Skip to content

Commit 65177e7

Browse files
authored
Merge pull request #297282 from MicrosoftDocs/main
Publish to live, Sunday 4PM PST, 3/30
2 parents 30d9c74 + af4342d commit 65177e7

File tree

9 files changed

+129
-648
lines changed

9 files changed

+129
-648
lines changed

articles/frontdoor/end-to-end-tls.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -121,8 +121,8 @@ For TLS 1.2/1.3, the following cipher suites are supported:
121121
- TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
122122
- TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
123123

124-
> [!NOTE]
125-
> Old TLS versions and weak ciphers are no longer supported.
124+
> [!NOTE]
125+
> Old TLS versions and weak ciphers are no longer supported.
126126
127127
Use *TLS policy* to configure specific cipher suites. Azure Front Door Standard and Premium offer two mechanisms for controlling TLS policy: you can use either a predefined policy or a custom policy per your own needs. For more information, see [Configure TLS policy on a Front Door custom domain](standard-premium/tls-policy-configure.md).
128128

37.4 KB
Loading
8.63 KB
Loading

articles/sentinel/notebook-get-started.md

Lines changed: 48 additions & 563 deletions
Large diffs are not rendered by default.

articles/sentinel/notebooks-msticpy-advanced.md

Lines changed: 24 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,11 @@ ms.date: 01/09/2023
1616

1717
This article describes advanced configurations for working with Jupyter notebooks and MSTICPy in Microsoft Sentinel.
1818

19-
For more information, see [Use Jupyter notebooks to hunt for security threats](notebooks.md) and [Tutorial: Get started with Jupyter notebooks and MSTICPy in Microsoft Sentinel](notebook-get-started.md).
19+
For more information, see [Use Jupyter notebooks to hunt for security threats](notebooks.md) and [Get started with Jupyter notebooks and MSTICPy in Microsoft Sentinel](notebook-get-started.md).
2020

2121
## Prerequisites
2222

23-
This article is a continuation on from [Tutorial: Get started with Jupyter notebooks and MSTICPy in Microsoft Sentinel](notebook-get-started.md). We recommend that you perform the tutorial before continuing with the advanced procedures described below.
23+
This article is a continuation on from [Get started with Jupyter notebooks and MSTICPy in Microsoft Sentinel](notebook-get-started.md). We recommend that you perform the tutorial before continuing with the advanced procedures described in this article.
2424

2525
## Specify authentication parameters for Azure and Microsoft Sentinel APIs
2626

@@ -39,7 +39,7 @@ This procedure describes how to configure authentication parameters for Microsof
3939

4040
1. Select the authentication methods to use:
4141

42-
- While you can use a different set of methods from the [Azure defaults](notebook-get-started.md#specify-the-azure-cloud-and-azure-authentication-methods), this usage isn't a typical configuration.
42+
- While you can use a different set of methods from the defaults, this usage isn't a typical configuration. For more information, see the [**Getting Started Guide For Azure Sentinel ML Notebooks** notebook](notebook-get-started.md).
4343
- Unless you want to use the **env** (environment variable) authentication, leave the **clientId**, **tenantId**, and **clientSecret** fields empty.
4444
- While not recommended, MSTICPy also supports using client app IDs and secrets for your authentication. In such cases, define your **clientId**, **tenantId**, and **clientSecret** fields directly in the **Data Providers** tab.
4545

@@ -67,11 +67,11 @@ When you frequently author new notebooks, autoloading query providers can save y
6767

6868
Each provider also has the following optional values:
6969

70-
- **Auto-connect:** This option is defined as **True** by default, and MSTICPy tries to authenticate to the provider immediately after loading. MSTICPy assumes that you've configured credentials for the provider in your settings.
70+
- **Auto-connect:** This option is defined as **True** by default, and MSTICPy tries to authenticate to the provider immediately after loading. MSTICPy assumes that you configured credentials for the provider in your settings.
7171

7272
- **Alias:** When MSTICPy loads a provider, it assigns the provider to a Python variable name. By default, the variable name is **qryworkspace_name** for Microsoft Sentinel providers and **qryprovider_name** for other providers.
7373

74-
For example, if you load a query provider for the *ContosoSOC* workspace, this query provider will be created in your notebook environment with the name `qry_ContosoSOC`. Add an alias if you want to use something shorter or easier to type and remember. The provider variable name will be `qry_<alias>`, where `<alias>` is replaced by the alias name that you provided.
74+
For example, if you load a query provider for the *ContosoSOC* workspace, this query provider is created in your notebook environment with the name `qry_ContosoSOC`. Add an alias if you want to use something shorter or easier to type and remember. The provider variable name is `qry_<alias>`, where `<alias>` is replaced by the alias name that you provided.
7575

7676
Providers you load by this mechanism are also added to the MSTICPy `current_providers` attribute, which is used, for example, in the following code:
7777

@@ -88,16 +88,14 @@ This procedure describes how to define other components that are automatically l
8888

8989
Supported components include, in the following order:
9090

91-
1. **TILookup:** The [TI provider library](notebook-get-started.md#add-threat-intelligence-provider-settings)
92-
1. **GeoIP:** The [GeoIP provider](notebook-get-started.md#add-geoip-provider-settings) you want to use
91+
1. **TILookup:** The TI provider library you want to use
92+
1. **GeoIP:** The GeoIP provider you want to use
9393
1. **AzureData:** The module you use to query details about [Azure resources](#specify-authentication-parameters-for-azure-and-microsoft-sentinel-apis)
9494
1. **AzureSentinelAPI:** The module you use to query the [Microsoft Sentinel API](#specify-authentication-parameters-for-azure-and-microsoft-sentinel-apis)
9595
1. **Notebooklets:** Notebooklets from the [msticnb package](https://msticnb.readthedocs.io/en/latest/)
9696
1. **Pivot:** Pivot functions
9797

98-
> [!NOTE]
99-
> The components load in this order because the Pivot component needs query and other providers loaded to find the pivot functions that it attaches to entities. For more information, see [MSTICPy documentation](https://msticpy.readthedocs.io/en/latest/data_analysis/PivotFunctions.html).
100-
>
98+
The components load in this order because the Pivot component needs query and other providers loaded to find the pivot functions that it attaches to entities. For more information, see [MSTICPy documentation](https://msticpy.readthedocs.io/en/latest/data_analysis/PivotFunctions.html). For more information, see the [**Getting Started Guide For Azure Sentinel ML Notebooks** notebook](notebook-get-started.md).
10199

102100
**To define auto-loaded MSTICPy components**:
103101

@@ -110,9 +108,8 @@ Supported components include, in the following order:
110108

111109
1. In the **Autoload Components** tab, define any parameter values as needed. For example:
112110

113-
- **GeoIpLookup**. Enter the name of the GeoIP provider you want to use, either *GeoLiteLookup* or *IPStack*. For more information, see [Add GeoIP provider settings](notebook-get-started.md#add-geoip-provider-settings).
114-
115-
- **AzureData and AzureSentinelAPI components**. Define the following values:
111+
- **GeoIpLookup**. Enter the name of the GeoIP provider you want to use, either *GeoLiteLookup* or *IPStack*.
112+
- **AzureData and AzureSentinelAPI components**. Define the following values:
116113

117114
- **auth_methods:** Override the default settings for AzureCLI, and connect using the selected methods.
118115
- **Auto-connect:** Set to false to load without connecting.
@@ -138,11 +135,11 @@ Supported components include, in the following order:
138135

139136
## Switch between Python 3.6 and 3.8 kernels
140137

141-
If you're switching between Python 3.65 and 3.8 kernels, you may find that MSTICPy and other packages don't get installed as expected.
138+
If you're switching between Python 3.65 and 3.8 kernels, you might find that MSTICPy and other packages don't get installed as expected.
142139

143-
This may happen when the `!pip install pkg` command will install correctly in the first environment, but then doesn't install correctly in the second. This creates a situation where the second environment can't import or use the package.
140+
This might happen when the `!pip install pkg` command installs correctly in the first environment, but then doesn't install correctly in the second. This creates a situation where the second environment can't import or use the package.
144141

145-
We recommend that you don't use `!pip install...` to install packages in Azure ML notebooks. Instead, use one of the following options:
142+
We recommend that you don't use `!pip install...` to install packages in Azure Machine Learning notebooks. Instead, use one of the following options:
146143

147144
- **Use the %pip line magic within a notebook**. Run:
148145

@@ -153,7 +150,7 @@ We recommend that you don't use `!pip install...` to install packages in Azure M
153150

154151
- **Install from a terminal**:
155152

156-
1. Open a terminal in Azure ML notebooks and run the following commands:
153+
1. Open a terminal in Azure Machine Learning notebooks and run the following commands:
157154

158155
``` bash
159156
conda activate azureml_py38
@@ -164,17 +161,17 @@ We recommend that you don't use `!pip install...` to install packages in Azure M
164161

165162
## Set an environment variable for your msticpyconfig.yaml file
166163

167-
If you are running in Azure ML and have your **msticpyconfig.yaml** file in the root of your user folder, MSTICPy will automatically find these settings. However, if you are running the notebooks in another environment, follow the instructions in this section to set an environment variable that points to the location of your configuration file.
164+
If you're running in Azure Machine Learning and have your **msticpyconfig.yaml** file in the root of your user folder, MSTICPy automatically finds these settings. However, if you're running the notebooks in another environment, follow the instructions in this section to set an environment variable that points to the location of your configuration file.
168165

169166
Defining the path to your **msticpyconfig.yaml** file in an environment variable allows you to store your file in a known location and make sure that you always load the same settings.
170167

171168
Use multiple configuration files, with multiple environment variables, if you want to use different settings for different notebooks.
172169

173170
1. Decide on a location for your **msticpyconfig.yaml** file, such as in **~/.msticpyconfig.yaml** or **%userprofile%/msticpyconfig.yaml**.
174171

175-
**Azure ML users**: If you store your configuration file in your Azure ML user folder, the MSTICPy `init_notebook` function (run in the initialization cell) will automatically find and use the file, and you do not need to set a **MSTICPYCONFIG** environment variable.
172+
**Azure ML users**: If you store your configuration file in your Azure Machine Learning user folder, the MSTICPy `init_notebook` function (run in the initialization cell) automatically finds and uses the file, and you don't need to set a **MSTICPYCONFIG** environment variable.
176173

177-
However, if you also have secrets stored in the file, we recommend storing the configuration file on the compute local drive. The compute internal storage is accessible only to the person who created the compute, whereas the shared storage is accessible to anyone with access to your Azure ML workspace.
174+
However, if you also have secrets stored in the file, we recommend storing the configuration file on the compute local drive. The compute internal storage is accessible only to the person who created the compute, whereas the shared storage is accessible to anyone with access to your Azure Machine Learning workspace.
178175

179176
For more information, see [What is an Azure Machine Learning compute instance?](/azure/machine-learning/concept-compute-instance).
180177

@@ -202,11 +199,11 @@ This procedure describes how to update the **.bashrc** file to set the **MSTICPY
202199

203200
1. Move the **msticpyconfig.yaml** file to the Compute instance as needed.
204201

205-
1. Open an Azure ML terminal, such as from the Microsoft Sentinel **Notebooks** page.
202+
1. Open an Azure Machine Learning terminal, such as from the Microsoft Sentinel **Notebooks** page.
206203

207204
1. Verify that you can access your **msticpyconfig.yaml** file.
208205

209-
In your Azure ML terminal, your current directory should be your Azure ML file store home directory, mounted in the Compute Linux system. The prompt looks similar to the following example:
206+
In your Azure Machine Learning terminal, your current directory should be your Azure Machine Learning file store home directory, mounted in the Compute Linux system. The prompt looks similar to the following example:
210207

211208
```python
212209
azureuser@alicecontoso-azml7:~/cloudfiles/code/Users/alicecontoso$
@@ -233,13 +230,13 @@ This procedure describes how to update the **.bashrc** file to set the **MSTICPY
233230
- If you moved the **msticpyconfig.yaml** file, run `export MSTICPYCONFIG=~/msticpyconfig.yaml`.
234231
- If you didn't move the **msticpyconfig.yaml** file, run `export MSTICPYCONFIG=~/cloudfiles/code/Users/<YOURNAME>/msticpyconfig.yaml`.
235232

236-
# [Azure ML options](#tab/azure-ml)
233+
# [Azure Machine Learning options](#tab/azure-ml)
237234

238-
If you need to store your **msticpyconfig.yaml** file somewhere other than your Azure ML user folder, use one of the following options:
235+
If you need to store your **msticpyconfig.yaml** file somewhere other than your Azure Machine Learning user folder, use one of the following options:
239236

240-
- **An *nbuser_settings.py* file at the root of your user folder**. While this process is simpler and less intrusive than editing the **kernel.json** file, it's only supported when you run the `init_notebook` function at the start of your notebook code. While this is the default behavior, if you run the notebook code without first running `init_notebook`, MSTICPy may not be able to find the configuration file.
237+
- **An *nbuser_settings.py* file at the root of your user folder**. While this process is simpler and less intrusive than editing the **kernel.json** file, it's only supported when you run the `init_notebook` function at the start of your notebook code. While this is the default behavior, if you run the notebook code without first running `init_notebook`, MSTICPy mmight not be able to find the configuration file.
241238

242-
1. In the Azure ML terminal, create the **nbuser_settings.py** file in the root of your user folder, which is the folder with your username.
239+
1. In the Azure Machine Learning terminal, create the **nbuser_settings.py** file in the root of your user folder, which is the folder with your username.
243240
1. In the **nbuser_settings.py** file, add the following lines:
244241

245242
```python
@@ -296,7 +293,7 @@ If you need to store your **msticpyconfig.yaml** file somewhere other than your
296293
---
297294

298295
> [!NOTE]
299-
> For the Linux and Windows options, you'll need to restart your Jupyter server for it to pick up the environment variable that you defined.
296+
> For the Linux and Windows options, you need to restart your Jupyter server for it to pick up the environment variable that you defined.
300297

301298
## Next steps
302299

0 commit comments

Comments
 (0)