Snippets.json

{
  "Microsoft Sentinel - Get Configuration parameters": {
    "prefix": [ "get-sentinelconfiguration", "get-sentinelconfig" ],
    "body": [
      "########################################################################",
      "# Microsoft Sentinel - Get Microsoft Sentinel Configuration parameters #",
      "########################################################################",
      "import json",
      "def read_config_values(file_path):",
      "    'This loads pre-generated parameters for Microsoft Sentinel Workspace'",
      "    with open(file_path) as json_file:",
      "        if json_file:",
      "            json_config = json.load(json_file)",
      "            return (json_config['${1:tenant_id}'],",
      "                json_config['${2:subscription_id}'],",
      "                json_config['${3:resource_group}'],",
      "                json_config['${4:workspace_id}'],",
      "                json_config['${5:workspace_name}'],",
      "                json_config['${6:user_alias}'],",
      "                json_config['${7:user_object_id}'])",
      "    return None",
      "",
      "# Calling the above function to populate Microsoft Sentinel workspace parameters",
      "# The file, config.json, was generated by the system, however, you may modify the values, or manually set the variables",
      "tenant_id, subscription_id, resource_group, workspace_id, workspace_name, user_alias, user_object_id = read_config_values('config.json')"
    ],
    "description": "Get Microsoft Sentinel configuration parameters from config.json"
  },

  "Microsoft Sentinel - Set up environment for MSTICPy": {
    "prefix": [ "msticpy-setup" ],
    "body": [
      "#######################################################",
      "# Microsoft Sentinel - Set up environment for MSTICPy #",
      "#######################################################",
      "# import some modules needed in this cell",
      "from pathlib import Path",
      "from IPython.display import display, HTML",
      "",
      "display(HTML('Checking upgrade to latest msticpy version'))",
      "%pip install --upgrade --quiet msticpy[azsentinel]",
      "",
      "display(HTML('<h3>Starting Notebook setup...</h3>'))",
      "# intialize msticpy",
      "try:",
      "    from msticpy.nbtools import nbinit",
      "    nbinit.init_notebook(",
      "    namespace=globals(),",
      "    extra_imports=[]",
      "    )",
      "except ImportError:",
      "    print('MSTICPy not installed, please restart the kernel to ensure MSTICPy is installed.')"
    ],
    "description": "Set up the execution environment for MSTICPy"
  },

  "Microsoft Sentinel - Authenticate with MSTICPy": {
    "prefix": [ "msticpy-azs-connect" ],
    "body": [
      "##############################################",
      "# Microsoft Sentinel - Authenticate with MSTICPy #",
      "##############################################",
      "",
      "from msticpy.data.data_providers import QueryProvider",
      "from msticpy.common.wsconfig import WorkspaceConfig",
      "",
      "ws_config = WorkspaceConfig()",
      "if not ws_config.config_loaded:",
      "ws_config.prompt_for_ws()",
      "",
      "qry_prov = QueryProvider(data_environment='AzureSentinel')",
      "qry_prov.connect(ws_config)",
      ""
    ],
    "description": "Load a Microsoft Sentinel query provider and connect to the default workspace with MSTICPy"
  },

  "Microsoft Sentinel - Set up MSTICPy Pivots": {
    "prefix": [ "msticpy-azs-pivots" ],
    "body": [
      "##########################################",
      "# Microsoft Sentinel - Set up MSTICPy Pivots #",
      "##########################################",
      "",
      "from msticpy.data.data_providers import QueryProvider",
      "from msticpy.common.wsconfig import WorkspaceConfig",
      "",
      "ws_config = WorkspaceConfig()",
      "if not ws_config.config_loaded:",
      "ws_config.prompt_for_ws()",
      "",
      "qry_prov = QueryProvider(data_environment='AzureSentinel')",
      "qry_prov.connect(ws_config)",
      "",
      "from msticpy.datamodel.pivot import Pivot",
      "Pivot(namespace=globals())",
      "Pivot.browse()"
    ],
    "description": "Set is MSTICPy Pivots to use Microsoft Sentinel"
  },

  "Microsoft Sentinel - Set up MSTICNb": {
    "prefix": [ "msticnb-setup" ],
    "body": [
      "###################################",
      "# Microsoft Sentinel - Set up MSTICNb #",
      "###################################",
      "from IPython.display import display, HTML",
      "",
      "display(HTML('Checking upgrade to latest msticnb version'))",
      "%pip install --upgrade --quiet msticnb",
      "",
      "display(HTML('<h3>Starting Notebooklet setup...</h3>'))",
      "# intialize msticnb",
      "try:",
      "    import msticnb as nb",
      "    nb.init(query_provider='AzureSentinel')",
      "    nb.browse()",
      "except ImportError:",
      "    print('MSTICNb not installed, please restart the kernel to ensure MSTICNb is installed.')"
    ],
    "description": "Install and load MSTICNb and display a browser showing avaliable notebooklets."
  },

  "Microsoft Sentinel - Authenticate into Azure Log Analytics": {
    "prefix": [ "login-loganalytics" ],
    "body": [
      "########################################################",
      "# Microsoft Sentinel - Authenticate to Azure Log Analytics #",
      "########################################################",
      "# Azure CLI is used to get device code to login into Azure, you need to copy the code and open the DeviceLogin site.",
      "# !!! You need [tenant_id] and [subscription_id] to login into Azure !!!",
      "from azure.common.client_factory import get_client_from_cli_profile",
      "from azure.common.credentials import get_azure_cli_credentials",
      "from azure.loganalytics import LogAnalyticsDataClient",
      "from azure.mgmt.loganalytics import LogAnalyticsManagementClient",
      "from azure.loganalytics.models import QueryBody",
      "",
      "!az login --use-device-code",
      "la_client = get_client_from_cli_profile(LogAnalyticsManagementClient, subscription_id = subscription_id)",
      "creds, _ = get_azure_cli_credentials(resource='https://api.loganalytics.io')",
      "la_data_client = LogAnalyticsDataClient(creds)",
      " ",
      "# Query sample: ",
      "# query = 'union withsource = SentinelTableName * | distinct SentinelTableName | sort by SentinelTableName asc'",
      "# result = la_data_client.query(workspace_id, QueryBody(query=query))",
      "# print(result.as_dict())"
    ],
    "description": "Using AZCLI to login to Azure Log Analytics"
  }
}