Scribd Logo
Upload

Welcome to Scribd!

  • L400-P8 Notebooks and Hunting

    Uploaded by

    H Z
    5 views14 pages
    This document provides an overview of using notebooks in Azure Sentinel for hunting and investigations. Notebooks allow you to create interactive documents containing live code, visualizations, and narrative text. They provide benefits like a full scripting environment, data persistence, sharing capabilities, and access to various libraries. The document recommends building notebooks on the fly for deep investigations or hunting, and authoring reusable notebooks as templates. It also lists KQL Magic and MSTICPY as tools for using KQL and the Microsoft Threat Intelligence Python SDK in notebooks.

    Original Description:

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    This document provides an overview of using notebooks in Azure Sentinel for hunting and investigations. Notebooks allow you to create interactive documents containing live code, visualizations, and narrative text. They provide benefits like a full scripting environment, data persistence, sharing capabilities, and access to various libraries. The document recommends building notebooks on the fly for deep investigations or hunting, and authoring reusable notebooks as templates. It also lists KQL Magic and MSTICPY as tools for using KQL and the Microsoft Threat Intelligence Python SDK in notebooks.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pdf or txt
    5 views14 pages

    L400-P8 Notebooks and Hunting

    Uploaded by

    H Z
    This document provides an overview of using notebooks in Azure Sentinel for hunting and investigations. Notebooks allow you to create interactive documents containing live code, visualizations, and narrative text. They provide benefits like a full scripting environment, data persistence, sharing capabilities, and access to various libraries. The document recommends building notebooks on the fly for deep investigations or hunting, and authoring reusable notebooks as templates. It also lists KQL Magic and MSTICPY as tools for using KQL and the Microsoft Threat Intelligence Python SDK in notebooks.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pdf or txt
    of 14

    Azure Sentinel Level 400

    Hunting and using


    notebooks
    • In this module you will learn
    Overview how to hunt using Azure
    Sentinel.

    • Azure Sentinel Overview


    Pre- module.
    requisites
    • KQL workshop.
    Hunting
    © Microsoft Corporation Azure
    Visualize data sets



    Notebooks
    • A web app for creating and
    running interactive
    documents.
    • Documents contain:
    • live code,
    • Visualizations
    • Narrative text
    • App Server can be:
    • Free MS service
    • Azure VM, Local Docker
    • Data persistency
    • Full scripting/programming environment (vs. declarative query)
    • Sharing, Knowledge base
    • Access to a wide variety of libraries:
    • Machine learning
    • Advanced data manipulation and analysis
    • Visualization

    Also read Why Use Jupyter for Security Investigations


    • Building notebooks on the fly
    • Tier 3 Analysts requiring deep investigation capability
    • Hunters/Threat Intel analysts
    • Authoring reusable notebooks
    • By Tier 3 analysts and SOC Engineering
    • For use as template notebooks by Tier 1+
    • KQL Magic
    • MSTICPY
     Notebooks lab

     Kqlmagic

     Msticpy

     Why Use Jupyter for Security Investigations

    You might also like