### Initialize MordorBrowser

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/data_acquisition/MordorData.md

Instantiate the MordorBrowser to start browsing datasets. Ensure msticpy is installed.

```ipython3
>>> from msticpy.vis.mordor_browser import MordorBrowser
>>> mdr_browser = MordorBrowser()
```

--------------------------------

### Query Help Example

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/data_acquisition/DataProviders.md

To get detailed information about a specific query, append '?' or 'help' to the query call. This will display the query name, data source, description, parameters, and the raw query string. This is useful for understanding query capabilities and required arguments.

```python
qry_prov.SecurityAlert.list_alerts('?')
```

--------------------------------

### Validate Cybereason Query with Time Parameters

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/data_acquisition/DataProv-Cybereason.md

This example shows how to set start and end times for a query and then validate the query structure before execution.

```ipython3
cybereason_prov.Connection.list_connections_from_process('print',
    hostname="hostname",
    pid=42
    start=-10,
    end=-2
)
```

--------------------------------

### Install MSTICPy with Azure and KQL extras

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/getting_started/Installing.md

Use this command to install MSTICPy with the 'azure' and 'kql' optional dependencies. Multiple extras can be specified separated by commas without spaces.

```bash
pip install msticpy[azure,kql]
```

--------------------------------

### Install Latest Dev Build

Source: https://github.com/microsoft/msticpy/blob/main/README.md

Install the latest development build directly from the GitHub repository.

```bash
pip install git+https://github.com/microsoft/msticpy
```

--------------------------------

### Install Kusto Packages

Source: https://github.com/microsoft/msticpy/blob/main/docs/notebooks/Kusto-Ingest.ipynb

Install the necessary Azure Kusto data and ingest packages using pip.

```bash
    > pip install azure-kusto-data azure-kusto-ingest
```

--------------------------------

### Install Core MSTICPy

Source: https://github.com/microsoft/msticpy/blob/main/README.md

Use this command to install the core msticpy package.

```bash
pip install msticpy
```

--------------------------------

### Install msticpy with SQL2KQL support

Source: https://github.com/microsoft/msticpy/blob/main/docs/notebooks/SqlToKql.ipynb

Install msticpy with the necessary extras for SQL to KQL conversion.

```python
%pip install --upgrade msticpy[sql2kql]
```

--------------------------------

### KeyVault Configuration Example

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/api/msticpy.auth.keyvault_settings.md

This is an example of the KeyVault section in the msticpyconfig.yaml file. It shows the parameters that can be configured for Azure Key Vault integration.

```yaml
KeyVault:
    TenantId: {tenantid-to-use-for-authentication}
    SubscriptionId: {subscriptionid-containing-vault}
    ResourceGroup: {resource-group-containing-vault}
    AzureRegion: {region-for-vault}
    VaultName: {vault-name}
    UseKeyring: True
    Authority: global
```

--------------------------------

### Install pre-commit

Source: https://github.com/microsoft/msticpy/wiki/Pre-commit-scripts

Install the pre-commit package using pip. This is a prerequisite for using pre-commit hooks.

```bash
pip install pre-commit
```

--------------------------------

### MSTICPy Configuration Example

Source: https://github.com/microsoft/msticpy/blob/main/docs/notebooks/What's New in MSTICPy 2.0.ipynb

Example of MSTICPy pivot settings in a configuration file, showing options for query naming, family usage, and timespan management.

```yaml
....
Pivots:
    UseV1QueryNames: False
    UseQueryFamily: False
    UseQueryProviderTimeSpans: False


```

--------------------------------

### Example Anomaly Periods Output

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/visualization/TimeSeriesAnomalies.md

Example output format for `mp_timeseries.anomaly_periods()`, showing detected time spans with start and end times.

```default
[TimeSpan(start=2019-05-13 16:00:00+00:00, end=2019-05-13 18:00:00+00:00, period=0 days 02:00:00),
TimeSpan(start=2019-05-17 20:00:00+00:00, end=2019-05-17 22:00:00+00:00, period=0 days 02:00:00),
TimeSpan(start=2019-05-26 04:00:00+00:00, end=2019-05-26 06:00:00+00:00, period=0 days 02:00:00)]
```

--------------------------------

### setup_instance

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/api/msticpy.config.query_editor.md

Initialization method called before the main constructor (`__init__`).

```APIDOC
## setup_instance(*args, **kwargs)

### Description
This is called **before** self._\_init_\ is called.

### Parameters
* **args** (*Any*)
* **kwargs** (*Any*)

### Return type
None
```

--------------------------------

### setup_instance

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/api/msticpy.config.query_editor.md

This method is called before the instance's __init__ method.

```APIDOC
## setup_instance(*args, **kwargs)

### Description
This is called **before** self._\_init\_ is called.

### Parameters
* **args** (*Any*)
* **kwargs** (*Any*)

### Return type:
None
```

--------------------------------

### Get QueryTime Widget Start and End Times

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/visualization/NotebookWidgets.md

Retrieves the selected start and end datetime values from a QueryTime widget instance. These values can be used in subsequent operations or queries.

```ipython3
print(q_times.start, '....', q_times.end)
```

--------------------------------

### setup_instance

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/api/msticpy.config.query_editor.md

This method is called before the instance's __init__ method is called.

```APIDOC
## setup_instance(*args, **kwargs)

### Description
This is called **before** self._\_init_\_ is called.

### Parameters
* **args** (*Any*)
* **kwargs** (*Any*)

### Return type
None
```

--------------------------------

### Get Query Schema and Parameters

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/extending/Queries.md

Displays the schema, parameters, and example query for a specific imported query.

```python
qry_prov.LinuxSyslog.syslog_example('?')
```

--------------------------------

### setup_instance

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/api/msticpy.config.query_editor.md

Called before the instance's `__init__` method. This is a hook for pre-initialization setup tasks.

```APIDOC
## setup_instance(*args, **kwargs)

### Description
This is called **before** self._\_init\_ is called.

### Parameters
#### Path Parameters
* **args** (Any) - Description: Positional arguments for setup.
* **kwargs** (Any) - Description: Keyword arguments for setup.

### Return type:
None
```

--------------------------------

### Get Help for init_notebook

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/api/msticpy.md

Use this command to display the help documentation for the init_notebook function.

```python
>>> help(mp.init_notebook)
```

--------------------------------

### Get Lookback Widget Time Range

Source: https://github.com/microsoft/msticpy/blob/main/docs/notebooks/NotebookWidgets.ipynb

Retrieves and prints the start and end times of the selected range from the Lookback widget.

```python
print(lb.start, "....", lb.end)
```

--------------------------------

### Get Entities from Incident

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/api/msticpy.context.azure.sentinel_core.md

Retrieves a list of entities associated with a specific Microsoft Sentinel incident. The incident can be identified by its GUID or Name.

```python
entities = sentinel_connection.get_entities(incident='your-incident-guid-or-name')
```

--------------------------------

### setup_instance

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/api/msticpy.config.query_editor.md

Called before the instance's `__init__` method. This method is part of the instance initialization lifecycle and can be used for pre-initialization setup.

```APIDOC
## setup_instance(*args, **kwargs)

### Description
This is called **before** self._\_init\_ is called.

### Parameters
* **args** (*Any*) - Positional arguments for setup.
* **kwargs** (*Any*) - Keyword arguments for setup.

### Return type
None
```

--------------------------------

### Get Root Process

Source: https://github.com/microsoft/msticpy/blob/main/docs/notebooks/ProcessTree.ipynb

Retrieves the root process from the loaded process tree. This is often the starting point for analyzing process execution.

```python
t_root = process_tree.get_root(full_tree)
```

--------------------------------

### Initialize MSTICpy and Run Host Summary Notebooklet

Source: https://github.com/microsoft/msticpy/blob/main/docs/notebooks/MSTICpy_Blackhat_Demo_2020.ipynb

Initializes MSTICpy, sets a time span, selects the HostSummary notebooklet, and runs it for a given host and time range. Ensure MSTICpy is installed and initialized before use.

```python
# Initalize our notebooklets
import msticnb as nb
from msticnb.common import TimeSpan

nb.init()
tspan = TimeSpan(start=start, end=end)
# Select our notebooklet
nblet = nb.nblts.azsent.host.HostSummary()
# Run our notebooklet
out = nblet.run(value=host_name, timespan=tspan)
```

--------------------------------

### Initialize Notebook Environment

Source: https://github.com/microsoft/msticpy/blob/main/docs/notebooks/DataUploader.ipynb

Sets up the notebook environment by initializing necessary imports and configurations. Ensure msticpy[azure] is installed before running.

```python
# Setup
from msticpy.init import nbinit

extra_imports = [
    "msticpy.data.uploaders.splunk_uploader, SplunkUploader",
    "msticpy.data.uploaders.loganalytics_uploader, LAUploader",
]

nbinit.init_notebook(
    namespace=globals(),
    extra_imports=extra_imports,
)

WIDGET_DEFAULTS = {
    "layout": widgets.Layout(width="95%"),
    "style": {"description_width": "initial"},
}
```

--------------------------------

### init

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/api/msticpy.init.pivot_init.vt_pivot.md

Initializes and loads VirusTotal (VT3) Pivots if the 'vt' library is installed.

```APIDOC
## init

### Description
Loads VT3 Pivots if the vt library is available.
```

--------------------------------

### Get Roots of Process Trees

Source: https://github.com/microsoft/msticpy/blob/main/docs/notebooks/ProcessTree.ipynb

Extracts the root processes from the entire dataset. This function is helpful for identifying the starting points of process execution chains.

```python
# Get roots of all trees in the set
process_tree.get_roots(full_tree).head()
```

--------------------------------

### Example Query Output

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/extending/Queries.md

Displays a sample list of query names available in the QueryProvider.

```text
LinuxSyslog.all_syslog
LinuxSyslog.cron_activity
LinuxSyslog.squid_activity
LinuxSyslog.sudo_activity
LinuxSyslog.syslog_example
LinuxSyslog.user_group_activity
LinuxSyslog.user_logon
SecurityAlert.get_alert
SecurityAlert.list_alerts
SecurityAlert.list_alerts_counts
SecurityAlert.list_alerts_for_ip
SecurityAlert.list_related_alerts
WindowsSecurity.get_host_logon
WindowsSecurity.get_parent_process
WindowsSecurity.get_process_tree
WindowsSecurity.list_host_logon_failures
WindowsSecurity.list_host_logons
WindowsSecurity.list_host_processes
WindowsSecurity.list_hosts_matching_commandline
WindowsSecurity.list_matching_processes
WindowsSecurity.list_processes_in_session
```

--------------------------------

### Get Blank Schema Dictionary

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/visualization/ProcessTree.md

Retrieves a blank schema dictionary template using ProcSchema.blank_schema_dict(). This can be used as a starting point for creating custom schema dictionaries.

```python
from msticpy.transform.proc_tree_schema import ProcSchema
ProcSchema.blank_schema_dict()
```

--------------------------------

### Initialize Notebook Environment with Msticpy

Source: https://github.com/microsoft/msticpy/blob/main/docs/notebooks/AWS_S3_HoneybucketLogAnalysis.ipynb

Sets up the notebook environment by importing necessary libraries and initializing msticpy. Ensure msticpy is installed if not using Azure Notebooks.

```python
import pprint
import re

import matplotlib
import matplotlib.pyplot as plt
import squarify
from IPython.display import HTML, display

%matplotlib inline

REQ_PYTHON_VER = (3, 6)
REQ_MSTICPY_VER = (1, 4, 4)

display(HTML("<h3>Starting Notebook setup...</h3>"))

# If not using Azure Notebooks, install msticpy with
# !pip install msticpy
from msticpy import init_notebook

extra_imports = [
    "msticpy.context.ip_utils, convert_to_ip_entities",
    "msticpy.vis.ti_browser, browse_results",
    "msticpy.context.ip_utils, get_whois_info",
    "msticpy.context.geoip, GeoLiteLookup",
    "msticpy.vis.foliummap, FoliumMap",
    "msticpy.vis.foliummap, get_map_center",
]

init_notebook(
    namespace=globals(),
    additional_packages=["squarify"],
    extra_imports=extra_imports,
);
```

--------------------------------

### Get Specific Incident Details

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/data_acquisition/SentinelIncidents.md

Retrieves details for a single incident using its GUID. The incident ID can be found in the 'name' column of the DataFrame returned by list_incidents.

```ipython3
sentinel.get_incident(incident = "875409ee-9e1e-40f6-b0b8-a38aa64a1d1c")
```

--------------------------------

### Example YAML Configuration

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/api/msticpy.init.mp_user_session.md

This YAML structure defines settings for QueryProviders and Components, including data environments, initialization arguments, and connection details.

```yaml
QueryProviders:
    qry_prov_sent:
        DataEnvironment: MSSentinel
        InitArgs:
            debug: True
        Connect: True
        ConnectArgs:
            workspace: MySoc
            auth_methods: ['cli', 'device_code']
    qry_prov_md:
        DataEnvironment: M365D
    qry_kusto_mde:
        DataEnvironment: Kusto
        Connect: True
        ConnectArgs:
            cluster: MDEData
    qry_kusto_mstic:
        DataEnvironment: Kusto
        Connect: True
        ConnectArgs:
            cluster: MSTIC
Components:
    mssentinel:
        Module: msticpy.context.azure
        Class: MicrosoftSentinel
        InitArgs:
        Connect: True
        ConnectArgs:
            workspace: CyberSecuritySoc
            auth_methods: ['cli', 'device_code']

```

--------------------------------

### Export Bokeh Plot to PNG

Source: https://github.com/microsoft/msticpy/blob/main/docs/notebooks/EventTimeline.ipynb

This example shows how to export a Bokeh plot generated by `nbdisplay.display_timeline_values` to a PNG file using `bokeh.io.export_png`. Ensure selenium, phantomjs, and pillow are installed.

```python
from bokeh.io import export_png
from IPython.display import Image

# Create a plot
flow_plot = nbdisplay.display_timeline_values(data=az_net_flows_df,
                                              group_by="L7Protocol",
                                              source_columns=["FlowType", 
                                                              "AllExtIPs", 
                                                              "L7Protocol", 
                                                              "FlowDirection", 
                                                              "TotalAllowedFlows"],
                                              time_column="FlowStartTime",
                                              y="TotalAllowedFlows",
                                              legend="right", 
                                              height=500,
                                              kind=["vbar", "circle"]
                                            );

# Export 
file_name = "plot.png"
export_png(flow_plot, filename=file_name)

# Read it and show it
display(Markdown(f"## Here is our saved plot: {file_name}"))
Image(filename=file_name)
```

--------------------------------

### Get Lookback Widget Time Range

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/visualization/NotebookWidgets.md

Retrieves the selected start and end times from the Lookback widget. This is useful after the user has interacted with the widget to set the desired time range.

```ipython3
print(lb.start, '....', lb.end)
```

--------------------------------

### Run Imported Query with Parameters

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/extending/Queries.md

Executes an imported query ('syslog_example') with specified start time, end time, and host name.

```python
qry_prov.LinuxSyslog.syslog_example(
    start='2019-07-21 23:43:18.274492',
    end='2019-07-27 23:43:18.274492',
    host_name='UbuntuDevEnv'
)
```

--------------------------------

### AzureData Connection Example

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/getting_started/msticpyconfig.md

Python code demonstrating how to instantiate and connect to AzureData using specified authentication methods.

```ipython3
from msticpy.context.azure_data import AzureData
az_data = AzureData()
az_data.connect(auth_methods=['cli','interactive'])
```

--------------------------------

### Load LocalData Query Provider with Defaults

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/data_acquisition/DataProv-LocalData.md

Instantiates the LocalData query provider using default configuration settings. This is the simplest way to get started if your data and query files are in standard locations.

```ipython3
qry_prov = QueryProvider("LocalData")
```

--------------------------------

### Get Process Tree Descendants

Source: https://github.com/microsoft/msticpy/blob/main/docs/notebooks/ProcessTree.ipynb

Retrieves all descendant processes of a given root process from a full process tree. Requires the full process tree DataFrame and a specific root process to start from.

```python
# Take one of those roots and get the full tree beneath it
t_root = process_tree.get_roots(full_tree).loc["unknown|1350|1970-01-01 00:00:00.000000"]
whole_tree = process_tree.get_descendents(full_tree, t_root)
whole_tree.head()
```

--------------------------------

### Initialize Query Provider and Connect

Source: https://github.com/microsoft/msticpy/blob/main/docs/notebooks/What's New in MSTICPy 2.0.ipynb

Instantiate a query provider for a specific data source (e.g., MSSentinel) and connect it to a workspace. This sets up the connection for subsequent data queries.

```python
qry_prov = mp.QueryProvider("MSSentinel")
qry_prov2 = mp.QueryProvider("MSSentinel")

qry_prov.connect(workspace="Default")
```

--------------------------------

### usage

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/api/msticpy.context.tiproviders.binaryedge.md

Prints the usage instructions for the BinaryEdge provider.

```APIDOC
## usage()

### Description
Print usage of provider.

### Parameters
None

### Returns
None

### Return type
None
```

--------------------------------

### Validate Splunk Query with Custom Parameters

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/data_acquisition/SplunkProvider.md

Use this example to validate a Splunk query by setting custom parameters such as index, source, time format, start, and end times before execution. This ensures the query is correctly formed.

```ipython3
splunk_prov.SplunkGeneral.get_events_parameterized('print',
    index="botsv2",
    source="WinEventLog:Microsoft-Windows-Sysmon/Operational",
    timeformat="%Y-%m-%d %H:%M:%S",
    start="2017-08-25 00:00:00",
    end="2017-08-25 10:00:00"
)
```

```default
' search index=botsv2 source=WinEventLog:Microsoft-Windows-Sysmon/Operational
  timeformat=%Y-%m-%d %H:%M:%S earliest="2017-08-25 00:00:00" latest="2017-08-25 10:00:00"
  | table TimeCreated, host, EventID, EventDescription, User, process, cmdline, Image,
  parent_process, ParentCommandLine, dest, Hashes | head 100'
```

--------------------------------

### Get Roots of All Process Trees

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/visualization/ProcessTree.md

Extracts the root processes from all the trees present in the provided process tree DataFrame. This is useful for identifying the starting points of different process execution chains. The `.head()` method is used to display the first few results.

```python
# Get roots of all trees in the set
process_tree.get_roots(p_tree_win).head()
```

--------------------------------

### Host Class Initialization and Attributes

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/api/msticpy.datamodel.entities.host.md

Demonstrates how to initialize the Host entity and lists its available attributes.

```APIDOC
## Host Class

### Description
Represents a Host entity, encapsulating various host-related attributes.

### Class Signature
```python
Host(src_entity=None, src_event=None, **kwargs)
```

### Parameters
*   **src_entity** (*Mapping[str, Any]*, optional): Create entity from an existing entity or other mapping object.
*   **src_event** (*Mapping[str, Any]*, optional): Create entity from event properties.
*   **kwargs**: Supply the entity properties as a set of keyword arguments.

### Attributes
*   **DnsDomain** (str): Host's DNS domain.
*   **NTDomain** (str): Host's NT domain.
*   **HostName** (str): Host's hostname.
*   **NetBiosName** (str): Host's NetBIOS name.
*   **AzureID** (str): Host's Azure ID.
*   **OMSAgentID** (str): Host's OMS Agent ID.
*   **OSFamily** (str): Host's operating system family.
*   **OSVersion** (str): Host's operating system version.
*   **IsDomainJoined** (bool): Indicates if the host is domain-joined.
*   **AzureID** (str | None): Host's Azure ID.
*   **DeviceId** (str | None): Host's device ID.
*   **DeviceName** (str | None): Host's device name.
*   **DnsDomain** (str | None): Host's DNS domain.
```

--------------------------------

### Get Full Descendant Tree Beneath a Process

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/visualization/ProcessTree.md

Retrieves the entire subtree, including all descendants, starting from a specified process. The `include_source` parameter can be set to True to include the originating process in the results. This is useful for analyzing the complete execution path below a given process.

```python
# Take one of those roots and get the full tree beneath it
t_root = process_tree.get_roots(p_tree_win).loc["c:\\windowsazure\\guestagent_2.7.41491.901_2019-01-14_202614\\waappagent.exe0x19941970-01-01 00:00:00.000000"]
full_tree = process_tree.get_descendents(p_tree_win, t_root)
full_tree.head()
```

--------------------------------

### Example Query Definition File

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/extending/Queries.md

This YAML file defines KQL queries for Windows Logon Events in Microsoft Sentinel. It includes metadata, default parameters, and specific query sources like 'get_host_logon' and 'list_host_logons'.

```yaml
metadata:
    version: 1
    description: Kql Sentinel Windows Logon Event Queries
    data_environments: [MSSentinel]
    data_families: [WindowsSecurity]
    tags: ["process", "windows", "processtree", "session"]
defaults:
    parameters:
        start:
            description: Query start time
            type: datetime
        end:
            description: Query end time
            type: datetime
        table:
            description: Table name
            type: str
            default: "SecurityEvent"
sources:
    get_host_logon:
        description: Retrieves the logon event for the session id on the host
        metadata:
        args:
            query: '
                {table}
                | where EventID == 4624
                | where Computer has "{host_name}"
                | where TimeGenerated >= datetime({start})
                | where TimeGenerated <= datetime({end})
                | where TargetLogonId == "{logon_session_id}"
                {add_query_items}'
        parameters:
            host_name:
                description: Name of host
                type: str
            logon_session_id:
                description: The logon session ID of the source process
                type: str
    list_host_logons:
        description: Retrieves the logon events on the host
        metadata:
        args:
            query: '
                {table}
                | where EventID == 4624
                | where Computer has "{host_name}"
                | where TimeGenerated >= datetime({start})
                | where TimeGenerated <= datetime({end})
                {add_query_items}'
        parameters:
            host_name:
                description: Name of host
                type: str

```

--------------------------------

### Initialize Mordor Data Provider

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/data_acquisition/MordorData.md

Create an instance of the Mordor QueryProvider and connect to download metadata. This is the first step to accessing Mordor datasets.

```ipython3
>>> from msticpy.data import QueryProvider
>>> mdr_data = QueryProvider("Mordor")
>>> mdr_data.connect()
```

```text
Retrieving Mitre data...
Retrieving Mordor data...
```

--------------------------------

### Install Pip Packages

Source: https://github.com/microsoft/msticpy/blob/main/conda/README.md

Install pip into the Conda environment and then install packages from the conda-reqs-pip.txt file. It is recommended to do this in a dedicated environment to avoid dependency conflicts.

```shell
conda install pip
pip install -r {path}/conda-reqs-pip.txt
```

--------------------------------

### PrismaCloudDriver QueryProvider Example

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/api/msticpy.data.drivers.prismacloud_driver.md

Instantiate a QueryProvider for Prisma Cloud and connect with debug enabled. Lists available queries.

```python
driver = QueryProvider("Prismacloud")
driver.connect(debug=True)
driver.list_queries()
```

--------------------------------

### Replace GUID with msticpy

Source: https://github.com/microsoft/msticpy/blob/main/docs/notebooks/DataObfuscation.ipynb

Replaces a GUID with a consistently mapped random UUID. Input GUIDs are mapped to the same output UUID across multiple calls.

```python
replace_guid('cf1b0b29-08ae-4528-839a-5f66eca2cce9') => 01ae8633-22e5-480f-b884-fc48588c25d9
replace_guid('ed63d29e-6288-4d66-b10d-8847096fc586') => 52cd2814-b5e4-48bd-80f2-51b503e50467
replace_guid('ac561203-99b2-4067-a525-60d45ea0d7ff') => ef059dc7-2d6e-4506-8619-05b346a6bc6b
replace_guid('cf1b0b29-08ae-4528-839a-5f66eca2cce9') => 01ae8633-22e5-480f-b884-fc48588c25d9
```

--------------------------------

### Convert SQL Query with Joins and Aggregations to KQL

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/data_acquisition/SqlToKql.md

This example demonstrates converting a more complex SQL query involving INNER JOIN, subqueries, GROUP BY, and ORDER BY clauses to KQL. Note the translation of LIKE with RLIKE to startswith and the use of `summarize` for aggregation.

```ipython3
sql="""
SELECT DISTINCT Message, Otherfield, COUNT(DISTINCT EventID)
FROM (SELECT EventID, ParentImage, Image, Message, Otherfield FROM apt29Host) as A
--FROM A
INNER JOIN (Select Message, evt_id FROM MyTable ) on MyTable.Message == A.Message and MyTable.evt_id == A.EventID
WHERE Channel = "Microsoft-Windows-Sysmon/Operational"
    AND EventID = 1
    AND LOWER(ParentImage) LIKE "%explorer.exe"
    AND LOWER(Image) RLIKE ".*3aka3%"
GROUP BY EventID
ORDER BY Message DESC, Otherfield
LIMIT 10
"""

kql = sql_to_kql(sql)
print(kql)
```

```default
apt29Host
| project EventID, ParentImage, Image, Message, Otherfield
| join kind=inner (MyTable
  | project Message, evt_id) on $right.Message == $left.Message
  and $right.evt_id == $left.EventID
| where Channel == 'Microsoft-Windows-Sysmon/Operational'
  and EventID == 1
  and tolower(ParentImage) endswith 'explorer.exe'
  and tolower(Image) startswith '.*3aka3'
| summarize any(Message), any(Otherfield), dcount(EventID) by EventID
| order by Message desc, Otherfield
| limit 10
```

--------------------------------

### Install All Wheel Files in Jupyter Notebook

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/getting_started/Installing.md

This Python code installs all .whl files found in a specified directory using pip within a Jupyter Notebook. It iterates through the directory, prints the filename being installed, and uses quiet, no-index, and no-deps flags for the installation.

```python
import os
directory = "/path/to/whl/files/directory" # edit this to match your directory
files = [
    os.path.join(directory, filename)
    for filename in os.listdir(directory)
    if filename.endswith(".whl")
]
for file in files:
    filename = os.path.split(file)[-1]
    print(f"\nAttempting to install {filename}")
    %pip install --quiet --no-index --no-deps --find-links . {file}
```

--------------------------------

### Initialize QueryProvider with Query Paths

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/extending/Queries.md

Initializes a QueryProvider, specifying a list of directories to load query definitions from.

```python
qry_prov = mp.QueryProvider("Splunk", query_paths=["~/home/mp_queries"])
```

--------------------------------

### Install pre-commit hooks in the repository

Source: https://github.com/microsoft/msticpy/wiki/Pre-commit-scripts

After installing pre-commit, run this command in the repository to install the git hooks. These hooks will automatically run checks on your code before each commit.

```bash
pre-commit install
```

--------------------------------

### Replace GUID with Mapped UUID

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/data_acquisition/DataMasking.md

Replaces input GUIDs with a consistent, randomly generated UUID for the current session. Ensures the same input GUID always maps to the same output UUID.

```python
replace_guid('cf1b0b29-08ae-4528-839a-5f66eca2cce9')
9ef6c321-14f3-4681-8c3b-b596de52d8b0
```

```python
replace_guid('ed63d29e-6288-4d66-b10d-8847096fc586')
219a5b0c-3985-49cc-9016-7b23a98c3d53
```

```python
replace_guid('ac561203-99b2-4067-a525-60d45ea0d7ff')
8e8ec1e1-6df6-4b41-bbff-b73b1614430b
```

```python
replace_guid('cf1b0b29-08ae-4528-839a-5f66eca2cce9')
9ef6c321-14f3-4681-8c3b-b596de52d8b0
```

--------------------------------

### Instantiate Query Provider and Threat Intel Lookup

Source: https://github.com/microsoft/msticpy/blob/main/docs/notebooks/What's New in MSTICPy 2.0.ipynb

Create instances of QueryProvider for data retrieval and TILookup for threat intelligence.

```python
qry_prov = mp.QueryProvider("MSSentinel")
ti = mp.TILookup()
```

--------------------------------

### Convert SQL to KQL with Table Mapping

Source: https://github.com/microsoft/msticpy/blob/main/docs/notebooks/SqlToKql.ipynb

Demonstrates converting SQL to KQL while providing a mapping for table names. This is useful when your SQL source table names differ from your Kusto table names.

```python
sql = """
SELECT DISTINCT Message, Otherfield, COUNT(DISTINCT EventID)
FROM (SELECT EventID, ParentImage, Image, Message, Otherfield FROM apt29Host) as A
INNER JOIN (Select Message, evt_id FROM MyTable ) on MyTable.Message == A.Message and MyTable.evt_id == A.EventID
WHERE Channel = "Microsoft-Windows-Sysmon/Operational"
    AND EventID = 1
    AND LOWER(ParentImage) LIKE "%explorer.exe"
    AND LOWER(Image) RLIKE ".*3aka3%"
GROUP BY EventID
ORDER BY Message DESC, Otherfield
LIMIT 10
"""

table_map = {"apt29Host": "SecurityEvent", "MyTable": "SigninLogs"}

kql = sql_to_kql(sql, table_map)
print(kql)
```

--------------------------------

### Install MSTIC Notebooklets

Source: https://github.com/microsoft/msticpy/blob/main/docs/notebooks/MSTICpy_Blackhat_Demo_2020.ipynb

Installs the MSTIC Notebooklets package, which is used in conjunction with MSTICpy.

```bash
%pip install --upgrade msticnb
```

--------------------------------

### Install or Upgrade msticpy

Source: https://github.com/microsoft/msticpy/blob/main/docs/notebooks/Openobserve-DataConnector.ipynb

Run this command once to install or upgrade msticpy to the latest version.

```python
# Only run first time to install/upgrade msticpy to latest version
# %pip install --upgrade msticpy
```

--------------------------------

### TILookup Constructor Parameters

Source: https://github.com/microsoft/msticpy/blob/main/docs/notebooks/TIProviders.ipynb

Details the parameters available for initializing the TILookup instance, including primary and secondary providers, and a list of specific providers to load.

```python
        Initialize TILookup instance.

        Parameters
        ----------
        primary_providers : Optional[List[TIProvider]], optional
            Primary TI Providers, by default None
        secondary_providers : Optional[List[TIProvider]], optional
            Secondary TI Providers, by default None
        providers: Optional[List[str]], optional
            List of provider names to load, by default all available
            providers are loaded. To see the list of available providers
            call `TILookup.list_available_providers()`.
            Note: if primary_provides or secondary_providers is specified
            This will override the providers list.

        
```

--------------------------------

### setup_logging Function

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/api/msticpy.init.logging.md

Initiates the logging system for msticpy.

```APIDOC
## msticpy.init.logging.setup_logging()

Initiate logging.
```

--------------------------------

### Initialize Splunk Connection Widgets

Source: https://github.com/microsoft/msticpy/blob/main/docs/notebooks/MSTICpy_Blackhat_Demo_2020.ipynb

Sets up text and password widgets for capturing Splunk connection details.

```python
splunk_host = widgets.Text(description="Splunk Host:")
splunk_user = widgets.Text(description="Splunk User:")
splunk_pwd = widgets.Password(description="Splunk Pwd:")
display(splunk_host)
display(splunk_user)
display(splunk_pwd)
```

--------------------------------

### usage

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/api/msticpy.context.tiproviders.intsights.md

Prints the usage instructions for the Intsights provider.

```APIDOC
## usage()

### Description
Print usage of provider.

### Parameters
* None

### Returns
* None

### Example
```python
IntsightsProvider.usage()
```
```

--------------------------------

### Install MSTICPy

Source: https://github.com/microsoft/msticpy/blob/main/docs/notebooks/EntityGraph.ipynb

Installs or upgrades the msticpy package. Ensure you are using a compatible Python version (3.6+).

```bash
%pip install --upgrade msticpy
```

--------------------------------

### Initialize Kusto QueryProvider

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/data_acquisition/DataProv-Kusto-Legacy.md

Instantiate the QueryProvider for Kusto. This is the first step before connecting or running queries.

```ipython3
kql_prov = QueryProvider("Kusto")
```

--------------------------------

### Example Valid Query Definition Output

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/extending/Queries.md

An example output indicating that a query definition file has passed validation.

```default
C:queriesexample.yaml is a valid query definition
```

--------------------------------

### Get Help on MpConfigFile

Source: https://github.com/microsoft/msticpy/blob/main/docs/notebooks/MPSettingsEditor.ipynb

Displays detailed information and documentation for the `MpConfigFile` class.

```python
help(MpConfigFile)
```

--------------------------------

### Connect to Splunk Instance

Source: https://github.com/microsoft/msticpy/blob/main/docs/notebooks/MSTICpy_Blackhat_Demo_2020.ipynb

Initializes the Splunk query provider and establishes a connection to the Splunk instance using provided credentials.

```python
# Initialize a Splunk provider and connect to our Splunk instance.
splunk_prov = QueryProvider("Splunk")
splunk_prov.connect(
    host=splunk_host.value, username=splunk_user.value, password=splunk_pwd.value
)
```

--------------------------------

### Install MSTICPy with Riskiq Extra

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/getting_started/Installing.md

Use this command to install MSTICPy with the 'riskiq' extra. For zsh/MacOS, escape the opening bracket.

```bash
pip install msticpy[riskiq]
```

--------------------------------

### Initialize OSQuery Provider and Query Processes

Source: https://github.com/microsoft/msticpy/blob/main/docs/source/data_acquisition/DataProv-OSQuery.md

Initializes the OSQuery provider with specified data paths and connects to the logs. Then, it queries the 'processes' table and returns the data as a pandas DataFrame.

```python
qry_prov = mp.QueryProvider("OSQueryLogs", data_paths=["~/my_logs"])
qry_prov.connect()
df_processes = qry_prov.os_query.processes()
```