<jupyter_start><jupyter_text>Get Start__Notebook Version:__ 1.0__Python Version:__ Python 3.6 (including Python 3.6 - AzureML)__Kqlmagic:__ 0.1.90__Platforms Supported:__    -  Azure Notebooks Free Compute    -  Azure Notebooks DSVM__Data Source Required:__    -  Log Analytics - SecurityEvent     DescriptionThe notebook provides you basic knowledge to use ASI Notebooks.When you switch between Azure Notebooks Free Compute and Data Science Virtual Machine (DSVM), you may need to select Python version: please select Python 3.6 for Free Compute, and Python 3.6 - AzureML for DSVM.  Table of Contents1. Retrieve Log Analytics information 2. Install Kqlmagic3. Log into Log Analytics4. Get a list of available data tables from Log Analytics5. Run a simple Kusto query  1. Retrieve Log Analytics Information<jupyter_code>path = %env PATH
dsvm = False
if '/dsvm/' in path:
    dsvm = True
    
if dsvm == False:
    # Run this if you are using Free Compute
    from utils import config_reader as mod
    workspace_id = mod.config_reader.read_config_values("config.json")[3]
    tenant_id = mod.config_reader.read_config_values("config.json")[0]

    ######################################################################
    your_workspace_name = mod.config_reader.read_config_values("config.json")[4]
    print("Your Log Analytic Workspace: " + your_workspace_name)
    ######################################################################
else:
    # Run this if you are using DSVM.  You need to copy the values from config.json, if the file has no value, then you need to go to Log Analytics Portal to get the information.
    tenant_id = input('tenant_id:')
    subscription_id = input('subscription_id:')
    resource_group = input('resource_group:')
    workspace_id = input('workspace_id:')
    workspace_name = input('workspace_name:')<jupyter_output><empty_output><jupyter_text>2. Install KqlmMagic<jupyter_code># run only once unless upgrade
!pip install Kqlmagic --upgrade
# Make sure you have 0.1.90 or above, if not, run Kqlmagic installation again
%reload_ext Kqlmagic<jupyter_output><empty_output><jupyter_text>If you need any help for kql magic     --> %kql --help "help" -popup_windowIf you need any help for Log Analytics --> %kql --help "LogAnalytics"  3. Log into Log Analytics<jupyter_code>%kql loganalytics://code;workspace=workspace_id;tenant=tenant_id;alias="asidb"<jupyter_output><empty_output><jupyter_text>4. Get a list of available data tables from Log Analytics 1. Tables with records<jupyter_code>%kql search * | summarize count() by Type<jupyter_output><empty_output><jupyter_text>2. All Tables in drop down<jupyter_code>import ipywidgets as widgets
from IPython.display import display
dbSchema = %kql --schema "asidb@loganalytics"
tables = list(dbSchema.keys())
selectedTable = widgets.Dropdown(options=tables, value=tables[24],description='Data Table:')
display(selectedTable)<jupyter_output><empty_output><jupyter_text>5. Run a simple Kusto query<jupyter_code>%kql SecurityEvent | take 5 | project Account, Computer
df = _kql_raw_result_.to_dataframe()
df<jupyter_output><empty_output>
{'fraction_non_alphanumeric': 0.12732520846696602, 'fraction_numerical': 0.011545862732520847, 'mean_word_length': 5.484407484407485, 'pattern_counts': {'":': 0, '<': 25, '<?xml version=': 0, '>': 27, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'chain_length': '6', 'dir': 'jupyter-structured-clean-dedup', 'id': '198349', 'license': 'MIT', 'n_tokens_mistral': 974, 'n_tokens_neox': 934, 'n_words': 294, 'path': 'Notebooks/Get Start.ipynb', 'repo_name': 'BY4KK0/Orion', 'size': '3118'}