{ "cells": [ { "cell_type": "markdown", "metadata": {}, "source": [ "# MSTICPy Settings \n", "\n", "This notebook takes you through setting up your MSTICPy configuration\n", "for the first time. Some sections are specific to using MSTICPy\n", "with Azure Sentinel.\n", "\n", "You must have msticpy installed to run this notebook:\n", "```\n", "%pip install --upgrade msticpy\n", "```\n", "\n", "MSTICpy versions >= 1.0.0" ] }, { "cell_type": "code", "execution_count": 1, "metadata": {}, "outputs": [], "source": [ "from msticpy.config import MpConfigFile, MpConfigEdit" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "# Checking your settings\n", "You can use MpConfigFile from the command line or as an interactive UI to do this.\n" ] }, { "cell_type": "code", "execution_count": 2, "metadata": {}, "outputs": [ { "data": { "application/vnd.jupyter.widget-view+json": { "model_id": "7e7430e84d3746568e68a8cfc04ce4a8", "version_major": 2, "version_minor": 0 }, "text/plain": [ "VBox(children=(Textarea(value=\"{'Azure': {'auth_methods': ['cli', 'interactive'], 'cloud': 'global'},\\n 'Azure…" ] }, "metadata": {}, "output_type": "display_data" } ], "source": [ "mpconfig = MpConfigFile()\n", "mpconfig.load_default()\n", "mpconfig.view_settings()" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "## If you see nothing ...\n", "...but a pair of curly braces in the settings view above it means\n", "that you should set up a **msticpyconfig.yaml**" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "## If you know that you have configured a msticpyconfig file\n", "\n", "You can search for this file using MpConfigFile. Click on **Load file**.\n", "\n", "Once you've done that go to the [Setting the path to your msticpyconfig.yaml](#Setting-the-path-to-your-msticpyconfig.yaml)\n", "\n" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "# Import your Config.json and create a msticpyconfig.yaml [Azure Sentinel]\n", "\n", "Follow these steps:\n", "1. Run MpConfigFile\n", "2. Locate your config.json\n", " - click **Load file** button\n", " - Browse - use the controls to navigate to find config.json\n", " - Search - set the starting directory to search and open the **Search** drop-down\n", " - When you see the file click on it and click **Select File** button (below the file browser)\n", " - optionally, click **View Settings** to confirm that this looks right\n", "3. Convert to convert to msticpyconfig format\n", " - click **View Settings**\n", "4. Save the file\n", " - type a path into the **Current file** text box\n", " - Click on **Save file**\n", "5. You can set this file to always load by assigning the path to an environment variable.\n", " See [Setting the path to your msticpyconfig.yaml](#Setting-the-path-to-your-msticpyconfig.yaml)" ] }, { "cell_type": "code", "execution_count": 3, "metadata": {}, "outputs": [ { "data": { "application/vnd.jupyter.widget-view+json": { "model_id": "0861c40918d34fe5a711c1f0e62f8649", "version_major": 2, "version_minor": 0 }, "text/plain": [ "VBox(children=(HTML(value='
\n from msticpy.common.config.ce_common import get_def_tenant_id\n get_def_tenant_id(\"{workspace-subscription-id}\")\n\n\n The name that you use for workspace (the \"Name\" text box) does not have to\n be the same as the official name. You can use any helpful name that you\n like. You can even have the same workspace included multiple times with\n different names.\n\n There is a special case of the workspace name \"Default\". Normally, when you\n connect to a workspace you need to supply the name corresponding to the\n workspace entry in your settings. If you give a workspace the name \"Default\"\n it will be picked if you do not specify a name. Note, the \"Default\" entry\n can be a duplicate of another named entry.\n
LocalData provider data_paths\n Enter one or more data paths, separated by new lines\n
\n