 0,
                                       'sha256': 'b485e6ccc9cfeb9c2034cebfeaf1bb3b3db0ac9996e5260fc1e95ce852b757c4',
                                       'total': 73}],
 'undetected_downloaded_samples': [{'date': '2020-09-09 11:44:35',
                                    'positives': 0,
                                    'sha256': 'e8812c8ff47b0542c7ee4d6bdff5bfbfd488a8e363d884074089c54b6ffc9789',
                                    'total': 73},
                                   {'date': '2020-07-16 04:03:02',
                                    'positives': 0,
                                    'sha256': '1474298ed7a5c63ca8098794cd743a276807cca0e678e046160718626bb038f3',
                                    'total': 76}],
 'undetected_referrer_samples': [],
 'undetected_urls': [['http://h2381205.stratoserver.net/',
                      '011bcc2795245bb9fac15c54e0e189b0c6e2f24c42c57fec7cfc654a8bb95106',
                      0,
                      80,
                      '2020-11-02 13:02:39'],
                     ['http://85.214.149.236:443/sugarcrm/.../',
                      '9ffbd9455f6aa190b4270b0d8bfe2c863c6495b94b0f510169999135476e4ed4',
                      0,
                      79,
                      '2020-07-14 10:52:05']],
 'verbose_msg': 'IP address in dataset'}
\n
\n " + "text/html": [ + "

85.214.149.236

Type: 'ipv4', Provider: VirusTotal, severity: high

Details

\n", + "\n", + "
VirusTotal
verbose_msgIP address in dataset
response_code1
positives217
detected_urls['http://85.214.149.236/sugarcrm/themes/default/images/', 'http://85.214.149.236:443/sugarcrm/themes/default/images/stock.jpg', 'http://85.214.149.236:443/sugarcrm/themes/default/images/tshd.jpg', 'http://85.214.149.236/', 'http://85.214.149.236:443/sugarcrm/themes/default/images/bioset.jpg', 'http://85.214.149.236:443/sugarcrm/themes/default/images/mod.jpg', 'http://85.214.149.236:443/sugarcrm/themes/default/images/default.jpg', 'http://dockerupdate.anondns.net/', 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/', 'http://85.214.149.236:443/sugarcrm/themes/default/images/', 'http://85.214.149.236:443/sugarcrm/themes/default/images/kube.jpg', 'http://85.214.149.236:443/']
detected_downloaded_samples['75a733d99d72d1d0d6ca99ec852d97ae8c515ed136e12195e96adf6df7bbad41', '252bf8c685289759b90c1de6f9db345c2cfe62e6f8aad9a7f44dfb3c8508487a', 'e15550481e89dbd154b875ce50cc5af4b49f9ff7b837d9ac5b5594e5d63966a3']
detected_communicating_samples[]

Reference:

https://www.virustotal.com/vtapi/v2/ip-address/report

Raw Results

\n", + "
\n", + " Raw results from provider...\n", + " 
{'as_owner': 'Strato AG',
 'asn': 6724,
 'country': 'DE',
 'detected_communicating_samples': [{'date': '2021-06-11 01:23:22',
                                     'positives': 13,
                                     'sha256': 'ab12b5d03f8467a1089d3d40ef9c4a54fb16ee61bb68714040e9edf96b5e763f',
                                     'total': 74},
                                    {'date': '2021-06-10 07:31:53',
                                     'positives': 30,
                                     'sha256': '1aaf7bc48ff75e870db4fe6ec0b3ed9d99876d7e2fb3d5c4613cca92bbb95e1b',
                                     'total': 75},
                                    {'date': '2021-06-09 02:36:09',
                                     'positives': 30,
                                     'sha256': '36bf7b2ab7968880ccc696927c03167b6056e73043fd97a33d2468383a5bafce',
                                     'total': 75},
                                    {'date': '2021-05-17 21:40:23',
                                     'positives': 13,
                                     'sha256': '39ac019520a278e350065d12ebc0c24201584390724f3d8e0dc828664fee6cae',
                                     'total': 74},
                                    {'date': '2021-05-12 12:46:23',
                                     'positives': 6,
                                     'sha256': 'b60ffcc7153650d6a232b1cb249924b0c6384c27681860eb13b12f4705bc0a05',
                                     'total': 75},
                                    {'date': '2021-05-11 08:32:51',
                                     'positives': 14,
                                     'sha256': '1ad0104478301e73e3f49cdeb10f8c1a1d54bccf9248e34ff81352598f112e6b',
                                     'total': 75},
                                    {'date': '2021-04-21 10:08:11',
                                     'positives': 16,
                                     'sha256': '7b6f7c48256a8df2041e8726c3490ccb6987e1a76fee947e148ea68eee036889',
                                     'total': 76},
                                    {'date': '2021-03-31 15:34:40',
                                     'positives': 20,
                                     'sha256': 'ae3e4a1c8a2b661265e6c8c756e3ba472dc7177cae79fe1861ab0c2d1af5167a',
                                     'total': 75},
                                    {'date': '2021-03-27 04:35:12',
                                     'positives': 22,
                                     'sha256': '3b280a4017ef2c2aef4b3ed8bb47516b816166998462899935afb39b533890ad',
                                     'total': 75},
                                    {'date': '2020-08-18 19:53:07',
                                     'positives': 3,
                                     'sha256': '0742efecbd7af343213a50cc5fd5cd2f8475613cfe6fb51f4296a7ec4533940d',
                                     'total': 74}],
 'detected_downloaded_samples': [{'date': '2021-06-29 11:54:16',
                                  'positives': 26,
                                  'sha256': '75a733d99d72d1d0d6ca99ec852d97ae8c515ed136e12195e96adf6df7bbad41',
                                  'total': 75},
                                 {'date': '2021-07-08 08:53:31',
                                  'positives': 36,
                                  'sha256': '252bf8c685289759b90c1de6f9db345c2cfe62e6f8aad9a7f44dfb3c8508487a',
                                  'total': 74},
                                 {'date': '2021-07-08 08:53:30',
                                  'positives': 38,
                                  'sha256': 'e15550481e89dbd154b875ce50cc5af4b49f9ff7b837d9ac5b5594e5d63966a3',
                                  'total': 74},
                                 {'date': '2021-06-10 07:32:43',
                                  'positives': 33,
                                  'sha256': '139f393594aabb20543543bd7d3192422b886f58e04a910637b41f14d0cad375',
                                  'total': 75},
                                 {'date': '2021-06-10 07:31:49',
                                  'positives': 34,
                                  'sha256': 'a506c6cf25de202e6b2bf60fe0236911a6ff8aa33f12a78edad9165ab0851caf',
                                  'total': 75},
                                 {'date': '2021-03-02 07:13:18',
                                  'positives': 33,
                                  'sha256': 'feb0a0f5ffba9d7b7d6878a8890a6d67d3f8ef6106e4e88719a63c3351e46a06',
                                  'total': 76},
                                 {'date': '2021-02-08 02:39:20',
                                  'positives': 18,
                                  'sha256': '230e2a06df2cd7574ee15cb13714d77182f28d50f83a6ed58af39f1966177769',
                                  'total': 76},
                                 {'date': '2020-10-31 16:15:20',
                                  'positives': 30,
                                  'sha256': '36bf7b2ab7968880ccc696927c03167b6056e73043fd97a33d2468383a5bafce',
                                  'total': 76},
                                 {'date': '2020-10-19 16:08:06',
                                  'positives': 28,
                                  'sha256': '1aaf7bc48ff75e870db4fe6ec0b3ed9d99876d7e2fb3d5c4613cca92bbb95e1b',
                                  'total': 75},
                                 {'date': '2020-09-09 11:54:11',
                                  'positives': 24,
                                  'sha256': '9750b3be953bd31322dd173ca18f29e5997029b28b24fbeb5fec7ebb1974cb09',
                                  'total': 73},
                                 {'date': '2020-09-06 07:41:39',
                                  'positives': 23,
                                  'sha256': 'c0ab7d1caabdd090b2399cd1193d2cc2334218d3f3f0d3164b61b6014fd308e9',
                                  'total': 73},
                                 {'date': '2020-09-09 11:30:10',
                                  'positives': 1,
                                  'sha256': '767fc7ae032403bce2dbcefa525cf1a9fd02bbb185e45aa88d9bc28a5f22a2b6',
                                  'total': 73},
                                 {'date': '2020-07-22 02:02:29',
                                  'positives': 26,
                                  'sha256': '132df864f6750d29bf9f762b298f377c13b899aa8d07c0a6bda58adcffd0d6f7',
                                  'total': 76},
                                 {'date': '2020-08-20 06:57:04',
                                  'positives': 30,
                                  'sha256': '2c40b76408d59f906f60db97ea36503bfc59aed22a154f5d564d8449c300594f',
                                  'total': 75}],
 'detected_referrer_samples': [{'date': '2020-09-09 11:30:10',
                                'positives': 1,
                                'sha256': '767fc7ae032403bce2dbcefa525cf1a9fd02bbb185e45aa88d9bc28a5f22a2b6',
                                'total': 73}],
 'detected_urls': [{'positives': 10,
                    'scan_date': '2021-07-14 02:19:07',
                    'total': 89,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images/'},
                   {'positives': 9,
                    'scan_date': '2021-07-14 00:09:39',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/stock.jpg'},
                   {'positives': 11,
                    'scan_date': '2021-07-09 11:00:43',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/tshd.jpg'},
                   {'positives': 8,
                    'scan_date': '2021-07-08 11:39:22',
                    'total': 89,
                    'url': 'http://85.214.149.236/'},
                   {'positives': 12,
                    'scan_date': '2021-07-08 08:55:14',
                    'total': 90,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/bioset.jpg'},
                   {'positives': 9,
                    'scan_date': '2021-06-28 02:32:40',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/mod.jpg'},
                   {'positives': 10,
                    'scan_date': '2021-06-26 00:05:01',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/default.jpg'},
                   {'positives': 12,
                    'scan_date': '2021-06-23 12:00:19',
                    'total': 88,
                    'url': 'http://dockerupdate.anondns.net/'},
                   {'positives': 12,
                    'scan_date': '2021-06-21 01:57:07',
                    'total': 88,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/'},
                   {'positives': 8,
                    'scan_date': '2021-06-21 01:50:52',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/'},
                   {'positives': 9,
                    'scan_date': '2021-06-19 00:07:04',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/kube.jpg'},
                   {'positives': 7,
                    'scan_date': '2021-06-16 08:08:57',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/'},
                   {'positives': 8,
                    'scan_date': '2021-06-09 03:40:07',
                    'total': 89,
                    'url': 'https://85.214.149.236/sugarcrm/themes/default/images'},
                   {'positives': 7,
                    'scan_date': '2021-06-09 03:18:37',
                    'total': 89,
                    'url': 'https://85.214.149.236/sugarcrm/themes/default/images/'},
                   {'positives': 8,
                    'scan_date': '2021-06-08 15:50:06',
                    'total': 89,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images'},
                   {'positives': 6,
                    'scan_date': '2021-04-21 00:07:34',
                    'total': 87,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images/stock.jpg'},
                   {'positives': 5,
                    'scan_date': '2021-04-01 13:42:58',
                    'total': 85,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images/mod.jpg'},
                   {'positives': 9,
                    'scan_date': '2021-03-19 18:12:09',
                    'total': 85,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/Carray.jpg'},
                   {'positives': 6,
                    'scan_date': '2021-01-12 10:34:27',
                    'total': 83,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images/kube.jpg'},
                   {'positives': 10,
                    'scan_date': '2020-12-28 02:17:00',
                    'total': 83,
                    'url': 'http://dockerupdate.anondns.net/sugarcrm/themes/default/images/'},
                   {'positives': 6,
                    'scan_date': '2020-12-19 10:34:37',
                    'total': 83,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images/default.jpg'},
                   {'positives': 6,
                    'scan_date': '2020-11-12 16:50:51',
                    'total': 81,
                    'url': 'http://85.214.149.236/sugarcrm/themes'},
                   {'positives': 14,
                    'scan_date': '2020-11-10 11:01:42',
                    'total': 81,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/mos.jpg'},
                   {'positives': 14,
                    'scan_date': '2020-11-08 15:00:49',
                    'total': 81,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/nk.jpg'},
                   {'positives': 6,
                    'scan_date': '2020-11-04 19:21:25',
                    'total': 81,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default'},
                   {'positives': 6,
                    'scan_date': '2020-10-29 00:55:07',
                    'total': 81,
                    'url': 'http://85.214.149.236/sugarcrm/themes/default/images'},
                   {'positives': 12,
                    'scan_date': '2020-09-28 03:26:34',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm'},
                   {'positives': 9,
                    'scan_date': '2020-09-28 03:06:19',
                    'total': 80,
                    'url': 'http://85.214.149.236/sugarcrm/.../dns'},
                   {'positives': 11,
                    'scan_date': '2020-09-24 14:01:08',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net/sugarcrm/themes/default/images'},
                   {'positives': 12,
                    'scan_date': '2020-09-21 17:20:19',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/carray.jpg'},
                   {'positives': 6,
                    'scan_date': '2020-09-20 16:04:57',
                    'total': 80,
                    'url': 'http://85.214.149.236/sugarcrm'},
                   {'positives': 9,
                    'scan_date': '2020-09-17 17:36:08',
                    'total': 80,
                    'url': 'http://85.214.149.236:443/sugarcrm/banner.php'},
                   {'positives': 11,
                    'scan_date': '2020-09-10 07:55:21',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/'},
                   {'positives': 10,
                    'scan_date': '2020-09-09 12:06:14',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/Carray.jpg/'},
                   {'positives': 4,
                    'scan_date': '2020-09-09 12:05:12',
                    'total': 80,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/bioset.jpg/'},
                   {'positives': 11,
                    'scan_date': '2020-09-09 11:59:35',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net/sugarcrm/themes/default/images/mos.jpg'},
                   {'positives': 5,
                    'scan_date': '2020-09-09 11:48:55',
                    'total': 80,
                    'url': 'http://85.214.149.236:443/sugarcrm/.../run'},
                   {'positives': 4,
                    'scan_date': '2020-09-09 11:44:28',
                    'total': 80,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/mod.js'},
                   {'positives': 6,
                    'scan_date': '2020-09-09 11:35:26',
                    'total': 80,
                    'url': 'http://85.214.149.236:443/sugarcrm/.../cron.sh'},
                   {'positives': 11,
                    'scan_date': '2020-09-09 11:30:00',
                    'total': 80,
                    'url': 'http://dockerupdate.anondns.net/sugarcrm/themes/default/images/nk.jpg'},
                   {'positives': 5,
                    'scan_date': '2020-09-05 03:44:35',
                    'total': 80,
                    'url': 'http://85.214.149.236/sugarcrm/...'},
                   {'positives': 8,
                    'scan_date': '2020-09-02 06:09:23',
                    'total': 80,
                    'url': 'https://dockerupdate.anondns.net/'},
                   {'positives': 6,
                    'scan_date': '2020-09-01 17:37:50',
                    'total': 79,
                    'url': 'http://85.214.149.236:443/sugarcrm/.../dns'},
                   {'positives': 1,
                    'scan_date': '2020-08-28 08:15:47',
                    'total': 78,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/mod.js\"'},
                   {'positives': 2,
                    'scan_date': '2020-08-27 13:22:06',
                    'total': 78,
                    'url': 'http://85.214.149.236:443/sugarcrm/themes/default/images/zgrab.jpg'},
                   {'positives': 7,
                    'scan_date': '2020-08-25 14:52:00',
                    'total': 79,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/portjoe.jpg'},
                   {'positives': 7,
                    'scan_date': '2020-08-25 07:02:55',
                    'total': 79,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images'},
                   {'positives': 4,
                    'scan_date': '2020-08-24 07:34:44',
                    'total': 79,
                    'url': 'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/01.jpg'}],
 'resolutions': [{'hostname': 'dockerupdate.anondns.net',
                  'last_resolved': '2020-08-14 18:56:08'},
                 {'hostname': 'h2381205.stratoserver.net',
                  'last_resolved': '2020-08-06 12:19:57'}],
 'response_code': 1,
 'undetected_communicating_samples': [{'date': '2021-06-24 10:15:37',
                                       'positives': 0,
                                       'sha256': '7149b53e4a3f9de2a7d47190af64f8b609618ed09f8440a64175049a90336775',
                                       'total': 75},
                                      {'date': '2021-06-09 10:51:49',
                                       'positives': 0,
                                       'sha256': '45cc4f38340bf1d4bb0010114ccf03112d14dee7815aa797d20854605fdca2d2',
                                       'total': 74},
                                      {'date': '2021-06-12 19:00:20',
                                       'positives': 0,
                                       'sha256': '020531aef7e069ee6e384f2fe9c49db9d99292d559c72da95276c2788b17d386',
                                       'total': 74},
                                      {'date': '2020-12-10 15:39:02',
                                       'positives': 0,
                                       'sha256': 'd9c46904d5bb808f2f0c28e819a31703f5155c4df66c4c4669f5d9e81f25dc66',
                                       'total': 75},
                                      {'date': '2020-08-28 07:36:29',
                                       'positives': 0,
                                       'sha256': 'd333c3cfb8b9ad1da5ee50f96a55dfbe70196f05fd88b5f04e925e32305cfff8',
                                       'total': 73},
                                      {'date': '2020-08-28 07:40:32',
                                       'positives': 0,
                                       'sha256': '18c178fb224ec17718e5f70a92041e721d9e380e70063cc4bfe3f61d6feb72d9',
                                       'total': 73},
                                      {'date': '2020-08-28 07:35:10',
                                       'positives': 0,
                                       'sha256': 'a5d14bb053b03e81e58101516c782360fe64d6469852c6aa06fc47c08b30b127',
                                       'total': 73},
                                      {'date': '2020-08-26 22:30:40',
                                       'positives': 0,
                                       'sha256': 'ba16f24e6294e8da28782c1d8e00189950dd4cbbb061ef13d1a4d84305651768',
                                       'total': 73},
                                      {'date': '2020-08-26 14:29:14',
                                       'positives': 0,
                                       'sha256': '1861eee8333dadcfe0d0dc10461f5f82fada8e42db9aa9efba6f258182e9c546',
                                       'total': 73},
                                      {'date': '2020-08-24 07:12:27',
                                       'positives': 0,
                                       'sha256': 'b485e6ccc9cfeb9c2034cebfeaf1bb3b3db0ac9996e5260fc1e95ce852b757c4',
                                       'total': 73}],
 'undetected_downloaded_samples': [{'date': '2020-09-09 11:44:35',
                                    'positives': 0,
                                    'sha256': 'e8812c8ff47b0542c7ee4d6bdff5bfbfd488a8e363d884074089c54b6ffc9789',
                                    'total': 73},
                                   {'date': '2020-07-16 04:03:02',
                                    'positives': 0,
                                    'sha256': '1474298ed7a5c63ca8098794cd743a276807cca0e678e046160718626bb038f3',
                                    'total': 76}],
 'undetected_referrer_samples': [],
 'undetected_urls': [['http://h2381205.stratoserver.net/',
                      '011bcc2795245bb9fac15c54e0e189b0c6e2f24c42c57fec7cfc654a8bb95106',
                      0,
                      80,
                      '2020-11-02 13:02:39'],
                     ['http://85.214.149.236:443/sugarcrm/.../',
                      '9ffbd9455f6aa190b4270b0d8bfe2c863c6495b94b0f510169999135476e4ed4',
                      0,
                      79,
                      '2020-07-14 10:52:05']],
 'verbose_msg': 'IP address in dataset'}
\n", + "
\n", + " " + ], + "text/plain": [ + "" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" } ], "source": [ @@ -1636,20 +2774,32 @@ "metadata": {}, "outputs": [ { - "output_type": "display_data", "data": { - "text/plain": "", - "text/html": "\nThis product includes GeoLite2 data created by MaxMind, available from\nhttps://www.maxmind.com.\n" + "text/html": [ + "\n", + "This product includes GeoLite2 data created by MaxMind, available from\n", + "https://www.maxmind.com.\n" + ], + "text/plain": [ + "" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" }, { - "output_type": "display_data", "data": { - "text/plain": "IpAddress(Address=85.214.149.236, Location={ 'AdditionalData': {},\n 'CountryCode': 'DE',\n...)", - "text/html": "

ipaddress

{ 'AdditionalData': {},
  'Address': '85.214.149.236',
  'Location': { 'AdditionalData': {},
                'CountryCode': 'DE',
                'CountryName': 'Germany',
                'Latitude': 51.2993,
                'Longitude': 9.491,
                'Type': 'geolocation',
                'edges': set()},
  'ThreatIntelligence': [],
  'Type': 'ipaddress',
  'edges': set()}" + "text/html": [ + "

ipaddress

{ 'AdditionalData': {},
  'Address': '85.214.149.236',
  'Location': { 'AdditionalData': {},
                'CountryCode': 'DE',
                'CountryName': 'Germany',
                'Latitude': 51.2993,
                'Longitude': 9.491,
                'Type': 'geolocation',
                'edges': set()},
  'ThreatIntelligence': [],
  'Type': 'ipaddress',
  'edges': set()}" + ], + "text/plain": [ + "IpAddress(Address=85.214.149.236, Location={ 'AdditionalData': {},\n", + " 'CountryCode': 'DE',\n", + "...)" + ] }, - "metadata": {} + "metadata": {}, + "output_type": "display_data" } ], "source": [ @@ -1891,6 +3041,18 @@ "language": "python", "name": "condadev" }, + "language_info": { + "codemirror_mode": { + "name": "ipython", + "version": 3 + }, + "file_extension": ".py", + "mimetype": "text/x-python", + "name": "python", + "nbconvert_exporter": "python", + "pygments_lexer": "ipython3", + "version": "3.7.10" + }, "widgets": { "application/vnd.jupyter.widget-state+json": { "state": {},