Azure / Azure/Azure-Sentinel-Notebooks

Data processing issue with Azure Sentinel Template: Guided Investigation - Process Alerts.ipynb

Open
#117 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Jupyter Notebook
Stars
628
Forks
236
PR merge metrics
No merged PRs in 30d

Description

error found in "Show these related alerts on a graph" and "Browse List of Related Alerts" sections when processing data for displaying. Various errors were displayed. Here is the top and bottom part of the output.

AttributeError Traceback (most recent call last)
in
2
3 if related_alerts is not None and not related_alerts.empty:
----> 4 rel_alert_graph = security_alert_graph.add_related_alerts(related_alerts=related_alerts,
global rel_alert_graph = undefined
global security_alert_graph.add_related_alerts =
global related_alerts = TenantId TimeGenerated \
0 xxxxxxxx-xxxx-4e32-xxxx-9bc4bxxx075e 2021-10-26 10:30:18.562000+00:00
1 xxxxxxxx-xxxx-4e32-xxxx-9bc4bxxx075e 2021-10-26 10:30:18.333000+00:00

......
......

entity_type_name = 'url'
raw_entity = {'$id': '13', 'Url': 'https://on-d.oss-cn-shenzhen.aliyuncs.com/download/%E5%8C%97%E4%BA%AC%E5%B8%82%E7%BD%91%E4%B8%8A%E7%A8%8E%E5%8A%A1%E5%B1%80%28%E8%87%AA%E7%84%B6%E4%BA%BA%E7%89%88%29_01210003296.exe', 'Type': 'url'}
450
451 raise TypeError("Could not find a suitable type for {}".format(entity_type))

/anaconda/envs/azureml_py38/lib/python3.8/site-packages/msticpy/datamodel/entities/url.py in __init__(self=Url(Type=url), src_entity={'$id': '13', 'Type': 'url', 'Url': 'https://on-d.oss-cn-shenzhen.aliyuncs.com/downlo...%AA%E7%84%B6%E4%BA%BA%E7%89%88%29_01210003296.exe'}, **kwargs={})
31 """
32 super().__init__(src_entity=src_entity, **kwargs)
---> 33 if self.Url:
self.Url = undefined
34 self.__dict__.update(url_components(self.Url))
35

/anaconda/envs/azureml_py38/lib/python3.8/site-packages/msticpy/datamodel/entities/entity.py in __getattr__(self=Url(Type=url), name='Url')
196 if name in self._entity_schema:
197 return None
--> 198 raise AttributeError(f"{name} is not a valid attribute.")
global AttributeError = undefined
199
200 def __iter__(self):

AttributeError: Url is not a valid attribute.

Contributor guide

Open the contributing guide

Research direction

Open Guided Investigation - Process Alerts.ipynb and reproduce the error in the "Show these related alerts on a graph" and "Browse List of Related Alerts" sections. Start with the traceback around security_alert_graph.add_related_alerts and the msticpy Url entity, then verify that related alerts can be processed and displayed without the reported errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, jupyter-notebook, python
Domain
data, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.