Highlights
This is a minor release with some fixes and additions that enable broader functionality.
The biggest-impacting changes apply to the
[Process Tree visualization](https://msticpy.readthedocs.io/en/latest/visualization/ProcessTree.html).
These changes allow it to work with broader types of Windows or Linux process data:
* Removed the following columns that were previously **required**: host_name, logon_id, user_name, cmd_line.
* Added auto-coloring by level if no legend is supplied.
* Fixed process sorting so that tree and peer groups in the tree are sorted by level, then timestamp.
* Added ability to supply schema as dictionary to the process tree APIs.
The changes are described in more detail below.
We've also added support for a new MS Sentinel API to retrieve queries stored in a Sentinel workspace
and fixed some issues in IP WhoIs lookups.
Process Tree changes
Reduced required column set
This allows you to use the process tree visualization and utilities with a minimal set of data fields:
* process_id
* parent_id
* process_name
* time_stamp
python
cust_schema = {
"process_name": "ImageFileName",
"process_id": "PID",
"parent_id": "PPID",
"time_stamp": "CreateTime",
}
df.mp_plot_process(schema=cust_schema)
Auto-coloring of tree plot
If you do not supply a `legend_col` parameter, the process objects will be
automatically colored by level in the hierarchy. This makes a basic tree more colorful and easier to navigate.
Processes are correctly sorted by process time
Previously, the code that builds the process tree left individual processes in an unintuitive order.
For a given level (e.g. parents) all of the processes will be displayed in time created order.
For example:
A \
- A.1
- A.2
B \
- B.1
- B.2
A will always have a timestamp less than or equal to B. All children of A (A.1, A.2...) and B will be shown in
time created order. However, across different levels and peer groups, there is no guarantee of time-ordering. In the above example, even though timestamp A is less than timestamp B, B.1 and B.2 could have timestamps earlier than either A.1 or A.2.
<table border="1" class="dataframe"><thead> <tr style="text-align: right;"> <th></th> <th>path</th> <th>ImageFileName</th> <th>CreateTime</th> </tr> <tr> <th>proc_key</th> <th></th> <th></th> <th></th> </tr></thead><tbody> <tr> <th>registry|88|2021-04-01 05:04:54.000000</th> <td>116/0</td> <td>Registry</td> <td>2021-04-01 05:04:54+00:00</td> </tr> <tr> <th>system|4|2021-04-01 05:04:58.000000</th> <td>117/1</td> <td>System</td> <td>2021-04-01 05:04:58+00:00</td> </tr> <tr> <th>smss.exe|404|2021-04-01 05:04:58.000000</th> <td>117/1/2</td> <td>smss.exe</td> <td>2021-04-01 05:04:58+00:00</td> </tr> <tr> <th>csrss.exe|640|2021-04-01 05:05:00.000000</th> <td>118/3</td> <td>csrss.exe</td> <td>2021-04-01 05:05:00+00:00</td> </tr> <tr> <th>winlogon.exe|700|2021-04-01 05:05:00.000000</th> <td>118/4</td> <td>winlogon.exe</td> <td>2021-04-01 05:05:00+00:00</td> </tr> <tr> <th>dwm.exe|1028|2021-04-01 05:05:02.000000</th> <td>118/4/17</td> <td>dwm.exe</td> <td>2021-04-01 05:05:02+00:00</td> </tr> <tr> <th>logonui.exe|512|2021-04-01 05:05:02.000000</th> <td>118/4/21</td> <td>LogonUI.exe</td> <td>2021-04-01 05:05:02+00:00</td> </tr> <tr> <th>fontdrvhost.ex|960|2021-04-01 05:05:01.000000</th> <td>118/4/7</td> <td>fontdrvhost.ex</td> <td>2021-04-01 05:05:01+00:00</td> </tr> <tr> <th>wininit.exe|632|2021-04-01 05:05:00.000000</th> <td>119/5</td> <td>wininit.exe</td> <td>2021-04-01 05:05:00+00:00</td> </tr> <tr> <th>lsass.exe|776|2021-04-01 05:05:01.000000</th> <td>119/5/10</td> <td>lsass.exe</td> <td>2021-04-01 05:05:01+00:00</td> </tr></tbody></table>
mp_plot.process_tree and mp.build_process_tree support schema as dictionary
Previously these accessors and the underlying functions `plot_process_tree` and
`build_process_tree` would only accept `msticpy.transform.process_tree_schema.ProcSchema`
instances. These will now accept dictionaries with at least the minimum required
attributes as keys.
What's Changed
* Sentinel - Return all saved queries by petebryan in https://github.com/microsoft/msticpy/pull/519
* Bump readthedocs-sphinx-ext from 2.1.8 to 2.1.9 by dependabot in https://github.com/microsoft/msticpy/pull/507
* Bump respx from 0.19.2 to 0.20.0 by dependabot in https://github.com/microsoft/msticpy/pull/512
* Allow process tree to work with more data sources. by ianhelle in https://github.com/microsoft/msticpy/pull/513
* Fixed error in cell using non-existing column name by ianhelle in https://github.com/microsoft/msticpy/pull/527
* Ianhelle/proc tree fixes 2022 09 16 by ianhelle in https://github.com/microsoft/msticpy/pull/530
* Fixed issue with whois lookups on only local IPs by petebryan in https://github.com/microsoft/msticpy/pull/506
**Full Changelog**: https://github.com/microsoft/msticpy/compare/v2.1.2...v2.1.3