Azure / Azure/Azure-Sentinel-Notebooks
Data processing issue with Azure Sentinel Template: Guided Investigation - Process Alerts.ipynb
- Dominant language
- Jupyter Notebook
- Stars
- 628
- Forks
- 236
- PR merge metrics
- No merged PRs in 30d
Description
error found in "Show these related alerts on a graph" and "Browse List of Related Alerts" sections when processing data for displaying. Various errors were displayed. Here is the top and bottom part of the output.
AttributeError Traceback (most recent call last)
in
2
3 if related_alerts is not None and not related_alerts.empty:
----> 4 rel_alert_graph = security_alert_graph.add_related_alerts(related_alerts=related_alerts,
global rel_alert_graph = undefined
global security_alert_graph.add_related_alerts =
global related_alerts = TenantId TimeGenerated \
0 xxxxxxxx-xxxx-4e32-xxxx-9bc4bxxx075e 2021-10-26 10:30:18.562000+00:00
1 xxxxxxxx-xxxx-4e32-xxxx-9bc4bxxx075e 2021-10-26 10:30:18.333000+00:00
......
......
entity_type_name = 'url'
raw_entity = {'$id': '13', 'Url': 'https://on-d.oss-cn-shenzhen.aliyuncs.com/download/%E5%8C%97%E4%BA%AC%E5%B8%82%E7%BD%91%E4%B8%8A%E7%A8%8E%E5%8A%A1%E5%B1%80%28%E8%87%AA%E7%84%B6%E4%BA%BA%E7%89%88%29_01210003296.exe', 'Type': 'url'}
450
451 raise TypeError("Could not find a suitable type for {}".format(entity_type))
/anaconda/envs/azureml_py38/lib/python3.8/site-packages/msticpy/datamodel/entities/url.py in __init__(self=Url(Type=url), src_entity={'$id': '13', 'Type': 'url', 'Url': 'https://on-d.oss-cn-shenzhen.aliyuncs.com/downlo...%AA%E7%84%B6%E4%BA%BA%E7%89%88%29_01210003296.exe'}, **kwargs={})
31 """
32 super().__init__(src_entity=src_entity, **kwargs)
---> 33 if self.Url:
self.Url = undefined
34 self.__dict__.update(url_components(self.Url))
35
/anaconda/envs/azureml_py38/lib/python3.8/site-packages/msticpy/datamodel/entities/entity.py in __getattr__(self=Url(Type=url), name='Url')
196 if name in self._entity_schema:
197 return None
--> 198 raise AttributeError(f"{name} is not a valid attribute.")
global AttributeError = undefined
199
200 def __iter__(self):
AttributeError: Url is not a valid attribute.
Contributor guide
Research direction
Open Guided Investigation - Process Alerts.ipynb and reproduce the error in the "Show these related alerts on a graph" and "Browse List of Related Alerts" sections. Start with the traceback around security_alert_graph.add_related_alerts and the msticpy Url entity, then verify that related alerts can be processed and displayed without the reported errors.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, jupyter-notebook, python
- Domain
- data, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100