You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/notebooks-msticpy-advanced.md
+19-19Lines changed: 19 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -20,7 +20,7 @@ For more information, see [Use Jupyter notebooks to hunt for security threats](n
20
20
21
21
## Prerequisites
22
22
23
-
This article is a continuation on from [Get started with Jupyter notebooks and MSTICPy in Microsoft Sentinel](notebook-get-started.md). We recommend that you perform the tutorial before continuing with the advanced procedures described below.
23
+
This article is a continuation on from [Get started with Jupyter notebooks and MSTICPy in Microsoft Sentinel](notebook-get-started.md). We recommend that you perform the tutorial before continuing with the advanced procedures described in this article.
24
24
25
25
## Specify authentication parameters for Azure and Microsoft Sentinel APIs
26
26
@@ -67,11 +67,11 @@ When you frequently author new notebooks, autoloading query providers can save y
67
67
68
68
Each provider also has the following optional values:
69
69
70
-
-**Auto-connect:** This option is defined as**True** by default, and MSTICPy tries to authenticate to the provider immediately after loading. MSTICPy assumes that you've configured credentials for the provider in your settings.
70
+
-**Auto-connect:** This option is defined as**True** by default, and MSTICPy tries to authenticate to the provider immediately after loading. MSTICPy assumes that you configured credentials for the provider in your settings.
71
71
72
72
-**Alias:** When MSTICPy loads a provider, it assigns the provider to a Python variable name. By default, the variable name is**qryworkspace_name**for Microsoft Sentinel providers and**qryprovider_name**for other providers.
73
73
74
-
For example, if you load a query provider for the *ContosoSOC* workspace, this query provider will be created in your notebook environment with the name `qry_ContosoSOC`. Add an alias if you want to use something shorter or easier to typeand remember. The provider variable name will be`qry_<alias>`, where `<alias>`is replaced by the alias name that you provided.
74
+
For example, if you load a query provider for the *ContosoSOC* workspace, this query provider iscreated in your notebook environment with the name `qry_ContosoSOC`. Add an alias if you want to use something shorter or easier to typeand remember. The provider variable name is`qry_<alias>`, where `<alias>`is replaced by the alias name that you provided.
75
75
76
76
Providers you load by this mechanism are also added to the MSTICPy `current_providers` attribute, which is used, for example, in the following code:
77
77
@@ -108,8 +108,8 @@ The components load in this order because the Pivot component needs query and ot
108
108
109
109
1. In the **Autoload Components** tab, define any parameter values as needed. For example:
110
110
111
-
-**GeoIpLookup**. Enter the name of the GeoIP provider you want to use, either *GeoLiteLookup*or*IPStack*.
112
-
-**AzureData and AzureSentinelAPI components**. Define the following values:
111
+
-**GeoIpLookup**. Enter the name of the GeoIP provider you want to use, either *GeoLiteLookup*or*IPStack*.
112
+
-**AzureData and AzureSentinelAPI components**. Define the following values:
113
113
114
114
-**auth_methods:** Override the default settings for AzureCLI, and connect using the selected methods.
115
115
-**Auto-connect:** Set to false to load without connecting.
@@ -135,11 +135,11 @@ The components load in this order because the Pivot component needs query and ot
135
135
136
136
## Switch between Python 3.6 and 3.8 kernels
137
137
138
-
If you're switching between Python 3.65 and 3.8 kernels, you may find that MSTICPy and other packages don't get installed as expected.
138
+
If you're switching between Python 3.65 and 3.8 kernels, you might find that MSTICPy and other packages don't get installed as expected.
139
139
140
-
This may happen when the `!pip install pkg` command will install correctly in the first environment, but then doesn't install correctly in the second. This creates a situation where the second environment can't importor use the package.
140
+
This might happen when the `!pip install pkg` command installs correctly in the first environment, but then doesn't install correctly in the second. This creates a situation where the second environment can't importor use the package.
141
141
142
-
We recommend that you don't use `!pip install...` to install packages in Azure ML notebooks. Instead, use one of the following options:
142
+
We recommend that you don't use `!pip install...` to install packages in Azure Machine Learning notebooks. Instead, use one of the following options:
143
143
144
144
-**Use the %pip line magic within a notebook**. Run:
145
145
@@ -150,7 +150,7 @@ We recommend that you don't use `!pip install...` to install packages in Azure M
150
150
151
151
-**Install from a terminal**:
152
152
153
-
1. Open a terminal in Azure ML notebooks and run the following commands:
153
+
1. Open a terminal in Azure Machine Learning notebooks and run the following commands:
154
154
155
155
``` bash
156
156
conda activate azureml_py38
@@ -161,17 +161,17 @@ We recommend that you don't use `!pip install...` to install packages in Azure M
161
161
162
162
## Set an environment variable for your msticpyconfig.yaml file
163
163
164
-
If you are running in Azure MLand have your **msticpyconfig.yaml**filein the root of your user folder, MSTICPy will automatically find these settings. However, if you are running the notebooks in another environment, follow the instructions in this section to set an environment variable that points to the location of your configuration file.
164
+
If you're running in Azure Machine Learning and have your **msticpyconfig.yaml** file in the root of your user folder, MSTICPy automatically finds these settings. However, if you're running the notebooks in another environment, follow the instructions in this section to set an environment variable that points to the location of your configuration file.
165
165
166
166
Defining the path to your **msticpyconfig.yaml**filein an environment variable allows you to store your filein a known location and make sure that you always load the same settings.
167
167
168
168
Use multiple configuration files, with multiple environment variables, if you want to use different settings for different notebooks.
169
169
170
170
1. Decide on a location for your **msticpyconfig.yaml**file, such asin**~/.msticpyconfig.yaml**or**%userprofile%/msticpyconfig.yaml**.
171
171
172
-
**Azure ML users**: If you store your configuration filein your Azure MLuser folder, the MSTICPy `init_notebook` function (run in the initialization cell) will automatically findanduse the file, and you do not need to set a **MSTICPYCONFIG** environment variable.
172
+
**Azure ML users**: If you store your configuration filein your Azure Machine Learning user folder, the MSTICPy `init_notebook` function (run in the initialization cell) automatically findsanduses the file, and you don't need to set a **MSTICPYCONFIG** environment variable.
173
173
174
-
However, if you also have secrets stored in the file, we recommend storing the configuration file on the compute local drive. The compute internal storage is accessible only to the person who created the compute, whereas the shared storage is accessible to anyone with access to your Azure ML workspace.
174
+
However, if you also have secrets stored in the file, we recommend storing the configuration file on the compute local drive. The compute internal storage is accessible only to the person who created the compute, whereas the shared storage is accessible to anyone with access to your Azure Machine Learning workspace.
175
175
176
176
For more information, see [What is an Azure Machine Learning compute instance?](/azure/machine-learning/concept-compute-instance).
177
177
@@ -199,11 +199,11 @@ This procedure describes how to update the **.bashrc** file to set the **MSTICPY
199
199
200
200
1. Move the **msticpyconfig.yaml**file to the Compute instance as needed.
201
201
202
-
1. Open an Azure ML terminal, such asfrom the Microsoft Sentinel **Notebooks** page.
202
+
1. Open an Azure Machine Learning terminal, such asfrom the Microsoft Sentinel **Notebooks** page.
203
203
204
204
1. Verify that you can access your **msticpyconfig.yaml**file.
205
205
206
-
In your Azure MLterminal, your current directory should be your Azure MLfile store home directory, mounted in the Compute Linux system. The prompt looks similar to the following example:
206
+
In your Azure Machine Learning terminal, your current directory should be your Azure Machine Learningfile store home directory, mounted in the Compute Linux system. The prompt looks similar to the following example:
@@ -230,13 +230,13 @@ This procedure describes how to update the **.bashrc** file to set the **MSTICPY
230
230
- If you moved the **msticpyconfig.yaml**file, run `export MSTICPYCONFIG=~/msticpyconfig.yaml`.
231
231
- If you didn't move the **msticpyconfig.yaml** file, run `export MSTICPYCONFIG=~/cloudfiles/code/Users/<YOURNAME>/msticpyconfig.yaml`.
232
232
233
-
# [Azure ML options](#tab/azure-ml)
233
+
# [Azure Machine Learning options](#tab/azure-ml)
234
234
235
-
If you need to store your **msticpyconfig.yaml**file somewhere other than your Azure ML user folder, use one of the following options:
235
+
If you need to store your **msticpyconfig.yaml**file somewhere other than your Azure Machine Learning user folder, use one of the following options:
236
236
237
-
-**An *nbuser_settings.py*file at the root of your user folder**. While this process is simpler and less intrusive than editing the **kernel.json**file, it's only supported when you run the `init_notebook` function at the start of your notebook code. While this is the default behavior, if you run the notebook code without first running `init_notebook`, MSTICPy may not be able to find the configuration file.
237
+
-**An *nbuser_settings.py*file at the root of your user folder**. While this process is simpler and less intrusive than editing the **kernel.json**file, it's only supported when you run the `init_notebook` function at the start of your notebook code. While this is the default behavior, if you run the notebook code without first running `init_notebook`, MSTICPy mmight not be able to find the configuration file.
238
238
239
-
1. In the Azure ML terminal, create the **nbuser_settings.py**filein the root of your user folder, which is the folder with your username.
239
+
1. In the Azure Machine Learning terminal, create the **nbuser_settings.py**filein the root of your user folder, which is the folder with your username.
240
240
1. In the **nbuser_settings.py**file, add the following lines:
241
241
242
242
```python
@@ -293,7 +293,7 @@ If you need to store your **msticpyconfig.yaml** file somewhere other than your
293
293
---
294
294
295
295
> [!NOTE]
296
-
> For the Linux and Windows options, you'll need to restart your Jupyter server for it to pick up the environment variable that you defined.
296
+
> For the Linux and Windows options, you need to restart your Jupyter server for it to pick up the environment variable that you defined.
0 commit comments