Skip to content

Timeline duration, MDE Query upgrade
Compare
Choose a tag to compare
@ianhelle ianhelle released this 19 Jul 16:29
v1.3.0
383c698

New Features

Timeline duration visualization #176

This new variant of the timeline control allows you to group by one or more columns and view timelines as start/end of activity related to those columns. The graphic below shows durations of communication between different source and destination IPs using a given protocol.

Like other timeline controls it's accessible as a pandas extension.

az_net_flows_df.mp_timeline.plot_duration(
    group_by=["SrcIP", "DestIP", "L7Protocol"]
)

Timeline duration

You can also import and use the plot function directly:

from msticpy.nbtools.timeline_duration import display_timeline_duration

display_timeline_duration(
    host_logons,
    group_by="Account",
    ref_events=host_logons.sample(3),
    ref_col="TargetUserName",
);

Read about this in our Event Timeline documentation

Fixes

#184 MDEFix Update MDE connectors

The Microsoft Defender for Endpoint provider and queries have had a major update, correcting many schema issues (we were still using old column names in a number of cases

#185 from microsoft/ianhelle/init_notebook_changes-2021-07-14

  • Removed nb_check.py update from azure_ml_tools.py
  • Updated text about how to fix missing PyGObject
  • Fixed MpConfigEdit widget to show checkbox for making backups prior to updating msticpyconfig
  • Fix to remove casefold of OptionButtons value

8707868@Fixing Mordor and azure_ml_tools tests

  • Fixed Mordor URL for mordor data provider

1ec1a00@bypassing GeoIP notebook test because of IPStack intermittent problems (#181)

Assets 2
Loading