You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/notebooks-msticpy-advanced.md
+7-10Lines changed: 7 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,11 +16,11 @@ ms.date: 01/09/2023
16
16
17
17
This article describes advanced configurations for working with Jupyter notebooks and MSTICPy in Microsoft Sentinel.
18
18
19
-
For more information, see [Use Jupyter notebooks to hunt for security threats](notebooks.md) and [Tutorial: Get started with Jupyter notebooks and MSTICPy in Microsoft Sentinel](notebook-get-started.md).
19
+
For more information, see [Use Jupyter notebooks to hunt for security threats](notebooks.md) and [Get started with Jupyter notebooks and MSTICPy in Microsoft Sentinel](notebook-get-started.md).
20
20
21
21
## Prerequisites
22
22
23
-
This article is a continuation on from [Tutorial: Get started with Jupyter notebooks and MSTICPy in Microsoft Sentinel](notebook-get-started.md). We recommend that you perform the tutorial before continuing with the advanced procedures described below.
23
+
This article is a continuation on from [Get started with Jupyter notebooks and MSTICPy in Microsoft Sentinel](notebook-get-started.md). We recommend that you perform the tutorial before continuing with the advanced procedures described below.
24
24
25
25
## Specify authentication parameters for Azure and Microsoft Sentinel APIs
26
26
@@ -39,7 +39,7 @@ This procedure describes how to configure authentication parameters for Microsof
39
39
40
40
1. Select the authentication methods to use:
41
41
42
-
- While you can use a different set of methods from the [Azure defaults](notebook-get-started.md#specify-the-azure-cloud-and-azure-authentication-methods), this usage isn't a typical configuration.
42
+
- While you can use a different set of methods from the defaults, this usage isn't a typical configuration. For more information, see the [**Getting Started Guide For Azure Sentinel ML Notebooks** notebook](notebook-get-started.md).
43
43
- Unless you want to use the **env** (environment variable) authentication, leave the **clientId**, **tenantId**, and**clientSecret** fields empty.
44
44
- While not recommended, MSTICPy also supports using client app IDs and secrets for your authentication. In such cases, define your **clientId**, **tenantId**, and**clientSecret** fields directly in the **Data Providers** tab.
45
45
@@ -88,16 +88,14 @@ This procedure describes how to define other components that are automatically l
88
88
89
89
Supported components include, in the following order:
90
90
91
-
1. **TILookup:** The [TI provider library](notebook-get-started.md#add-threat-intelligence-provider-settings)
92
-
1. **GeoIP:** The [GeoIP provider](notebook-get-started.md#add-geoip-provider-settings) you want to use
91
+
1. **TILookup:** The TI provider library you want to use
92
+
1. **GeoIP:** The GeoIP provider you want to use
93
93
1. **AzureData:** The module you use to query details about [Azure resources](#specify-authentication-parameters-for-azure-and-microsoft-sentinel-apis)
94
94
1. **AzureSentinelAPI:** The module you use to query the [Microsoft Sentinel API](#specify-authentication-parameters-for-azure-and-microsoft-sentinel-apis)
95
95
1. **Notebooklets:** Notebooklets from the [msticnb package](https://msticnb.readthedocs.io/en/latest/)
96
96
1. **Pivot:** Pivot functions
97
97
98
-
> [!NOTE]
99
-
> The components load in this order because the Pivot component needs query and other providers loaded to find the pivot functions that it attaches to entities. For more information, see [MSTICPy documentation](https://msticpy.readthedocs.io/en/latest/data_analysis/PivotFunctions.html).
100
-
>
98
+
The components load in this order because the Pivot component needs query and other providers loaded to find the pivot functions that it attaches to entities. For more information, see [MSTICPy documentation](https://msticpy.readthedocs.io/en/latest/data_analysis/PivotFunctions.html). For more information, see the [**Getting Started Guide For Azure Sentinel ML Notebooks** notebook](notebook-get-started.md).
101
99
102
100
**To define auto-loaded MSTICPy components**:
103
101
@@ -110,8 +108,7 @@ Supported components include, in the following order:
110
108
111
109
1. In the **Autoload Components** tab, define any parameter values as needed. For example:
112
110
113
-
-**GeoIpLookup**. Enter the name of the GeoIP provider you want to use, either *GeoLiteLookup*or*IPStack*. For more information, see [Add GeoIP provider settings](notebook-get-started.md#add-geoip-provider-settings).
114
-
111
+
-**GeoIpLookup**. Enter the name of the GeoIP provider you want to use, either *GeoLiteLookup*or*IPStack*.
115
112
-**AzureData and AzureSentinelAPI components**. Define the following values:
116
113
117
114
-**auth_methods:** Override the default settings for AzureCLI, and connect using the selected methods.
0 commit comments