The second release of Notebooklets has been a long time coming but finally here.
It includes 3 new notebooklets:
- [Account summary](https://msticnb.readthedocs.io/en/latest/notebooklet_docs/AccountSummary.html) - explore an account (Azure/Office, Windows or Linux)
Logon activity, Azure office activity, alerts, etc.
- [IP Address Summary](https://msticnb.readthedocs.io/en/latest/notebooklet_docs/IpAddressSummary.html) - explore IP address:
Threat intel, geolocation, whois plus checks for presence of IP in multiple Azure Sentinel logs
- [Logon session rarity](https://msticnb.readthedocs.io/en/latest/notebooklet_docs/LogonSessionsRarity.html)
Using clustering of processes to estimate the relative unusualness of individial logon sessions.
Browse the sessions with unusual activity using event timelines or process trees.
Also support for MSTICPy pivot functions - loading Notebooklets package will add
notebooklet run functions as pivots to the appropriate entity (e.g. Host, Account, IP)
Updates
86c0865Automated [ReadtheDocs documentation for notebooklets](https://msticnb.readthedocs.io/en/latest/notebooklet_docs/IpAddressSummary.html)
e3bc125Logon session rarity notebooklet.
58c8e60Adding print_options function to notebooklet.py
49e05a6
- Add data_viewers.py module for simple event browsing
- Added Pivot initialization to the package __init__.py so that notebooklets are added as pivot functions
- Created local version of convert_to_ip_entities that accepts geoip provider in args. This is used by ti_enrich, host.py, host_logons_summary.py and, indirectly, by ip_summary and network_flow_summary.
- Added map_ips function to ip_tools - generic Folium map for list of IPs
- Change notebooklet_result.py so that it only displays first 5 rows of DF and has explanatory text why not everything is showing.
3d619cb
- Added some utility functions to common.py and notebooklet.py
- check_valid_result_data
- check_table_exists
- get_methods/list_methods (lists only methods defined on subclasses, not Notebooklet class)
- Split NotebooketResult into separate module notebooklet_result.py
- Added ability to invoke notebooklet functions from results class
- Added alert.py alert browser
Fixes