{
"cells": [
{
"cell_type": "markdown",
"metadata": {},
"source": [
"# Entity Explorer - Linux Host\r\n",
" Details...
\r\n",
"\r\n",
" **Notebook Version:** 1.1
\r\n",
" **Python Version:** Python 3.6 (including Python 3.6 - AzureML)
\r\n",
" **Required Packages**: kqlmagic, msticpy, pandas, pandas_bokeh, numpy, matplotlib, networkx, seaborn, datetime, ipywidgets, ipython, dnspython, ipwhois, folium, maxminddb_geolite2
\r\n",
"\r\n",
" **Data Sources Required**:\r\n",
" - Log Analytics/Azure Sentinel - Syslog, Secuirty Alerts, Auditd, Azure Network Analytics.\r\n",
" - (Optional) - AlienVault OTX (requires account and API key)\r\n",
"
\"\r\n",
" \"Warning: we needed to update 'utils/nb_check.py'
\"\r\n",
" \"Please restart the kernel and re-run this cell.\"\r\n",
" \"
Sucessful logons
Failed Logon Attempts (via su)
')) \r\n", "\r\n", " all_df = pd.DataFrame(dict(successful= remote_logons['ProcessName'].value_counts(), failed = failed_logons['ProcessName'].value_counts())).fillna(0)\r\n", " fail_data = pd.value_counts(failed_logons['User'].values, sort=True).head(10).reset_index(name='value').rename(columns={'User':'Count'})\r\n", " fail_data['angle'] = fail_data['value']/fail_data['value'].sum() * 2*pi\r\n", " fail_data['color'] = viridis(len(fail_data))\r\n", " fp = figure(plot_height=350, plot_width=450, title=\"Relative Frequencies of Failed Logons by Account\", toolbar_location=None, tools=\"hover\", tooltips=\"@index: @value\")\r\n", " fp.wedge(x=0, y=1, radius=0.5, start_angle=cumsum('angle', include_zero=True), end_angle=cumsum('angle'), line_color=\"white\", fill_color='color', legend='index', source=fail_data)\r\n", "\r\n", " sucess_data = pd.value_counts(remote_logons['User'].values, sort=False).reset_index(name='value').rename(columns={'User':'Count'})\r\n", " sucess_data['angle'] = sucess_data['value']/sucess_data['value'].sum() * 2*pi\r\n", " sucess_data['color'] = viridis(len(sucess_data))\r\n", " sp = figure(plot_height=350, width=450, title=\"Relative Frequencies of Sucessful Logons by Account\", toolbar_location=None, tools=\"hover\", tooltips=\"@index: @value\")\r\n", " sp.wedge(x=0, y=1, radius=0.5, start_angle=cumsum('angle', include_zero=True), end_angle=cumsum('angle'), line_color=\"white\", fill_color='color', legend='index', source=sucess_data)\r\n", "\r\n", " fp.axis.axis_label=None\r\n", " fp.axis.visible=False\r\n", " fp.grid.grid_line_color = None\r\n", " sp.axis.axis_label=None\r\n", " sp.axis.visible=False\r\n", " sp.grid.grid_line_color = None\r\n", "\r\n", "\r\n", " processes = all_df.index.values.tolist()\r\n", " results = all_df.columns.values.tolist()\r\n", " fail_sucess_data = {'processes' :processes,\r\n", " 'sucess' : all_df['successful'].values.tolist(),\r\n", " 'failure': all_df['failed'].values.tolist()}\r\n", "\r\n", " palette = viridis(2)\r\n", " x = [ (process, result) for process in processes for result in results ]\r\n", " counts = sum(zip(fail_sucess_data['sucess'], fail_sucess_data['failure']), ()) \r\n", " source = ColumnDataSource(data=dict(x=x, counts=counts))\r\n", " b = figure(x_range=FactorRange(*x), plot_height=350, plot_width=450, title=\"Failed and Sucessful logon attempts by process\",\r\n", " toolbar_location=None, tools=\"\", y_minor_ticks=2)\r\n", " b.vbar(x='x', top='counts', width=0.9, source=source, line_color=\"white\",\r\n", " fill_color=factor_cmap('x', palette=palette, factors=results, start=1, end=2))\r\n", " b.y_range.start = 0\r\n", " b.x_range.range_padding = 0.1\r\n", " b.xaxis.major_label_orientation = 1\r\n", " b.xgrid.grid_line_color = None\r\n", "\r\n", " show(Row(sp,fp,b))\r\n", "\r\n", " ip_list = [convert_to_ip_entities(i, ip_col=\"SourceIP\")[0] for i in remote_logons['SourceIP'].unique() if i != \"\"]\r\n", " ip_fail_list = [convert_to_ip_entities(i)[0] for i in failed_logons['SourceIP'].unique() if i != \"\"]\r\n", " \r\n", " location = get_map_center(ip_list + ip_fail_list)\r\n", " folium_map = FoliumMap(location = location, zoom_start=1.4)\r\n", " #Map logon locations to allow for identification of anomolous locations\r\n", " if len(ip_fail_list) > 0:\r\n", " md('Warning: the folium mapping library '\r\n", " 'does not display correctly in some browsers.
Warning: the folium mapping library '\n", " 'does not display correctly in some browsers.