<jupyter_start><jupyter_text>Guided Investigation - Anomaly Lookup__Notebook Version:__ 1.2.4__Python Version:__ Python 3.6 - AzureML__Required Packages:__ Azure-Sentinel-Utilities__Platforms Supported:__  Azure Machine Learning Notebooks     __Data Source Required:__ Log Analytics tables      DescriptionGain insights into the possible root cause of an alert by searching for related anomalies on the corresponding entities around the alert’s time. This notebook will provide valuable leads for an alert’s investigation, listing all suspicious increase in event counts or their properties around the time of the alert, and linking to the corresponding raw records in Log Analytics for the investigator to focus on and interpret.You may need to select Python 3.6 - AzureML on Azure Machine Learning Notebooks. Table of Contents1. Initialize Azure Resource Management Clients2. Looking up for anomaly entities  1. Initialize Azure Resource Management Clients<jupyter_code># only run once
!pip install --upgrade Azure-Sentinel-Utilities
# Set variables from config.json
from SentinelWidgets import WidgetViewHelper
from SentinelUtils import ConfigReader
tenant_id, subscription_id, resource_group, workspace_id, workspace_name  = ConfigReader.read_config_values('config.json');
from azure.loganalytics import LogAnalyticsDataClient
from azure.loganalytics.models import QueryBody
from azure.mgmt.loganalytics import LogAnalyticsManagementClient
import SentinelAzure
from SentinelAnomalyLookup import AnomalyFinder, AnomalyLookupViewHelper

from pandas.io.json import json_normalize
import sys
import timeit
import datetime as dt
import pandas as pd
import copy
from IPython.display import HTML
# Authentication to Log Analytics
from azure.common.client_factory import get_client_from_cli_profile
from azure.common.credentials import get_azure_cli_credentials
!az login --tenant $tenant_id
la_client = get_client_from_cli_profile(LogAnalyticsManagementClient, subscription_id = subscription_id)
la = SentinelAzure.azure_loganalytics_helper.LogAnalyticsHelper(la_client)
creds, _ = get_azure_cli_credentials(resource="https://api.loganalytics.io")
la_data_client = LogAnalyticsDataClient(creds)<jupyter_output><empty_output><jupyter_text>2. Looking up for anomaly entities<jupyter_code>import ipywidgets as widgets
#DateTime format: 2019-07-15T07:05:20.000
q_timestamp = widgets.Text(value='2020-07-08',description='DateTime: ')
display(q_timestamp)
#Entity format: computer
q_entity = widgets.Text(value='computer',description='Entity: ')
display(q_entity)
anomaly_lookup = AnomalyFinder(workspace_id, la_data_client)
selected_tables = WidgetViewHelper.select_multiple_tables(anomaly_lookup)
display(selected_tables)
# This action may take a few minutes or more, please be patient.
start = timeit.default_timer()
anomalies, queries = anomaly_lookup.run(q_timestamp.value, q_entity.value, list(selected_tables.value))

if anomalies is not None and len(anomalies) > 0:
    display(anomalies)

print('======= Task completed ===========')
print('Elapsed time: ', timeit.default_timer() - start, ' seconds')

if queries is not None:
    url = WidgetViewHelper.construct_url_for_log_analytics_logs(tenant_id, subscription_id, resource_group, workspace_name)
    print('======= Clicking the URL to go to Log Analytics =======')
    print(url)
    WidgetViewHelper.display_html(WidgetViewHelper.copy_to_clipboard(url, queries, 'Add queries to clipboard then paste to Logs'))
else:
    print('0 records found.')<jupyter_output><empty_output>
{'fraction_non_alphanumeric': 0.07337110481586402, 'fraction_numerical': 0.01076487252124646, 'mean_word_length': 7.025, 'pattern_counts': {'":': 0, '<': 9, '<?xml version=': 0, '>': 10, 'https://': 1, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'chain_length': '2', 'dir': 'jupyter-structured-clean-dedup', 'id': '413953', 'license': 'MIT', 'n_tokens_mistral': 1028, 'n_tokens_neox': 972, 'n_words': 309, 'path': 'Guided Investigation - Anomaly Lookup.ipynb', 'repo_name': 'ASIJupyter/Sentinel', 'size': '3530'}