A Getting Started Guide For Azure Sentinel ML Notebooks.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "source": [
    "# Getting Started with Azure ML Notebooks and Azure Sentinel\r\n",
    "\r\n",
    "---\r\n",
    "\r\n",
    "# Contents\r\n",
    "\r\n",
    "1. Introduction<br><br>\r\n",
    "2. What is a Jupyter notebook?<br>\r\n",
    "   2.1 Using Azure ML notebooks<br>\r\n",
    "   2.2 Running code in notebooks<br><br>\r\n",
    "\r\n",
    "3. Initializing the notebook and MSTICPy<br><br>\r\n",
    "4. Notebook/MSTICPy configuration<br><br>\r\n",
    "   4.1 Configure Azre Sentinel settings<br>\r\n",
    "   4.2 Configure external data providers (VirusTotal and Maxmind GeoLite2)<br>\r\n",
    "   4.3 Configure your Azure Cloud<br>\r\n",
    "   4.4 Validate your settings<br>\r\n",
    "   4.5 Loading and reloading your settings<br><br>\r\n",
    "5. Query data from Azure Sentinel<br>\r\n",
    "   5.1 Load a QueryProvider<br>\r\n",
    "   5.2 Authenticate to your Azure Sentinel Workspace<br>\r\n",
    "   5.3 Authenticate with Azure CLI to cache your credentials<br>\r\n",
    "   5.4 Viewing the Azure Sentinel Schema<br>\r\n",
    "   5.5 Using built-in Azure Sentinel queries<br>\r\n",
    "   5.6 Customizable and custom queries<br><br>\r\n",
    "6. Testing external data providers<br>\r\n",
    "   6.1 Threat intelligence lookup using VirusTotal<br>\r\n",
    "   6.2 IP geo-location lookup with Maxmind GeoLite2<br><br>\r\n",
    "7. Conclusion<br><br>\r\n",
    "8. Further Resources<br><br>\r\n",
    "9. FAQs - Frequently Asked Questions\r\n",
    "\r\n",
    "---\r\n",
    "\r\n",
    "# 1. Introduction\r\n",
    "\r\n",
    "This notebook takes you through the basics needed to get started with Azure Machine Learning (ML) Notebooks and Azure Sentinel.\r\n",
    "\r\n",
    "It focuses on getting things set up and basic steps to query data.\r\n",
    "\r\n",
    "After you've finished running this notebook you can go on to look at the following notebooks:\r\n",
    "\r\n",
    "- **A Tour of Cybersec notebook features** - this takes you through some of the basic\r\n",
    "  features for CyberSec investigation/hunting available to you in notebooks.\r\n",
    "- **Configuring your environment** - this covers all of the configuration options for \r\n",
    "  accessing external cybersec resources\r\n",
    "\r\n",
    "\r\n",
    "Each topic includes 'learn more' sections to provide you with the resource to deep\r\n",
    "dive into each of these topics. We encourage you to work through the notebook from start\r\n",
    "to finish.\r\n",
    "\r\n",
    "<div style=\"color: Black; background-color: Khaki; padding: 5px; font-size: 20px\">\r\n",
    "<p>Please run the the code cells in sequence. Skipping cells will result in errors.</p>\r\n",
    "<div style=\"font-size: 14px\">\r\n",
    "<p>If you encounter any unexpected errors or warnings please see the FAQ at the end of this notebook.</p>\r\n",
    "</div>\r\n",
    "</div>\r\n",
    "\r\n",
    "<hr>"
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "---\r\n",
    "\r\n",
    "# 2. What is a Jupyter notebook?\r\n",
    "\r\n",
    "<div style=\"color: Black; background-color: Gray; padding: 5px; font-size: 15px\">\r\n",
    "If you're familiar with notebooks, skip this section and go to \"3. Initializing\r\n",
    "the notebook and MSTICPy\" section.\r\n",
    "</div>\r\n",
    "<br>\r\n",
    "\r\n",
    "You are currently reading a Jupyter notebook. [Jupyter](http://jupyter.org/) is an interactive\r\n",
    "development and data manipulation environment presented in a browser.\r\n",
    "\r\n",
    "A Jupyter notebook is a document\r\n",
    "made up of cells that contain interactive code, alongside that code's output,\r\n",
    "and other items such as text and images (what you are looking at now is a cell of *Markdown* text).\r\n",
    "\r\n",
    "The name, Jupyter, comes from the core supported programming languages that it supports: **Ju**lia, **Pyt**hon, and **R**.\r\n",
    "While you can use any of these languages (and others such as Powershell) we are going to use Python in this notebook.\r\n",
    "\r\n",
    "The majority of the notebooks on the [Azure Sentinel GitHub repo](https://github.com/Azure/Azure-Sentinel-Notebooks)\r\n",
    "are written in Python. Whilst there are pros, and cons to each language, Python is a well-established\r\n",
    "language that has a large number of materials and libraries well suited for\r\n",
    "data analysis and security investigation, making it ideal for our needs.\r\n",
    "\r\n",
    "To use a Jupyter notebook you need a Jupyter server that will render the notebook and execute the code within it.\r\n",
    "This can take the form of a local [Jupyter installation](https://pypi.org/project/jupyter/),\r\n",
    "or a remotely hosted version such as \r\n",
    "[Azure Machine Learning Notebooks](https://docs.microsoft.com/en-us/azure/machine-learning/how-to-run-jupyter-notebooks). \r\n",
    "\r\n",
    "<details>\r\n",
    "  <summary>Learn more...</summary>\r\n",
    "  <ul>\r\n",
    "    <li><a href=https://infosecjupyterbook.com/introduction.html>The Infosec Jupyter Book</a>\r\n",
    "    has more details on the technical working of Jupyter.\r\n",
    "    </li>\r\n",
    "    <li><a href=https://jupyter.org/documentation>The Jupyter Project documentation</a></li>\r\n",
    "  </ul>\r\n",
    "</details>\r\n",
    "\r\n",
    "<br>\r\n",
    "\r\n"
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "---\r\n",
    "\r\n",
    "## 2.1 Using Azure Machine Learning (ML) Notebooks\r\n",
    "\r\n",
    "If you launched this notebook from Azure Sentinel, you will be running it in an Azure ML workspace.\r\n",
    "By default, the notebook is running in the built-in notebook editor. You can also open\r\n",
    "and run the notebook in Jupyterlab or Jupyter classic, if these environments are more familiar\r\n",
    "to you.\r\n",
    "\r\n",
    "<details>\r\n",
    "  <summary>Learn more...</summary>\r\n",
    "<p>Although you can view a notebook as a static document (GitHub, for example has a built-in\r\n",
    "static notebook renderer), if you want to run the code in a notebook, the notebook\r\n",
    "must be attached to a backend process, know as a Jupyter kernel. The kernel\r\n",
    "is really where your code is being run and where all of variables and objects\r\n",
    "created in the code are held. The browser is just the viewer for this data.\r\n",
    "</p>\r\n",
    "<p>In Azure ML, the kernel runs on a virtual machine known as an Azure ML Compute.\r\n",
    "The Compute instance can support the running of many notebooks simultaneously.</p>\r\n",
    "<p>\r\n",
    "Usually, the creation/attaching of a kernel for your notebook happens\r\n",
    "seamlessly - you don't need to do anything manually. One thing that you\r\n",
    "may need to check (especially if you are getting errors or the notebook\r\n",
    "doesn't seem to be executing) is the version and state of the kernel.</p>\r\n",
    "  <ul>\r\n",
    "    <li><a href=https://realpython.com/jupyter-notebook-introduction/>\r\n",
    "    Installing and running a local Jupyter server\r\n",
    "    </a>\r\n",
    "    </li>\r\n",
    "  </ul>\r\n",
    "</details>\r\n",
    "\r\n",
    "For this notebook we are going to be using Python 3.8 (you can also choose the Python 3.6 kernel).\r\n",
    "\r\n",
    "You can check the kernel name and version is selected by looking at\r\n",
    "the drop down in the top left corner of the Workspace window as shown in\r\n",
    "the image below.\r\n",
    "\r\n",
    "\r\n",
    "\r\n",
    "<img src=\"https://github.com/Azure/Azure-Sentinel-Notebooks/raw/master/images/AML_kernel.png\" height=\"200px\">\r\n",
    "\r\n",
    "This image also shows the active compute instance (to the right).\r\n",
    "\r\n",
    "<img src=\"https://github.com/Azure/Azure-Sentinel-Notebooks/raw/master/images/AML_compute_kernel.png\" height=\"200px\">\r\n",
    "\r\n",
    "\r\n",
    "If the selected kernel does not show `Azure ML Python 3.8` you can select the correct kernel by clicking on the Kernel drop-down.\r\n",
    "\r\n",
    "<p style=\"border: solid; padding: 5pt\"><b>Note</b>: the notebook works with Python 3.6 or later.\r\n",
    "If you are using this notebook in another\r\n",
    "Jupyter environment you can choose any kernel that supports Python 3.6 or later\r\n",
    "</p>\r\n",
    "\r\n",
    "<p style=\"border: solid; padding: 5pt; color: white; background-color: DarkOliveGreen\"><b>Tip:</b>\r\n",
    "Sometimes, your notebook may \"hang\" or you want to just start over.\r\n",
    "To do this you can restart the kernel. Use the \"recycle\" button in the toolbar\r\n",
    "in the upper right of the screen above the notebook.\r\n",
    "<br>\r\n",
    "You will need to re-run any initialization and authentication cells after doing\r\n",
    "this since restarting the kernel wipes all variables and other state.\r\n",
    "</p>\r\n",
    "\r\n",
    "<img src=\"https://github.com/Azure/Azure-Sentinel-Notebooks/raw/master/images/AML_restart_kernel.png\" height=\"200px\">\r\n",
    "\r\n",
    "<br>\r\n",
    "<details>\r\n",
    "  <summary>Troubleshooting...</summary>\r\n",
    "  <p>\r\n",
    "If you are having trouble getting the notebook running you should review\r\n",
    "<a href=https://docs.microsoft.com/en-us/azure/machine-learning/how-to-run-jupyter-notebooks>How to run Juptyer notebooks</a>.\r\n",
    "</p>\r\n",
    "</details>\r\n"
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "---\r\n",
    "\r\n",
    "## 2.2 Running code in notebooks\r\n",
    "\r\n",
    "The **cell** below is a code cell (note that it looks different from the\r\n",
    "cell you are reading). The current cell is known as a *Markdown* cell\r\n",
    "and lets you write text (including HTML) and include static images.\r\n",
    "\r\n",
    "Select the code cell (using mouse or cursor keys) below.\r\n",
    "Once selected, you can execute the code in it by clicking the \"Play\" button in the cell, or by pressing Shift+Enter.\r\n",
    "\r\n",
    "<p style=\"border: solid; padding: 5pt; color: white; background-color: DarkOliveGreen\">\r\n",
    "<b>Tip</b>: You can identify which cells are code cells by selecting them.<br>\r\n",
    "In Azure ML notebooks and VSCode, code cells have a larger border\r\n",
    "on the left side with a \"Play\" button to execute the cell.<br>\r\n",
    "In other notebook environments code and markdown cells will have\r\n",
    "different styles but it's usually easy to distinguish them.\r\n",
    "</p>\r\n"
   ],
   "metadata": {}
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "source": [
    "# This is our first code cell, it contains basic Python code.\r\n",
    "# You can run a code cell by selecting it and clicking\r\n",
    "# the Run button (to the left of the cell), or by pressing Shift + Enter.\r\n",
    "# Any output from the code will be displayed directly below it.\r\n",
    "print(\"Congratulations you just ran this code cell\")\r\n",
    "y = 2 + 2\r\n",
    "print(\"2 + 2 =\", y)"
   ],
   "outputs": [
    {
     "output_type": "stream",
     "name": "stdout",
     "text": [
      "Congratulations you just ran this code cell\n",
      "2 + 2 = 4\n"
     ]
    }
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "Variables set within a code cell persist between cells meaning you can chain cells together.\r\n",
    "In this example we're using the value of y from the previous cell."
   ],
   "metadata": {}
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "source": [
    "# Note that output from the last line of a cell is automatically\r\n",
    "# sent to the output cell, without needing the print() function.\r\n",
    "y + 2"
   ],
   "outputs": [
    {
     "output_type": "execute_result",
     "data": {
      "text/plain": [
       "6"
      ]
     },
     "metadata": {},
     "execution_count": 2
    }
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "Now that you understand the basics we can move onto more complex code.\r\n",
    "\r\n",
    "\r\n",
    "<details>\r\n",
    "  <summary>Learn more about notebooks...</summary>\r\n",
    "  <ul>\r\n",
    "    <li><a href=https://infosecjupyterbook.com/>The Infosec Jupyter Book</a>\r\n",
    "    provides an infosec-specific intro to Python.\r\n",
    "    </li>\r\n",
    "    <li><a href=https://realpython.com/>Real Python</a>\r\n",
    "    is a comprehensive set of Python learnings and tutorials.</li>\r\n",
    "  <ul>\r\n",
    "\r\n",
    "</details>\r\n"
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "---\r\n",
    "\r\n",
    "# 3. Initializing the notebook and MSTICPy\r\n",
    "\r\n",
    "To avoid having to type (or paste) a lot of complex and repetitive code into\r\n",
    "notebook cells, most notebooks rely on third party libraries (known in the Python\r\n",
    "world as \"packages\").\r\n",
    "\r\n",
    "Before you can use a package in your notebook, you need to do two things:\r\n",
    "\r\n",
    "- install the package (although the Azure ML Compute has most common packages pre-installed)\r\n",
    "- import the package (or some part of the package - usually a module/file, a function or a class)\r\n",
    "\r\n",
    "## MSTICPy\r\n",
    "\r\n",
    "We've created a Python package built for Azure Sentinel notebooks - named MSTICPy (pronounced miss-tick-pie).\r\n",
    "It is a collection of CyberSecurity tools for data retrieval, analysis, enrichment and visualization.\r\n",
    "\r\n",
    "## Intializing notebooks\r\n",
    "\r\n",
    "At the start of most Azure Sentinel notebooks you will see an initialization cell like the one below.\r\n",
    "This cell is specific to the MSTICPy initialization:\r\n",
    "\r\n",
    "- it defines the minimum versions for Python and MSTICPy needed for this notebook\r\n",
    "- it then imports and runs the `init_notebook` function.\r\n",
    "\r\n",
    "<details>\r\n",
    "    <summary>More about <i>init_notebook</i>...</summary>\r\n",
    "    <p>\r\n",
    "`init_notebook` does some of the tedious work of importing other packages, \r\n",
    "checking configuration (we'll get to configuration in a moment) and, optionally,\r\n",
    "installing other required packages.</p>\r\n",
    "</details>\r\n",
    "<br>\r\n",
    "\r\n",
    "<div style=\"bor der: solid; padding: 5pt\">\r\n",
    "<b>Note:</b>don't be alarmed if you see configuration warnings (such as \"Missing msticpyconfig.yaml\").<br>\r\n",
    "We haven't configured anything yet, so this is expected.\r\n",
    "</div>\r\n",
    "\r\n",
    "The first line ensures that the latest version of msticpy is installed."
   ],
   "metadata": {}
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "source": [
    "# import some modules needed in this cell\r\n",
    "from IPython.display import display, HTML\r\n",
    "\r\n",
    "REQ_PYTHON_VER=\"3.6\"\r\n",
    "REQ_MSTICPY_VER=\"1.4.3\"\r\n",
    "\r\n",
    "display(HTML(\"Checking upgrade to latest msticpy version\"))\r\n",
    "%pip install --upgrade --quiet msticpy[azuresentinel]>=$REQ_MSTICPY_VER\r\n",
    "\r\n",
    "# initialize msticpy\r\n",
    "from msticpy.nbtools import nbinit\r\n",
    "nbinit.init_notebook(\r\n",
    "    namespace=globals(),\r\n",
    "    extra_imports=[\"urllib.request, urlretrieve\"]\r\n",
    ")\r\n",
    "pd.set_option(\"display.html.table_schema\", False)"
   ],
   "outputs": [
    {
     "output_type": "display_data",
     "data": {
      "text/html": [
       "Checking upgrade to latest msticpy version"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "stream",
     "name": "stdout",
     "text": [
      "Note: you may need to restart the kernel to use updated packages.\n"
     ]
    },
    {
     "output_type": "display_data",
     "data": {
      "text/html": [
       "<hr><h4>Starting Notebook initialization...</h4>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "display_data",
     "data": {
      "text/html": [
       "msticpy version installed: 1.4.1 latest published: 1.4.1<br>Latest version is installed.<br> <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "display_data",
     "data": {
      "text/html": [
       "Processing imports.... <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "display_data",
     "data": {
      "text/html": [
       "Imported: pd (pandas), IPython.get_ipython, IPython.display.display, IPython.display.HTML, IPython.display.Markdown, widgets (ipywidgets), pathlib.Path, plt (matplotlib.pyplot), matplotlib.MatplotlibDeprecationWarning, sns (seaborn), np (numpy), msticpy, msticpy.data.QueryProvider, msticpy.nbtools.foliummap.FoliumMap, msticpy.common.utility.md, msticpy.common.utility.md_warn, msticpy.common.wsconfig.WorkspaceConfig, msticpy.datamodel.pivot.Pivot, msticpy.datamodel.entities, msticpy.vis.mp_pandas_plot, urllib.request.urlretrieve <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "display_data",
     "data": {
      "text/html": [
       "Checking configuration.... <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "display_data",
     "data": {
      "text/html": [
       "Setting notebook options.... <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "display_data",
     "data": {
      "text/html": [
       " <br>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "display_data",
     "data": {
      "text/html": [
       "<h4>Notebook initialization complete</h4>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {}
    }
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "---\r\n",
    "\r\n",
    "# 4. Notebook/MSTICPy Configuration\r\n",
    "\r\n",
    "Once we've done this basic initialization step,\r\n",
    "we need to make sure we have some configuration in place.\r\n",
    "\r\n",
    "Some of the notebook components need addtional configuration to connect our Azure Sentinel workspace\r\n",
    "as well as to external services (e.g. API keys to retrieve Threat Intelligence data). \r\n",
    "\r\n",
    "The easiest way to manage the configuration data for these services is to store it in a \r\n",
    "configuration file (`msticpyconfig.yaml`).<br>\r\n",
    "The alternative to this is having to type\r\n",
    "configuration details and keys in each time you use a notebook - which is\r\n",
    "guaranteed to put you off notebooks forever!\r\n",
    "\r\n",
    "<details>\r\n",
    "  <summary>Learn more...</summary>\r\n",
    "  <p>\r\n",
    "  Although you don't need to know these details now, you can find more information here:\r\n",
    "  </p>\r\n",
    "  <ul>\r\n",
    "    <li><a href=https://msticpy.readthedocs.io/en/latest/getting_started/msticpyconfig.html >MSTICPy Package Configuration</a></li>\r\n",
    "    <li><a href=https://msticpy.readthedocs.io/en/latest/getting_started/SettingsEditor.html >MSTICPy Settings Editor</a></li>\r\n",
    "  </ul>\r\n",
    "  <p>If you need a more complete walk-through of configuration, we have a separate notebook to help you:</p>\r\n",
    "  <ul>\r\n",
    "    <li><a href=https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/ConfiguringNotebookEnvironment.ipynb >Configuring Notebook Environment</a></li>\r\n",
    "    <li>And for the ultimate walk-through of how to configure all your `msticpyconfig.yaml` settings\r\n",
    "  see the <a href=https://github.com/microsoft/msticpy/blob/master/docs/notebooks/MPSettingsEditor.ipynb >MPSettingsEditor notebook</a></li>\r\n",
    "    <li>The Azure-Sentinel-Notebooks GitHub repo also contains an template `msticpyconfig.yaml`, with commented-out sections\r\n",
    "  that may also be helpful in finding your way around the settings if you want to dig into things\r\n",
    "  by hand.</li>\r\n",
    "  </ul>\r\n",
    "</details>\r\n",
    "<br>\r\n",
    "\r\n",
    "---"
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "## 4.1 Configuring Azure Sentinel settings\r\n",
    "\r\n",
    "When you launched this notebook from Azure Sentinel it copied a basic configuration file - `config.json` -\r\n",
    "to your workspace folder.<br>\r\n",
    "You should be able to see this file in the file browser to the left.<br>\r\n",
    "This file contains details about your Azure Sentinel workspace but has\r\n",
    "no configuration settings for other external services that we need.\r\n",
    "\r\n",
    "If you didn't have a `msticpyconfig.yaml` file in your workspace folder (which is likely\r\n",
    "if this is your first use of notebooks), the `init_notebook` function should have created\r\n",
    "one for you and populated it\r\n",
    "with the Azure Sentinel workspace data taken from your config.json.\r\n",
    "\r\n",
    "<p style=\"border: solid; padding: 5pt; color: white; background-color: DarkOliveGreen\"><b>Tip:</b>\r\n",
    "If you do not see a \"msticpyconfig.yaml\" file in your user folder, click the refresh button<br>\r\n",
    "at the top of the file browser.\r\n",
    "</p>\r\n",
    "\r\n",
    "We can check this now by opening the settings editor and view the settings.\r\n",
    "\r\n",
    "<div style=\"color: Black; background-color: Khaki; border: solid; padding: 5pt;\"><b>\r\n",
    "You should not have to change anything here unless you need to add\r\n",
    "one or more additional workspaces.</b></div>\r\n",
    "<p/>\r\n",
    "<p style=\"border: solid; padding: 5pt\"><b>Note:</b>\r\n",
    "In the Azure ML environment, the settings editor may take 10-20 seconds to appear.<br>\r\n",
    "This is a known bug that we are working to fix.\r\n",
    "</p>\r\n",
    "\r\n",
    "When you have verified that this looks OK. Click **Save Settings**\r\n",
    "\r\n",
    "\r\n",
    "<details>\r\n",
    "    <summary>Multiple Azure Sentinel workspaces...</summary>\r\n",
    "    <p>If you have multiple Azure Sentinel workspaces, you can add\r\n",
    "    them in the following configuration cell.</p>\r\n",
    "    <p>You can choose to keep one as the default or just delete this entry\r\n",
    "    if you always want to name your workspaces explicitly when you \r\n",
    "    connect.\r\n",
    "    </p>\r\n",
    "</details>"
   ],
   "metadata": {}
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "source": [
    "from msticpy.config import MpConfigEdit\r\n",
    "import os\r\n",
    "\r\n",
    "mp_conf = \"msticpyconfig.yaml\"\r\n",
    "\r\n",
    "# check if MSTICPYCONFIG is already an env variable\r\n",
    "mp_env = os.environ.get(\"MSTICPYCONFIG\")\r\n",
    "mp_conf = mp_env if mp_env and Path(mp_env).is_file() else mp_conf\r\n",
    "\r\n",
    "if not Path(mp_conf).is_file():\r\n",
    "    print(\r\n",
    "        \"No msticpyconfig.yaml was found!\",\r\n",
    "        \"Please check that there is a config.json file in your workspace folder.\",\r\n",
    "        \"If this is not there, go back to the Azure Sentinel portal and launch\",\r\n",
    "        \"this notebook from there.\",\r\n",
    "        sep=\"\\n\"\r\n",
    "    )\r\n",
    "else:\r\n",
    "    mpedit = MpConfigEdit(mp_conf)\r\n",
    "    mpedit.set_tab(\"AzureSentinel\")\r\n",
    "    display(mpedit)"
   ],
   "outputs": [
    {
     "output_type": "display_data",
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "29271a8ee0ae40368d8e0730fcbcfdaa",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "VBox(children=(Tab(children=(VBox(children=(Label(value='Azure Sentinel workspace settings'), HBox(children=(VÃ¢â‚¬Â¦"
      ]
     },
     "metadata": {}
    }
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "At this stage you should only see two entries in the Azure Sentinel tab:\r\n",
    "\r\n",
    "- An entry with the name of your Azure Sentinel workspace\r\n",
    "- An entry named \"Default\" with the same settings.\r\n",
    "\r\n",
    "MSTICPy lets you store configurations for multiple Azure Sentinel workspaces\r\n",
    "and switch between them. The \"Default\" entry lets you authenticate\r\n",
    "to a specific workspace without having to name it explicitly.\r\n",
    "\r\n",
    "Let's add some additional configuration."
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "## 4.2 Configure external data providers (VirusTotal and Maxmind GeoLite2)\r\n",
    "\r\n",
    "We are going to use [VirusTotal](https://www.virustotal.com) (VT) as an example of a popular threat intelligence source.\r\n",
    "To use VirusTotal threat intel lookups you will need a VirusTotal account and API key.\r\n",
    "\r\n",
    "You can sign up for a free account at the\r\n",
    "[VirusTotal getting started page](https://developers.virustotal.com/v3.0/reference#getting-started) website.\r\n",
    "\r\n",
    "If you are already a VirusTotal user, you can, of course, use your existing key.\r\n",
    "\r\n",
    "<p style=\"border: solid; padding: 5pt; color: black; background-color: Khaki\">\r\n",
    "<b>Warning</b> If you are using a VT enterprise key we do not recommend storing this\r\n",
    "in the msticpyconfig.yaml file.<br>\r\n",
    "MSTICPy supports storage of secrets in\r\n",
    "Azure Key Vault. You can read more about this\r\n",
    "<a href=https://msticpy.readthedocs.io/en/latest/getting_started/msticpyconfig.html#specifying-secrets-as-key-vault-secrets >in the MSTICPY docs</a><br>\r\n",
    "For the moment, you can sign up for a free acount, until you can take the time to\r\n",
    "set up Key Vault storage.\r\n",
    "</p>\r\n",
    "\r\n",
    "\r\n",
    "As well as VirusTotal, we also support a range\r\n",
    "of other threat intelligence providers: https://msticpy.readthedocs.io/en/latest/data_acquisition/TIProviders.html\r\n",
    "<br><br>\r\n",
    "\r\n",
    "To add the VirusTotal details, run the following cell.\r\n",
    "\r\n",
    "1. Select \"VirusTotal\" from the **Add prov** drop down\r\n",
    "2. Click the **Add** button\r\n",
    "3. In the left-side Details panel select **Text** as the Storage option.\r\n",
    "4. Paste the API key in the **Value** text box.\r\n",
    "5. Click the **Update** button to confirm your changes.\r\n",
    "\r\n",
    "Your changes are not yet saved to your configuration file. To\r\n",
    "do this, click on the **Save Settings** button at the bottom of the dialog.\r\n",
    "\r\n",
    "If you are unclear about what anything in the configuration editor means, use the **Help** drop-down. This\r\n",
    "has instructions and links to more detailed documentation.\r\n"
   ],
   "metadata": {}
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "source": [
    "mpedit.set_tab(\"TI Providers\")\r\n",
    "mpedit"
   ],
   "outputs": [
    {
     "output_type": "display_data",
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "82db8a782ad143408aa5f9dc304aa349",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "VBox(children=(Tab(children=(VBox(children=(Label(value='Azure Sentinel workspace settings'), HBox(children=(VÃ¢â‚¬Â¦"
      ]
     },
     "metadata": {}
    }
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "Our notebooks commonly use IP geo-location information. \n",
    "In order to enable this we are going to set up [MaxMind GeoLite2](https://www.maxmind.com)\n",
    "to provide geolocation lookup services for IP addresses.\n",
    "\n",
    "GeoLite2 uses a downloaded database which requires an account key to download.\n",
    "You can sign up for a free account and a license key at \n",
    "[The Maxmind signup page - https://www.maxmind.com/en/geolite2/signup](https://www.maxmind.com/en/geolite2/signup).\n",
    "<br>\n",
    "\n",
    "<details>\n",
    "    <summary>Using IPStack as an alernative to GeoLite2...</summary>\n",
    "    <p>\n",
    "    For more details see the\n",
    "    <a href=https://msticpy.readthedocs.io/en/latest/data_acquisition/GeoIPLookups.html >\n",
    "    MSTICPy GeoIP Providers documentation</a>\n",
    "    </p>\n",
    "</details>\n",
    "<br>\n",
    "\n",
    "Once, you have an account, run the following cell to add the Maxmind GeopIP Lite details to your configuration.\n",
    "\n",
    "The procedure is similar to the one we used for VirusTotal:\n",
    "\n",
    "1. Select the \"GeoIPLite\" provider from the **Add prov** drop-down\n",
    "2. Click **Add**\n",
    "3. Select **Text** Storage and paste the license (API/Auth) key into the text box\n",
    "4. Click **Update**\n",
    "5. Click **Save Settings** to write your settings to your configuration.\n"
   ],
   "metadata": {}
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "source": [
    "mpedit.set_tab(\"GeoIP Providers\")\r\n",
    "mpedit"
   ],
   "outputs": [
    {
     "output_type": "display_data",
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "8ac582d4f4f34bf1baa526901f67aafd",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "VBox(children=(Tab(children=(VBox(children=(Label(value='Azure Sentinel workspace settings'), HBox(children=(VÃ¢â‚¬Â¦"
      ]
     },
     "metadata": {}
    }
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "## 4.3 Configure your Azure Cloud\r\n",
    "\r\n",
    "If you are running in a sovereign or government cloud (i.e. not the Azure global cloud)\r\n",
    "you must set up Azure functions to use the correct authentication and\r\n",
    "resource management authorities.\r\n",
    "\r\n",
    "<p style=\"border: solid; padding: 5pt\"><b>Note:</b>\r\n",
    "This is not required if using the Azure Global cloud (most common).<br>\r\n",
    "If the domain of your Azure Sentinel or Azure Machine learning does\r\n",
    "not end with '.azure.com' you should set the appropriate cloud\r\n",
    "for your organization\r\n",
    "</p>"
   ],
   "metadata": {}
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "source": [
    "mpedit.set_tab(\"Azure\")\r\n",
    "mpedit"
   ],
   "outputs": [
    {
     "output_type": "display_data",
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "82db8a782ad143408aa5f9dc304aa349",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "VBox(children=(Tab(children=(VBox(children=(Label(value='Azure Sentinel workspace settings'), HBox(children=(VÃ¢â‚¬Â¦"
      ]
     },
     "metadata": {}
    }
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "## 4.4 Validate your settings\r\n",
    "\r\n",
    "- click on the **Validate settings** button.\r\n",
    "\r\n",
    "You may see some warnings about missing sections but not about the Azure Sentinel, TIProviders or GeoIP Providers settings.\r\n",
    "\r\n",
    "Click on the **Close** button to hide the validation output.\r\n",
    "\r\n",
    "If you need to make any changes as a result of the Validation,\r\n",
    "remember to save your changes by clicking the **Save File** button."
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "## 4.5 Loading and re-loading your saved settings\r\n",
    "\r\n",
    "<h3 stylecolor: Black; background-color: Khaki;i; padding: 5px\">\r\n",
    "Although your settings are saved they are not yet loaded into MSTICPy. Please run the next cell.</h3>\r\n",
    "<hr>\r\n",
    "\r\n",
    "You have saved your settings to a \"msticpyconfig.yaml\" file on disk. This file<br>\r\n",
    "is a YAML file so is easy to read with a text editor.<br>\r\n",
    "However, MSTICPy does not automatically reload these settings.\r\n",
    "\r\n",
    "Run the following cell to force it to reload from the new configuration file.\r\n"
   ],
   "metadata": {}
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "source": [
    "import msticpy\r\n",
    "msticpy.settings.refresh_config()"
   ],
   "outputs": [],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "\r\n",
    "<details>\r\n",
    "    <summary>Optional - set a MSTICPYCONFIG environment variable...</summary>\r\n",
    "\r\n",
    "Setting a `MSTICPYCONFIG` environment variable to point to the location of your\r\n",
    "your `msticpyconfig.yaml` configuration file lets MSTICPy find this file. By\r\n",
    "default, it looks in the current directory only.\r\n",
    "\r\n",
    "Having a MSTICPYCONFIG variable set is especially convenient if you are\r\n",
    "using notebooks locally or have a deep or complex folder structure\r\n",
    "\r\n",
    "<b>You may not need this on Azure ML</b> - the\r\n",
    "`nb_check` script (in the initialization cell) will automatically set the MSTICPYCONFIG\r\n",
    "environment variable if it is not already set. The script will try to find a\r\n",
    "`msticpyconfig.yaml` in the current directory or in the root of your AML user folder.\r\n",
    "\r\n",
    "For more detailed instructions on this, please see the *Setting the path to your msticpyconfig.yaml* section\r\n",
    "in the <a href=https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/ConfiguringNotebookEnvironment.ipynb >Configuring Notebook Environment</a>.\r\n",
    "\r\n",
    "<p style=\"border: solid; padding: 5pt; color: black; background-color: #AA4000\">\r\n",
    "<b>Warning</b>: If you are storing secrets such as API keys in the file you should<br>\r\n",
    "probably opt to store either store this file on the compute instance or use<br.>\r\n",
    "Azure Key Vault to store the secrets.<br>\r\n",
    "Read more about using KeyVault\r\n",
    "<a href=https://msticpy.readthedocs.io/en/latest/getting_started/msticpyconfig.html#specifying-secrets-as-key-vault-secrets >in the MSTICPY docs</a>\r\n",
    "</p>\r\n",
    "\r\n",
    "</details>\r\n"
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "---\r\n",
    "\r\n",
    "# 5. Querying Data from Azure Sentinel\r\n",
    "\r\n",
    "Now that we have configured the details for your Azure Sentinel workspace, \r\n",
    "we can go ahead and test it. We will do this with `QueryProvider` class from MSTICPy.\r\n",
    "\r\n",
    "The QueryProvider class has one main function:\r\n",
    "\r\n",
    "- querying data from a data source to make it available to view and analyze in the notebook.\r\n",
    "\r\n",
    "Query results are always returned as *pandas* DataFrames. If you are new\r\n",
    "to using *pandas* look at the **Introduction to Pandas** section at in\r\n",
    "the **A Tour of Cybersec notebook features** notebook.\r\n",
    "\r\n",
    "<details>\r\n",
    "    <summary>Other data sources...</summary>\r\n",
    "    <p>\r\n",
    "    The query provider supports several different data sources - the one we'll use\r\n",
    "here is \"AzureSentinel\".</p>\r\n",
    "<p>\r\n",
    "Other data sources supported by the `QueryProvider` class include Microsoft Defender for Endpoint,\r\n",
    "Splunk, Microsoft Graph API, Azure Resource Graph but these are not covered here.\r\n",
    "    </p>\r\n",
    "</details>\r\n",
    "<br>\r\n",
    "\r\n",
    "Most query providers come with a range of built-in queries\r\n",
    "for common data operations. You can also a query provider to run custom queries against\r\n",
    "Azure Sentinel data.\r\n",
    "\r\n",
    "Once you've loaded a QueryProvider you'll normally need to authenticate\r\n",
    "to the data source (in this case Azure Sentinel).\r\n",
    "\r\n",
    "<details>\r\n",
    "    <summary><b>Learn more...</b></summary>\r\n",
    "    <p>\r\n",
    "    More details on configuring and using QueryProviders:\r\n",
    "    </p>\r\n",
    "    <ul>\r\n",
    "        <li>\r\n",
    " <a href=https://msticpy.readthedocs.io/en/latest/data_acquisition/DataProviders.html#instantiating-a-query-provider >MSTICPy Documentation</a>.</li>\r\n",
    "    </ul>\r\n",
    "</details>\r\n",
    "<br>\r\n"
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "## 5.1 Load a QueryProvider\r\n",
    "To start, we are going to load up a QueryProvider\r\n",
    "for Azure Sentinel, pass it the \r\n",
    "details for our workspace that we just stored in the msticpyconfig file, and connect.\r\n",
    "\r\n",
    "<div style=\"border: solid; padding: 5pt\"><b>Note:</b>\r\n",
    "If you see a warning \"Runtime dependency of PyGObject is missing\" when loading the<br>\r\n",
    "Azure Sentinel driver, please see the FAQ section at the end of this notebook.<br>\r\n",
    "The warning does not impact any functionality of the notebooks.\r\n",
    "</div>"
   ],
   "metadata": {}
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "source": [
    "# Initalize a QueryProvider for Azure Sentinel\r\n",
    "qry_prov = QueryProvider(\"AzureSentinel\")"
   ],
   "outputs": [
    {
     "output_type": "stream",
     "name": "stdout",
     "text": [
      "Please wait. Loading Kqlmagic extension...done\n"
     ]
    }
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "## 5.2 Authenticate to the Azure Sentinel workspace\r\n",
    "\r\n",
    "Next we need to authenticate The code cell immediately following this section\r\n",
    "will start the authentication process. e.When you run the cell it will trigger an Azure authentication sequence.\r\n",
    "\r\n",
    "\r\n",
    "The connection process will ask us to authenticate to our Azure Sentinel workspace using \r\n",
    "[device authorization](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code)\r\n",
    "with our Azure credentials.\r\n",
    "\r\n",
    "Device authorization adds an additional factor to the authentication by generating a\r\n",
    "one-time device code that you supply as part of the authentication process.\r\n",
    "\r\n",
    "The process is as follows:\r\n",
    "\r\n",
    "1. generate and display an device code\r\n",
    "\r\n",
    "<img src=\"https://github.com/Azure/Azure-Sentinel-Notebooks/raw/master/images/device_auth_code.png\" height=\"300px\">\r\n",
    "\r\n",
    "In some Jupyter notebook interfaces, step 1 has a clickable button that will copy the code to the clipboard\r\n",
    "and then open a browser window to the devicelogin URI.<br>The default AML notebook interface does not\r\n",
    "do this. You need to manually select and copy the code to the clipboard, then click on the devicelogin link\r\n",
    "where you can paste the code in to start the authentication process.\r\n",
    "\r\n",
    "2. go to http://microsoft.com/devicelogin and paste in the code\r\n",
    "3. authenticate with your Azure credentials\r\n",
    "\r\n",
    "<p style=\"border: sols:id; <br>\r\n",
    "1. Tdding: 5pt\"><b>Note:</b> the devicelogin URL may be different for government <br>\r\n",
    "2. You must use an account that has permissions to the Azure Sentinel workspace.<br>\r\n",
    "(<b>Azure Sentinel Reader</b> or <b>Log Analytics Reader</b>)\r\n",
    "or national Azure clouds.</p>\r\n",
    "\r\n",
    "<br>\r\n",
    "\r\n",
    "<img src=\"https://github.com/Azure/Azure-Sentinel-Notebooks/raw/master/images/device_authn.png\" height=\"300px\">\r\n",
    "\r\n",
    "4. Once the last box in the previous image is shown you can close that tab and return to the notebook. \r\n",
    "   You should see an image like the one shown below.\r\n",
    "\r\n",
    "<img src=\"https://github.com/Azure/Azure-Sentinel-Notebooks/raw/master/images/device_auth_complete.png\" height=\"300px\">\r\n",
    "\r\n",
    "<br>\r\n"
   ],
   "metadata": {}
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "source": [
    "# Get the Azure Sentinel workspace details from msticpyconfig\r\n",
    "# Loading WorkspaceConfig with no parameters will use the details\r\n",
    "# of your \"Default\" workspace (see the Configuring Azure Sentinel settings section earlier)\r\n",
    "# If you want to connect to a specific workspace use this syntax:\r\n",
    "#    ws_config = WorkspaceConfig(workspace=\"WorkspaceName\")\r\n",
    "# ('WorkspaceName' should be one of the workspaces defined in msticpyconfig.yaml)\r\n",
    "ws_config = WorkspaceConfig()\r\n",
    " \r\n",
    "# Connect to Azure Sentinel with our QueryProvider and config details\r\n",
    "qry_prov.connect(ws_config)"
   ],
   "outputs": [
    {
     "output_type": "stream",
     "name": "stdout",
     "text": [
      "Connecting... "
     ]
    },
    {
     "output_type": "display_data",
     "data": {
      "text/html": [
       "<!DOCTYPE html>\n",
       "            <html><body>\n",
       "            <div style=''>\n",
       "            <a href='file:///e:/src/Azure-Sentinel-Notebooks/kqlmagic/temp_files/c076299c-9c93-4b62-8746-9c95ec999d86/_8ecf8077-cf51-4820-aadd-14040956f35d_at_loganalytics_schema.html' style='padding: 2px 6px 2px 6px; color: #333333; background-color: #EEEEEE; border-top: 1px solid #CCCCCC; border-right: 1px solid #333333; border-bottom: 1px solid #333333; border-left: 1px solid #CCCCCC' target='_8ecf8077-cf51-4820-aadd-14040956f35d_at_loganalytics_schema'>popup schema 8ecf8077-cf51-4820-aadd-14040956f35d@loganalytics</a>\n",
       "            </div>\n",
       "            </body></html>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "stream",
     "name": "stdout",
     "text": [
      "connected\n"
     ]
    }
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "## 5.3 Authenticating with Azure CLI to cache your logon credentials\r\n",
    "\r\n",
    "Normally, you may need to re-authenticate if you restart the kernel in the current notebook.\r\n",
    "You also have to authenticate again if you open another notebook.\r\n",
    "\r\n",
    "You can avoid this by using Azure CLI to create a cached logon on the AML compute (this is described\r\n",
    "in the FAQ section at the end of the notebook).<br>\r\n",
    "\r\n",
    "<div style=\"border: solid; padding: 5pt; color: white; background-color: DarkOliveGreen\"><b>Tip:</b>\r\n",
    "This also works with other types of Jupyter hub: for example, if you are running the\r\n",
    "Jupyter server on your local computer or using another remote Jupyter server.<br>\r\n",
    "</div>\r\n",
    "<p>\r\n",
    "The Azure CLI\r\n",
    "logon has to be performed on the system where your Jupyter server is running. If\r\n",
    "you are using a remote Jupyter server, you can do this by opening a terminal\r\n",
    "and running <pre>az login</pre> on the remote machine.</p>\r\n",
    "More, simply you can create an empty cell in a notebook and run\r\n",
    "<pre>!az login</pre><br>\r\n",
    "Azure CLI must be installed on the system where your Jupyter server is running.\r\n",
    "\r\n",
    "This information is also available in a \r\n",
    "[Wiki article](https://github.com/Azure/Azure-Sentinel-Notebooks/wiki/Caching-credentials-with-Azure-CLI)\r\n",
    "\r\n",
    "The Azure CLI logon will cache the token even if you restart kernel.<AML br>\r\n",
    "This <i>refresh token</i> is cached on the compute (Jupyter server)\r\n",
    "and can be re-used until it times out.<br>\r\n",
    "You will need to re-authenticate if you restart your compute instance/\r\n",
    "Jupyter server or switch to a different compute/server.\r\n",
    "\r\n",
    "You can try this by uncommenting the line in the cell below and running it."
   ],
   "metadata": {}
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "source": [
    "#!az login\r\n"
   ],
   "outputs": [],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "## 5.4 Viewing the Azure Sentinel workspace data schema\r\n",
    "\r\n",
    "You can use the schema to help understand what data is available to query.<br>\r\n",
    "\r\n",
    "This also works as a quick test to ensure that you've authenticated successfully\r\n",
    "to your Azure Sentinel workspace.\r\n",
    "\r\n",
    "The AzureSentinel QueryProvider has a `schema_tables` property that lets us get a list of tables.\r\n",
    "It also has the `schema` property which returns a dictionary of \\<table_name, column_schema\\>.\r\n",
    "For each table the column names and data types are shown.\r\n",
    "\r\n",
    "<p style=\"border: solid; padding: 5pt\"><b>Note:</b>\r\n",
    "If you see an error here, make sure that you ran the previous cells in this\r\n",
    "section and that your authentication succeeded.\r\n",
    "</p>"
   ],
   "metadata": {}
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "source": [
    "# Get list of tables in our Workspace with the 'schema_tables' property\r\n",
    "print(\"Sample of first 10 tables in the schema\")\r\n",
    "qry_prov.schema_tables[:10]  # We are outputting only a sample of tables for brevity\r\n",
    "                              # remove the \"[:10]\" to see the whole list\r\n"
   ],
   "outputs": [
    {
     "output_type": "stream",
     "name": "stdout",
     "text": [
      "Sample of first 10 tables in the schema\n"
     ]
    },
    {
     "output_type": "execute_result",
     "data": {
      "text/plain": [
       "['AACAudit',\n",
       " 'AACHttpRequest',\n",
       " 'AADDomainServicesAccountLogon',\n",
       " 'AADDomainServicesAccountManagement',\n",
       " 'AADDomainServicesDirectoryServiceAccess',\n",
       " 'AADDomainServicesLogonLogoff',\n",
       " 'AADDomainServicesPolicyChange',\n",
       " 'AADDomainServicesPrivilegeUse',\n",
       " 'AADDomainServicesSystemSecurity',\n",
       " 'AADManagedIdentitySignInLogs']"
      ]
     },
     "metadata": {},
     "execution_count": 6
    }
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "## 5.5 Using built-in Azure Sentinel queries in MSTICPy\r\n",
    "\r\n",
    "MSTICPy includes a number of built-in queries that you can run.\r\n",
    "\r\n",
    "Each query is a function (or method) that's a member of the\r\n",
    "`QueryProvider` object that you loaded earlier. Notice, in\r\n",
    "the list of queries below, each query has a two-part name, separated\r\n",
    "by a dot. The first part is a container name that helps to group\r\n",
    "the queries in related sets. The second part (after the dot) is the\r\n",
    "name of the query function itself.\r\n",
    "\r\n",
    "You run a\r\n",
    "query by specifying the name of the `QueryProvider` instance,\r\n",
    "followed by the fully-qualified name (i.e. container_name + \".\" + query_name),\r\n",
    "followed by a set of parentheses. For example:\r\n",
    "\r\n",
    "```Python\r\n",
    "qry_prov.Azure.get_vmcomputer_for_host(host_name=\"my-computer\")\r\n",
    "```\r\n",
    "\r\n",
    "Inside the parentheses is where you specify parameters to the query\r\n",
    "(nearly all queries require one or more parameters).\r\n",
    "\r\n",
    "List available queries with the QueryProvider `.list_queries()` function<br>\r\n",
    "and get specific details about a query, and its required and optional\r\n",
    "parameters by running the query function with \"?\" as the only parameter."
   ],
   "metadata": {}
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "source": [
    "# Get a sample of available queries\r\n",
    "print(\"Sample of queries\")\r\n",
    "print(\"=================\")\r\n",
    "print(qry_prov.list_queries()[::5])  # showing a sample - remove \"[::5]\" for whole list\r\n",
    "\r\n",
    "# Get help about a query by passing \"?\" as a parameter\r\n",
    "print(\"\\nHelp for 'list_all_signins_geo' query\")\r\n",
    "print(\"=====================================\")\r\n",
    "qry_prov.Azure.list_all_signins_geo(\"?\")"
   ],
   "outputs": [
    {
     "output_type": "stream",
     "name": "stdout",
     "text": [
      "Sample of queries\n",
      "=================\n",
      "['Azure.get_vmcomputer_for_host', 'Azure.list_azure_activity_for_account', 'AzureNetwork.az_net_analytics', 'AzureNetwork.get_heartbeat_for_ip', 'AzureSentinel.get_bookmark_by_id', 'Heartbeat.get_heartbeat_for_host', 'LinuxSyslog.all_syslog', 'LinuxSyslog.list_logon_failures', 'LinuxSyslog.sudo_activity', 'MultiDataSource.get_timeseries_decompose', 'Network.get_host_for_ip', 'Office365.list_activity_for_ip', 'SecurityAlert.list_alerts_for_ip', 'ThreatIntelligence.list_indicators_by_filepath', 'WindowsSecurity.get_parent_process', 'WindowsSecurity.list_host_events', 'WindowsSecurity.list_hosts_matching_commandline', 'WindowsSecurity.list_other_events']\n",
      "\n",
      "Help for 'list_all_signins_geo' query\n",
      "=====================================\n",
      "Query:  list_all_signins_geo\n",
      "Data source:  AzureSentinel\n",
      "Gets Signin data used by morph charts\n",
      "\n",
      "Parameters\n",
      "----------\n",
      "add_query_items: str (optional)\n",
      "    Additional query clauses\n",
      "end: datetime (optional)\n",
      "    Query end time\n",
      "start: datetime (optional)\n",
      "    Query start time\n",
      "    (default value is: -5)\n",
      "table: str (optional)\n",
      "    Table name\n",
      "    (default value is: SigninLogs)\n",
      "Query:\n",
      " {table} | where TimeGenerated >= datetime({start}) | where TimeGenerated <= datetime({end}) | extend Result = iif(ResultType==0, \"Sucess\", \"Failed\") | extend Latitude = tostring(parse_json(tostring(LocationDetails.geoCoordinates)).latitude) | extend Longitude = tostring(parse_json(tostring(LocationDetails.geoCoordinates)).longitude)\n"
     ]
    }
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "### MSTICPy Query browser\r\n",
    "\r\n",
    "The query browser combines both of the previous functions in a scrollable<br>\r\n",
    "and filterable list. For the selected query, it shows the required and<br>\r\n",
    "optional parameters, together with the full text of the query.<br>\r\n",
    "\r\n",
    "You cannot execute queries from the browser but you can copy and paste\r\n",
    "the example shown below the help for each query.\r\n"
   ],
   "metadata": {}
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "source": [
    "qry_prov.browse_queries()"
   ],
   "outputs": [
    {
     "output_type": "display_data",
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "da0b433e4b6440de9f03c5a6aabf9ffb",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "VBox(children=(Text(value='', description='Filter:', style=DescriptionStyle(description_width='initial')), SelÃ¢â‚¬Â¦"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "display_data",
     "data": {
      "text/html": [
       "<hr>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "display_data",
     "data": {
      "text/html": [
       "<h3>Gets latest VMComputer record for Host</h3><div></div><p><b>Parameters</b></p><div>add_query_items: str (optional)</div><div style='margin-left: 40px'>    Additional query clauses</div><div>end: datetime (optional)</div><div style='margin-left: 40px'>    Query end time</div><div>host_name: str</div><div style='margin-left: 40px'>    The Computer name of the VM</div><div>start: datetime (optional)</div><div style='margin-left: 40px'>    Query start time</div><div style='margin-left: 40px'>    (default value is: -5)</div><div>table: str (optional)</div><div style='margin-left: 40px'>    Table name</div><div style='margin-left: 40px'>    (default value is: VMComputer)</div><br><p><b>Query</b></p><pre>{table} \n",
       "| where TimeGenerated >= datetime({start}) \n",
       "| where TimeGenerated <= datetime({end}) \n",
       "| where Computer has \"{host_name}\" \n",
       "| take 1</pre><br>\n",
       "        <p><b>Example</b></p>\n",
       "        <p>{QueryProvider}[.QueryPath].QueryName(params...)</p>\n",
       "        <pre>qry_prov.Azure.get_vmcomputer_for_host(start=start, end=end, hostname=host)</pre>\n",
       "    "
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {}
    }
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "### Run some queries\r\n",
    "\r\n",
    "### Most queries require time parameters!\r\n",
    "\r\n",
    "Datetime strings are **painful** to type in and keep track of. \r\n",
    "We can use MSTICPy's `nbwidgets.QueryTime` class to define \"start\" and \"end\" for queries.\r\n",
    "\r\n",
    "Each query provider has its own `QueryTime` instance built-in. If the query\r\n",
    "needs \"start\" and \"end\" parameters and you do not supply them, the query\r\n",
    "will take the time from this built-in timerange control."
   ],
   "metadata": {}
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "source": [
    "# Open the query time control for our query provider\r\n",
    "qry_prov.query_time"
   ],
   "outputs": [
    {
     "output_type": "display_data",
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "fb378e7829fb4f5792c57c2ff750d534",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "VBox(children=(HTML(value='<h4>Set query time boundaries</h4>'), HBox(children=(DatePicker(value=datetime.dateÃ¢â‚¬Â¦"
      ]
     },
     "metadata": {}
    }
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "### Run a query using this time range.\r\n",
    "\r\n",
    "Query results are returned as a [Pandas DataFrame](https://pandas.pydata.org/).\r\n",
    "A dataframe is a tabular data structure much like a spreadsheet or\r\n",
    "database table.\r\n",
    "\r\n",
    "<details>\r\n",
    "    <summary>Learn more about DataFrames...</summary>\r\n",
    "    <p>\r\n",
    "    <ul>\r\n",
    "        <li>\r\n",
    "        The <a href=https://pandas.pydata.org/ >Pandas website</a> has an extensive user guide.</li>\r\n",
    "        <li>The <i>A Tour of Cybersec notebook features</i> has a brief introduction to common pandas operations.</li>\r\n",
    "    </ul>\r\n",
    "    </p>\r\n",
    "</details>\r\n"
   ],
   "metadata": {}
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "source": [
    "# The time parameters are taken from the qry_prov time settings\r\n",
    "# but you can override this by supplying explict \"start\" and \"end\" datetimes\r\n",
    "signins_df = qry_prov.Azure.list_all_signins_geo()\r\n",
    "\r\n",
    "if signins_df.empty:\r\n",
    "    md(\"The query returned no rows for this time range. You might want to increase the time range\")\r\n",
    "\r\n",
    "# display first 5 rows of any results\r\n",
    "signins_df.head() # If you have no data you will just see the column headings displayed"
   ],
   "outputs": [
    {
     "output_type": "display_data",
     "data": {
      "application/javascript": "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}",
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "display_data",
     "data": {
      "application/javascript": "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}",
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "display_data",
     "data": {
      "application/javascript": "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}",
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "display_data",
     "data": {
      "application/javascript": "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}",
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "execute_result",
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>TenantId</th>\n",
       "      <th>SourceSystem</th>\n",
       "      <th>TimeGenerated</th>\n",
       "      <th>ResourceId</th>\n",
       "      <th>OperationName</th>\n",
       "      <th>OperationVersion</th>\n",
       "      <th>Category</th>\n",
       "      <th>ResultType</th>\n",
       "      <th>ResultSignature</th>\n",
       "      <th>ResultDescription</th>\n",
       "      <th>DurationMs</th>\n",
       "      <th>CorrelationId</th>\n",
       "      <th>Resource</th>\n",
       "      <th>ResourceGroup</th>\n",
       "      <th>ResourceProvider</th>\n",
       "      <th>Identity</th>\n",
       "      <th>Level</th>\n",
       "      <th>Location</th>\n",
       "      <th>AlternateSignInName</th>\n",
       "      <th>AppDisplayName</th>\n",
       "      <th>AppId</th>\n",
       "      <th>AuthenticationDetails</th>\n",
       "      <th>AuthenticationMethodsUsed</th>\n",
       "      <th>AuthenticationProcessingDetails</th>\n",
       "      <th>AuthenticationRequirement</th>\n",
       "      <th>...</th>\n",
       "      <th>RiskLevelDuringSignIn</th>\n",
       "      <th>RiskState</th>\n",
       "      <th>ResourceDisplayName</th>\n",
       "      <th>ResourceIdentity</th>\n",
       "      <th>ServicePrincipalId</th>\n",
       "      <th>ServicePrincipalName</th>\n",
       "      <th>Status</th>\n",
       "      <th>TokenIssuerName</th>\n",
       "      <th>TokenIssuerType</th>\n",
       "      <th>UserAgent</th>\n",
       "      <th>UserDisplayName</th>\n",
       "      <th>UserId</th>\n",
       "      <th>UserPrincipalName</th>\n",
       "      <th>AADTenantId</th>\n",
       "      <th>UserType</th>\n",
       "      <th>FlaggedForReview</th>\n",
       "      <th>IPAddressFromResourceProvider</th>\n",
       "      <th>SignInIdentifier</th>\n",
       "      <th>SignInIdentifierType</th>\n",
       "      <th>ResourceTenantId</th>\n",
       "      <th>HomeTenantId</th>\n",
       "      <th>Type</th>\n",
       "      <th>Result</th>\n",
       "      <th>Latitude</th>\n",
       "      <th>Longitude</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
       "      <td>Azure AD</td>\n",
       "      <td>2021-08-09 11:16:31.826000+00:00</td>\n",
       "      <td>/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiam</td>\n",
       "      <td>Sign-in activity</td>\n",
       "      <td>1.0</td>\n",
       "      <td>SignInLogs</td>\n",
       "      <td>0</td>\n",
       "      <td>None</td>\n",
       "      <td></td>\n",
       "      <td>0</td>\n",
       "      <td>92536dd0-1210-4c18-944d-bc3928add59b</td>\n",
       "      <td>Microsoft.aadiam</td>\n",
       "      <td>Microsoft.aadiam</td>\n",
       "      <td></td>\n",
       "      <td>Arseny Vasilev</td>\n",
       "      <td>4</td>\n",
       "      <td>RU</td>\n",
       "      <td></td>\n",
       "      <td>Azure Portal</td>\n",
       "      <td>c44b4083-3bb0-49c1-b47d-974e53cbdf3c</td>\n",
       "      <td>[\\r\\n  {\\r\\n    \"authenticationStepDateTime\": \"2021-08-09T11:16:31.8261902+00:00\",\\r\\n    \"authe...</td>\n",
       "      <td></td>\n",
       "      <td>[\\r\\n  {\\r\\n    \"key\": \"IsCAEToken\",\\r\\n    \"value\": \"False\"\\r\\n  }\\r\\n]</td>\n",
       "      <td>singleFactorAuthentication</td>\n",
       "      <td>...</td>\n",
       "      <td>none</td>\n",
       "      <td>none</td>\n",
       "      <td>Windows Azure Service Management API</td>\n",
       "      <td>797f4846-ba00-4fd7-ba43-dac1f8f63013</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>{'errorCode': 0}</td>\n",
       "      <td></td>\n",
       "      <td>AzureAD</td>\n",
       "      <td>Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.451...</td>\n",
       "      <td>Arseny Vasilev</td>\n",
       "      <td>9267d02c-5f76-40a9-a9eb-b686f3ca47aa</td>\n",
       "      <td>avasilev@viacode.com</td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>Guest</td>\n",
       "      <td>None</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>5fccd68a-e65e-46ae-96b1-2d896d680249</td>\n",
       "      <td>SigninLogs</td>\n",
       "      <td>Sucess</td>\n",
       "      <td>59.93904113769531</td>\n",
       "      <td>30.3157901763916</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
       "      <td>Azure AD</td>\n",
       "      <td>2021-08-09 11:33:34.845000+00:00</td>\n",
       "      <td>/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiam</td>\n",
       "      <td>Sign-in activity</td>\n",
       "      <td>1.0</td>\n",
       "      <td>SignInLogs</td>\n",
       "      <td>0</td>\n",
       "      <td>None</td>\n",
       "      <td></td>\n",
       "      <td>0</td>\n",
       "      <td>272044e5-2133-49d8-9441-bfff89159f13</td>\n",
       "      <td>Microsoft.aadiam</td>\n",
       "      <td>Microsoft.aadiam</td>\n",
       "      <td></td>\n",
       "      <td>On-Premises Directory Synchronization Service Account</td>\n",
       "      <td>4</td>\n",
       "      <td>US</td>\n",
       "      <td>Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com</td>\n",
       "      <td>Microsoft Azure Active Directory Connect</td>\n",
       "      <td>cb1056e2-e479-49de-ae31-7812af012ed8</td>\n",
       "      <td>[\\r\\n  {\\r\\n    \"authenticationStepDateTime\": \"2021-08-09T11:33:34.8455741+00:00\",\\r\\n    \"authe...</td>\n",
       "      <td></td>\n",
       "      <td>[\\r\\n  {\\r\\n    \"key\": \"IsCAEToken\",\\r\\n    \"value\": \"False\"\\r\\n  }\\r\\n]</td>\n",
       "      <td>singleFactorAuthentication</td>\n",
       "      <td>...</td>\n",
       "      <td>none</td>\n",
       "      <td>none</td>\n",
       "      <td>Windows Azure Active Directory</td>\n",
       "      <td>00000002-0000-0000-c000-000000000000</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>{'errorCode': 0}</td>\n",
       "      <td></td>\n",
       "      <td>AzureAD</td>\n",
       "      <td></td>\n",
       "      <td>On-Premises Directory Synchronization Service Account</td>\n",
       "      <td>2235a468-ad9c-4375-8008-0a7be76994a7</td>\n",
       "      <td>sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com</td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>Member</td>\n",
       "      <td>None</td>\n",
       "      <td></td>\n",
       "      <td>Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com</td>\n",
       "      <td></td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>SigninLogs</td>\n",
       "      <td>Sucess</td>\n",
       "      <td>38.7130012512207</td>\n",
       "      <td>-78.15899658203125</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
       "      <td>Azure AD</td>\n",
       "      <td>2021-08-09 12:02:21.592000+00:00</td>\n",
       "      <td>/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiam</td>\n",
       "      <td>Sign-in activity</td>\n",
       "      <td>1.0</td>\n",
       "      <td>SignInLogs</td>\n",
       "      <td>0</td>\n",
       "      <td>None</td>\n",
       "      <td></td>\n",
       "      <td>0</td>\n",
       "      <td>2bfba6c0-14a3-48b9-ba55-18892a2a9f97</td>\n",
       "      <td>Microsoft.aadiam</td>\n",
       "      <td>Microsoft.aadiam</td>\n",
       "      <td></td>\n",
       "      <td>Harisha</td>\n",
       "      <td>4</td>\n",
       "      <td>IN</td>\n",
       "      <td></td>\n",
       "      <td>Azure Portal</td>\n",
       "      <td>c44b4083-3bb0-49c1-b47d-974e53cbdf3c</td>\n",
       "      <td>[\\r\\n  {\\r\\n    \"authenticationStepDateTime\": \"2021-08-09T12:02:21.5928932+00:00\",\\r\\n    \"authe...</td>\n",
       "      <td></td>\n",
       "      <td>[\\r\\n  {\\r\\n    \"key\": \"IsCAEToken\",\\r\\n    \"value\": \"False\"\\r\\n  }\\r\\n]</td>\n",
       "      <td>singleFactorAuthentication</td>\n",
       "      <td>...</td>\n",
       "      <td>none</td>\n",
       "      <td>none</td>\n",
       "      <td>Windows Azure Service Management API</td>\n",
       "      <td>797f4846-ba00-4fd7-ba43-dac1f8f63013</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>{'errorCode': 0}</td>\n",
       "      <td></td>\n",
       "      <td>AzureAD</td>\n",
       "      <td>Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.451...</td>\n",
       "      <td>Harisha</td>\n",
       "      <td>3ce68c80-7cc7-4776-9a87-7d862b6dfdb0</td>\n",
       "      <td>harisha@happiestminds.com</td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>Guest</td>\n",
       "      <td>None</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>77428205-87ff-4048-a645-91b337240228</td>\n",
       "      <td>SigninLogs</td>\n",
       "      <td>Sucess</td>\n",
       "      <td>14.21049976348877</td>\n",
       "      <td>76.32176208496094</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
       "      <td>Azure AD</td>\n",
       "      <td>2021-08-09 12:03:35.222000+00:00</td>\n",
       "      <td>/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiam</td>\n",
       "      <td>Sign-in activity</td>\n",
       "      <td>1.0</td>\n",
       "      <td>SignInLogs</td>\n",
       "      <td>0</td>\n",
       "      <td>None</td>\n",
       "      <td></td>\n",
       "      <td>0</td>\n",
       "      <td>18c3af58-e914-4ade-a1c8-0c30ae882fcc</td>\n",
       "      <td>Microsoft.aadiam</td>\n",
       "      <td>Microsoft.aadiam</td>\n",
       "      <td></td>\n",
       "      <td>On-Premises Directory Synchronization Service Account</td>\n",
       "      <td>4</td>\n",
       "      <td>US</td>\n",
       "      <td>Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com</td>\n",
       "      <td>Microsoft Azure Active Directory Connect</td>\n",
       "      <td>cb1056e2-e479-49de-ae31-7812af012ed8</td>\n",
       "      <td>[\\r\\n  {\\r\\n    \"authenticationStepDateTime\": \"2021-08-09T12:03:35.2225907+00:00\",\\r\\n    \"authe...</td>\n",
       "      <td></td>\n",
       "      <td>[\\r\\n  {\\r\\n    \"key\": \"IsCAEToken\",\\r\\n    \"value\": \"False\"\\r\\n  }\\r\\n]</td>\n",
       "      <td>singleFactorAuthentication</td>\n",
       "      <td>...</td>\n",
       "      <td>none</td>\n",
       "      <td>none</td>\n",
       "      <td>Windows Azure Active Directory</td>\n",
       "      <td>00000002-0000-0000-c000-000000000000</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>{'errorCode': 0}</td>\n",
       "      <td></td>\n",
       "      <td>AzureAD</td>\n",
       "      <td></td>\n",
       "      <td>On-Premises Directory Synchronization Service Account</td>\n",
       "      <td>2235a468-ad9c-4375-8008-0a7be76994a7</td>\n",
       "      <td>sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com</td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>Member</td>\n",
       "      <td>None</td>\n",
       "      <td></td>\n",
       "      <td>Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com</td>\n",
       "      <td></td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>SigninLogs</td>\n",
       "      <td>Sucess</td>\n",
       "      <td>38.7130012512207</td>\n",
       "      <td>-78.15899658203125</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
       "      <td>Azure AD</td>\n",
       "      <td>2021-08-09 12:03:40.028000+00:00</td>\n",
       "      <td>/tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiam</td>\n",
       "      <td>Sign-in activity</td>\n",
       "      <td>1.0</td>\n",
       "      <td>SignInLogs</td>\n",
       "      <td>0</td>\n",
       "      <td>None</td>\n",
       "      <td></td>\n",
       "      <td>0</td>\n",
       "      <td>41867fc3-83c3-4d6e-ba1d-3d62e6fad43c</td>\n",
       "      <td>Microsoft.aadiam</td>\n",
       "      <td>Microsoft.aadiam</td>\n",
       "      <td></td>\n",
       "      <td>On-Premises Directory Synchronization Service Account</td>\n",
       "      <td>4</td>\n",
       "      <td>US</td>\n",
       "      <td>Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com</td>\n",
       "      <td>Microsoft Azure Active Directory Connect</td>\n",
       "      <td>cb1056e2-e479-49de-ae31-7812af012ed8</td>\n",
       "      <td>[\\r\\n  {\\r\\n    \"authenticationStepDateTime\": \"2021-08-09T12:03:40.0284788+00:00\",\\r\\n    \"authe...</td>\n",
       "      <td></td>\n",
       "      <td>[\\r\\n  {\\r\\n    \"key\": \"IsCAEToken\",\\r\\n    \"value\": \"False\"\\r\\n  }\\r\\n]</td>\n",
       "      <td>singleFactorAuthentication</td>\n",
       "      <td>...</td>\n",
       "      <td>none</td>\n",
       "      <td>none</td>\n",
       "      <td>Windows Azure Active Directory</td>\n",
       "      <td>00000002-0000-0000-c000-000000000000</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>{'errorCode': 0}</td>\n",
       "      <td></td>\n",
       "      <td>AzureAD</td>\n",
       "      <td></td>\n",
       "      <td>On-Premises Directory Synchronization Service Account</td>\n",
       "      <td>2235a468-ad9c-4375-8008-0a7be76994a7</td>\n",
       "      <td>sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com</td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>Member</td>\n",
       "      <td>None</td>\n",
       "      <td></td>\n",
       "      <td>Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com</td>\n",
       "      <td></td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>SigninLogs</td>\n",
       "      <td>Sucess</td>\n",
       "      <td>38.7130012512207</td>\n",
       "      <td>-78.15899658203125</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows 69 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "                               TenantId SourceSystem  \\\n",
       "0  8ecf8077-cf51-4820-aadd-14040956f35d     Azure AD   \n",
       "1  8ecf8077-cf51-4820-aadd-14040956f35d     Azure AD   \n",
       "2  8ecf8077-cf51-4820-aadd-14040956f35d     Azure AD   \n",
       "3  8ecf8077-cf51-4820-aadd-14040956f35d     Azure AD   \n",
       "4  8ecf8077-cf51-4820-aadd-14040956f35d     Azure AD   \n",
       "\n",
       "                     TimeGenerated  \\\n",
       "0 2021-08-09 11:16:31.826000+00:00   \n",
       "1 2021-08-09 11:33:34.845000+00:00   \n",
       "2 2021-08-09 12:02:21.592000+00:00   \n",
       "3 2021-08-09 12:03:35.222000+00:00   \n",
       "4 2021-08-09 12:03:40.028000+00:00   \n",
       "\n",
       "                                                                 ResourceId  \\\n",
       "0  /tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiam   \n",
       "1  /tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiam   \n",
       "2  /tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiam   \n",
       "3  /tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiam   \n",
       "4  /tenants/4b2462a4-bbee-495a-a0e1-f23ae524cc9c/providers/Microsoft.aadiam   \n",
       "\n",
       "      OperationName OperationVersion    Category ResultType ResultSignature  \\\n",
       "0  Sign-in activity              1.0  SignInLogs          0            None   \n",
       "1  Sign-in activity              1.0  SignInLogs          0            None   \n",
       "2  Sign-in activity              1.0  SignInLogs          0            None   \n",
       "3  Sign-in activity              1.0  SignInLogs          0            None   \n",
       "4  Sign-in activity              1.0  SignInLogs          0            None   \n",
       "\n",
       "  ResultDescription  DurationMs                         CorrelationId  \\\n",
       "0                             0  92536dd0-1210-4c18-944d-bc3928add59b   \n",
       "1                             0  272044e5-2133-49d8-9441-bfff89159f13   \n",
       "2                             0  2bfba6c0-14a3-48b9-ba55-18892a2a9f97   \n",
       "3                             0  18c3af58-e914-4ade-a1c8-0c30ae882fcc   \n",
       "4                             0  41867fc3-83c3-4d6e-ba1d-3d62e6fad43c   \n",
       "\n",
       "           Resource     ResourceGroup ResourceProvider  \\\n",
       "0  Microsoft.aadiam  Microsoft.aadiam                    \n",
       "1  Microsoft.aadiam  Microsoft.aadiam                    \n",
       "2  Microsoft.aadiam  Microsoft.aadiam                    \n",
       "3  Microsoft.aadiam  Microsoft.aadiam                    \n",
       "4  Microsoft.aadiam  Microsoft.aadiam                    \n",
       "\n",
       "                                                Identity Level Location  \\\n",
       "0                                         Arseny Vasilev     4       RU   \n",
       "1  On-Premises Directory Synchronization Service Account     4       US   \n",
       "2                                                Harisha     4       IN   \n",
       "3  On-Premises Directory Synchronization Service Account     4       US   \n",
       "4  On-Premises Directory Synchronization Service Account     4       US   \n",
       "\n",
       "                                    AlternateSignInName  \\\n",
       "0                                                         \n",
       "1  Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com   \n",
       "2                                                         \n",
       "3  Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com   \n",
       "4  Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com   \n",
       "\n",
       "                             AppDisplayName  \\\n",
       "0                              Azure Portal   \n",
       "1  Microsoft Azure Active Directory Connect   \n",
       "2                              Azure Portal   \n",
       "3  Microsoft Azure Active Directory Connect   \n",
       "4  Microsoft Azure Active Directory Connect   \n",
       "\n",
       "                                  AppId  \\\n",
       "0  c44b4083-3bb0-49c1-b47d-974e53cbdf3c   \n",
       "1  cb1056e2-e479-49de-ae31-7812af012ed8   \n",
       "2  c44b4083-3bb0-49c1-b47d-974e53cbdf3c   \n",
       "3  cb1056e2-e479-49de-ae31-7812af012ed8   \n",
       "4  cb1056e2-e479-49de-ae31-7812af012ed8   \n",
       "\n",
       "                                                                                 AuthenticationDetails  \\\n",
       "0  [\\r\\n  {\\r\\n    \"authenticationStepDateTime\": \"2021-08-09T11:16:31.8261902+00:00\",\\r\\n    \"authe...   \n",
       "1  [\\r\\n  {\\r\\n    \"authenticationStepDateTime\": \"2021-08-09T11:33:34.8455741+00:00\",\\r\\n    \"authe...   \n",
       "2  [\\r\\n  {\\r\\n    \"authenticationStepDateTime\": \"2021-08-09T12:02:21.5928932+00:00\",\\r\\n    \"authe...   \n",
       "3  [\\r\\n  {\\r\\n    \"authenticationStepDateTime\": \"2021-08-09T12:03:35.2225907+00:00\",\\r\\n    \"authe...   \n",
       "4  [\\r\\n  {\\r\\n    \"authenticationStepDateTime\": \"2021-08-09T12:03:40.0284788+00:00\",\\r\\n    \"authe...   \n",
       "\n",
       "  AuthenticationMethodsUsed  \\\n",
       "0                             \n",
       "1                             \n",
       "2                             \n",
       "3                             \n",
       "4                             \n",
       "\n",
       "                                            AuthenticationProcessingDetails  \\\n",
       "0  [\\r\\n  {\\r\\n    \"key\": \"IsCAEToken\",\\r\\n    \"value\": \"False\"\\r\\n  }\\r\\n]   \n",
       "1  [\\r\\n  {\\r\\n    \"key\": \"IsCAEToken\",\\r\\n    \"value\": \"False\"\\r\\n  }\\r\\n]   \n",
       "2  [\\r\\n  {\\r\\n    \"key\": \"IsCAEToken\",\\r\\n    \"value\": \"False\"\\r\\n  }\\r\\n]   \n",
       "3  [\\r\\n  {\\r\\n    \"key\": \"IsCAEToken\",\\r\\n    \"value\": \"False\"\\r\\n  }\\r\\n]   \n",
       "4  [\\r\\n  {\\r\\n    \"key\": \"IsCAEToken\",\\r\\n    \"value\": \"False\"\\r\\n  }\\r\\n]   \n",
       "\n",
       "    AuthenticationRequirement  ... RiskLevelDuringSignIn RiskState  \\\n",
       "0  singleFactorAuthentication  ...                  none      none   \n",
       "1  singleFactorAuthentication  ...                  none      none   \n",
       "2  singleFactorAuthentication  ...                  none      none   \n",
       "3  singleFactorAuthentication  ...                  none      none   \n",
       "4  singleFactorAuthentication  ...                  none      none   \n",
       "\n",
       "                    ResourceDisplayName                      ResourceIdentity  \\\n",
       "0  Windows Azure Service Management API  797f4846-ba00-4fd7-ba43-dac1f8f63013   \n",
       "1        Windows Azure Active Directory  00000002-0000-0000-c000-000000000000   \n",
       "2  Windows Azure Service Management API  797f4846-ba00-4fd7-ba43-dac1f8f63013   \n",
       "3        Windows Azure Active Directory  00000002-0000-0000-c000-000000000000   \n",
       "4        Windows Azure Active Directory  00000002-0000-0000-c000-000000000000   \n",
       "\n",
       "  ServicePrincipalId ServicePrincipalName            Status TokenIssuerName  \\\n",
       "0                                          {'errorCode': 0}                   \n",
       "1                                          {'errorCode': 0}                   \n",
       "2                                          {'errorCode': 0}                   \n",
       "3                                          {'errorCode': 0}                   \n",
       "4                                          {'errorCode': 0}                   \n",
       "\n",
       "  TokenIssuerType  \\\n",
       "0         AzureAD   \n",
       "1         AzureAD   \n",
       "2         AzureAD   \n",
       "3         AzureAD   \n",
       "4         AzureAD   \n",
       "\n",
       "                                                                                             UserAgent  \\\n",
       "0  Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.451...   \n",
       "1                                                                                                        \n",
       "2  Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.451...   \n",
       "3                                                                                                        \n",
       "4                                                                                                        \n",
       "\n",
       "                                         UserDisplayName  \\\n",
       "0                                         Arseny Vasilev   \n",
       "1  On-Premises Directory Synchronization Service Account   \n",
       "2                                                Harisha   \n",
       "3  On-Premises Directory Synchronization Service Account   \n",
       "4  On-Premises Directory Synchronization Service Account   \n",
       "\n",
       "                                 UserId  \\\n",
       "0  9267d02c-5f76-40a9-a9eb-b686f3ca47aa   \n",
       "1  2235a468-ad9c-4375-8008-0a7be76994a7   \n",
       "2  3ce68c80-7cc7-4776-9a87-7d862b6dfdb0   \n",
       "3  2235a468-ad9c-4375-8008-0a7be76994a7   \n",
       "4  2235a468-ad9c-4375-8008-0a7be76994a7   \n",
       "\n",
       "                                      UserPrincipalName  \\\n",
       "0                                  avasilev@viacode.com   \n",
       "1  sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com   \n",
       "2                             harisha@happiestminds.com   \n",
       "3  sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com   \n",
       "4  sync_aadcon_a5225d32ba79@seccxpninja.onmicrosoft.com   \n",
       "\n",
       "                            AADTenantId UserType FlaggedForReview  \\\n",
       "0  4b2462a4-bbee-495a-a0e1-f23ae524cc9c    Guest             None   \n",
       "1  4b2462a4-bbee-495a-a0e1-f23ae524cc9c   Member             None   \n",
       "2  4b2462a4-bbee-495a-a0e1-f23ae524cc9c    Guest             None   \n",
       "3  4b2462a4-bbee-495a-a0e1-f23ae524cc9c   Member             None   \n",
       "4  4b2462a4-bbee-495a-a0e1-f23ae524cc9c   Member             None   \n",
       "\n",
       "  IPAddressFromResourceProvider  \\\n",
       "0                                 \n",
       "1                                 \n",
       "2                                 \n",
       "3                                 \n",
       "4                                 \n",
       "\n",
       "                                       SignInIdentifier SignInIdentifierType  \\\n",
       "0                                                                              \n",
       "1  Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com                        \n",
       "2                                                                              \n",
       "3  Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com                        \n",
       "4  Sync_AADCON_a5225d32ba79@seccxpninja.onmicrosoft.com                        \n",
       "\n",
       "                       ResourceTenantId                          HomeTenantId  \\\n",
       "0  4b2462a4-bbee-495a-a0e1-f23ae524cc9c  5fccd68a-e65e-46ae-96b1-2d896d680249   \n",
       "1  4b2462a4-bbee-495a-a0e1-f23ae524cc9c  4b2462a4-bbee-495a-a0e1-f23ae524cc9c   \n",
       "2  4b2462a4-bbee-495a-a0e1-f23ae524cc9c  77428205-87ff-4048-a645-91b337240228   \n",
       "3  4b2462a4-bbee-495a-a0e1-f23ae524cc9c  4b2462a4-bbee-495a-a0e1-f23ae524cc9c   \n",
       "4  4b2462a4-bbee-495a-a0e1-f23ae524cc9c  4b2462a4-bbee-495a-a0e1-f23ae524cc9c   \n",
       "\n",
       "         Type  Result           Latitude           Longitude  \n",
       "0  SigninLogs  Sucess  59.93904113769531    30.3157901763916  \n",
       "1  SigninLogs  Sucess   38.7130012512207  -78.15899658203125  \n",
       "2  SigninLogs  Sucess  14.21049976348877   76.32176208496094  \n",
       "3  SigninLogs  Sucess   38.7130012512207  -78.15899658203125  \n",
       "4  SigninLogs  Sucess   38.7130012512207  -78.15899658203125  \n",
       "\n",
       "[5 rows x 69 columns]"
      ]
     },
     "metadata": {},
     "execution_count": 10
    }
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "## 5.6 Customizable and custom queries\r\n",
    "\r\n",
    "### Customizing built-in queries\r\n",
    "\r\n",
    "Most built-in queries support the \"add_query_items\" parameter.\r\n",
    "You can use this to append additional filters or other operations to the built-in queries.\r\n",
    "\r\n",
    "Azure Sentinel queries use the Kusto Query Language (KQL).\r\n",
    "\r\n",
    "<div style=border: solid; padding: 5pt\"><b>Note:</b>\r\n",
    "If the query in following cell returns too many or too few results you can change the \"28\"\r\n",
    "in the query below to a smaller or larger number of days.\r\n",
    "</div>\r\n",
    "<br>\r\n",
    "\r\n",
    "<details>\r\n",
    "    <summary>Learn more about KQL query syntax...</summary>\r\n",
    "    <p>\r\n",
    "    <a href=https://aka.ms/kql >Kusto Query Language reference</a><br>\r\n",
    "    </p>\r\n",
    "</details>\r\n",
    "<br>\r\n"
   ],
   "metadata": {}
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "source": [
    "from datetime import datetime, timedelta\r\n",
    "\r\n",
    "qry_prov.SecurityAlert.list_alerts(\r\n",
    "    start=datetime.utcnow() - timedelta(28),\r\n",
    "    end=datetime.utcnow(),\r\n",
    "    add_query_items=\"| summarize NumAlerts=count() by AlertName\"\r\n",
    ")"
   ],
   "outputs": [
    {
     "output_type": "display_data",
     "data": {
      "application/javascript": "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}",
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "display_data",
     "data": {
      "application/javascript": "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}",
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "display_data",
     "data": {
      "application/javascript": "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}",
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "display_data",
     "data": {
      "application/javascript": "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}",
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "execute_result",
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>AlertName</th>\n",
       "      <th>NumAlerts</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>'Mimikatz' hacktool was detected</td>\n",
       "      <td>110</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>Malicious credential theft tool execution detected</td>\n",
       "      <td>1151</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>Suspected brute-force attack (LDAP)</td>\n",
       "      <td>1632</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>Unfamiliar sign-in properties</td>\n",
       "      <td>45</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>Test Rule - E1</td>\n",
       "      <td>738</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>220</th>\n",
       "      <td>Login from a domain not seen in 60 days</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>221</th>\n",
       "      <td>DDoS Attack mitigated for Public IP</td>\n",
       "      <td>2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>222</th>\n",
       "      <td>(Preview) SAP - Low - Dynamic ABAP Program</td>\n",
       "      <td>2</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>223</th>\n",
       "      <td>DDoS Attack detected for Public IP</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>224</th>\n",
       "      <td>Itay - Test</td>\n",
       "      <td>8</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>225 rows  2 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "                                              AlertName  NumAlerts\n",
       "0                      'Mimikatz' hacktool was detected        110\n",
       "1    Malicious credential theft tool execution detected       1151\n",
       "2                   Suspected brute-force attack (LDAP)       1632\n",
       "3                         Unfamiliar sign-in properties         45\n",
       "4                                        Test Rule - E1        738\n",
       "..                                                  ...        ...\n",
       "220             Login from a domain not seen in 60 days          1\n",
       "221                 DDoS Attack mitigated for Public IP          2\n",
       "222          (Preview) SAP - Low - Dynamic ABAP Program          2\n",
       "223                  DDoS Attack detected for Public IP          1\n",
       "224                                         Itay - Test          8\n",
       "\n",
       "[225 rows x 2 columns]"
      ]
     },
     "metadata": {},
     "execution_count": 11
    }
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "### Custom queries\r\n",
    "\r\n",
    "Another way to run queries is to pass a full KQL query string to the query provider.\r\n",
    "\r\n",
    "This will run the query against the workspace connected to above, and will return the data \r\n",
    "as DataFrame.\r\n"
   ],
   "metadata": {}
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "source": [
    "# Define our query\r\n",
    "test_query = \"\"\"\r\n",
    "OfficeActivity\r\n",
    "| where TimeGenerated > ago(1d)\r\n",
    "| take 10\r\n",
    "\"\"\"\r\n",
    "\r\n",
    "# Pass that query to our QueryProvider\r\n",
    "office_events_df = qry_prov.exec_query(test_query)\r\n",
    "display(office_events_df.head())\r\n"
   ],
   "outputs": [
    {
     "output_type": "display_data",
     "data": {
      "application/javascript": "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}",
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "display_data",
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>TenantId</th>\n",
       "      <th>Application</th>\n",
       "      <th>UserDomain</th>\n",
       "      <th>UserAgent</th>\n",
       "      <th>RecordType</th>\n",
       "      <th>TimeGenerated</th>\n",
       "      <th>Operation</th>\n",
       "      <th>OrganizationId</th>\n",
       "      <th>OrganizationId_</th>\n",
       "      <th>UserType</th>\n",
       "      <th>UserKey</th>\n",
       "      <th>OfficeWorkload</th>\n",
       "      <th>ResultStatus</th>\n",
       "      <th>ResultReasonType</th>\n",
       "      <th>OfficeObjectId</th>\n",
       "      <th>UserId</th>\n",
       "      <th>UserId_</th>\n",
       "      <th>ClientIP</th>\n",
       "      <th>ClientIP_</th>\n",
       "      <th>Scope</th>\n",
       "      <th>Site_</th>\n",
       "      <th>ItemType</th>\n",
       "      <th>EventSource</th>\n",
       "      <th>Source_Name</th>\n",
       "      <th>MachineDomainInfo</th>\n",
       "      <th>...</th>\n",
       "      <th>ChannelType</th>\n",
       "      <th>ChannelName</th>\n",
       "      <th>ChannelGuid</th>\n",
       "      <th>ExtraProperties</th>\n",
       "      <th>AddOnType</th>\n",
       "      <th>AddonName</th>\n",
       "      <th>TabType</th>\n",
       "      <th>Name</th>\n",
       "      <th>OldValue</th>\n",
       "      <th>NewValue</th>\n",
       "      <th>ItemName</th>\n",
       "      <th>ChatThreadId</th>\n",
       "      <th>ChatName</th>\n",
       "      <th>CommunicationType</th>\n",
       "      <th>AADGroupId</th>\n",
       "      <th>AddOnGuid</th>\n",
       "      <th>AppDistributionMode</th>\n",
       "      <th>TargetUserId</th>\n",
       "      <th>OperationScope</th>\n",
       "      <th>AzureADAppId</th>\n",
       "      <th>OperationProperties</th>\n",
       "      <th>AppId</th>\n",
       "      <th>ClientAppId</th>\n",
       "      <th>Type</th>\n",
       "      <th>_ResourceId</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>50</td>\n",
       "      <td>2021-07-22 01:03:05+00:00</td>\n",
       "      <td>MailItemsAccessed</td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>Regular</td>\n",
       "      <td>100320003F8A6FC7</td>\n",
       "      <td>Exchange</td>\n",
       "      <td>Succeeded</td>\n",
       "      <td>Succeeded</td>\n",
       "      <td></td>\n",
       "      <td>MeganB@seccxp.ninja</td>\n",
       "      <td>MeganB@seccxp.ninja</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>None</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>[{'Value': 'Bind', 'Name': 'MailAccessType'}, {'Value': 'False', 'Name': 'IsThrottled'}]</td>\n",
       "      <td>414a677a-e50f-46ea-b89c-aebb8a9efbe2</td>\n",
       "      <td></td>\n",
       "      <td>OfficeActivity</td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>50</td>\n",
       "      <td>2021-07-22 01:03:05+00:00</td>\n",
       "      <td>MailItemsAccessed</td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>Regular</td>\n",
       "      <td>100320003F8A6FC7</td>\n",
       "      <td>Exchange</td>\n",
       "      <td>Succeeded</td>\n",
       "      <td>Succeeded</td>\n",
       "      <td></td>\n",
       "      <td>MeganB@seccxp.ninja</td>\n",
       "      <td>MeganB@seccxp.ninja</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>None</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>[{'Value': 'Bind', 'Name': 'MailAccessType'}, {'Value': 'False', 'Name': 'IsThrottled'}]</td>\n",
       "      <td>414a677a-e50f-46ea-b89c-aebb8a9efbe2</td>\n",
       "      <td></td>\n",
       "      <td>OfficeActivity</td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>50</td>\n",
       "      <td>2021-07-22 01:03:05+00:00</td>\n",
       "      <td>MailItemsAccessed</td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>Regular</td>\n",
       "      <td>100320003F8A6FC7</td>\n",
       "      <td>Exchange</td>\n",
       "      <td>Succeeded</td>\n",
       "      <td>Succeeded</td>\n",
       "      <td></td>\n",
       "      <td>MeganB@seccxp.ninja</td>\n",
       "      <td>MeganB@seccxp.ninja</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>None</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>[{'Value': 'Bind', 'Name': 'MailAccessType'}, {'Value': 'False', 'Name': 'IsThrottled'}]</td>\n",
       "      <td>414a677a-e50f-46ea-b89c-aebb8a9efbe2</td>\n",
       "      <td></td>\n",
       "      <td>OfficeActivity</td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>50</td>\n",
       "      <td>2021-07-22 01:03:05+00:00</td>\n",
       "      <td>MailItemsAccessed</td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>Regular</td>\n",
       "      <td>100320003F8A6FC7</td>\n",
       "      <td>Exchange</td>\n",
       "      <td>Succeeded</td>\n",
       "      <td>Succeeded</td>\n",
       "      <td></td>\n",
       "      <td>MeganB@seccxp.ninja</td>\n",
       "      <td>MeganB@seccxp.ninja</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>None</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>[{'Value': 'Bind', 'Name': 'MailAccessType'}, {'Value': 'False', 'Name': 'IsThrottled'}]</td>\n",
       "      <td>414a677a-e50f-46ea-b89c-aebb8a9efbe2</td>\n",
       "      <td></td>\n",
       "      <td>OfficeActivity</td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>8ecf8077-cf51-4820-aadd-14040956f35d</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>ExchangeAdmin</td>\n",
       "      <td>2021-07-22 01:06:47+00:00</td>\n",
       "      <td>Set-ConditionalAccessPolicy</td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>4b2462a4-bbee-495a-a0e1-f23ae524cc9c</td>\n",
       "      <td>DcAdmin</td>\n",
       "      <td>NAMP221\\Administrator (Microsoft.Office.Datacenter.Torus.PowerShellWorker)</td>\n",
       "      <td>Exchange</td>\n",
       "      <td>True</td>\n",
       "      <td>True</td>\n",
       "      <td>seccxpninja.onmicrosoft.com\\8837fdaa-aaeb-4432-9622-43f6f583d583</td>\n",
       "      <td>NAMP221\\Administrator (Microsoft.Office.Datacenter.Torus.PowerShellWorker)</td>\n",
       "      <td>NAMP221\\Administrator (Microsoft.Office.Datacenter.Torus.PowerShellWorker)</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>None</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>None</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>OfficeActivity</td>\n",
       "      <td></td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows  131 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "                               TenantId Application UserDomain UserAgent  \\\n",
       "0  8ecf8077-cf51-4820-aadd-14040956f35d                                    \n",
       "1  8ecf8077-cf51-4820-aadd-14040956f35d                                    \n",
       "2  8ecf8077-cf51-4820-aadd-14040956f35d                                    \n",
       "3  8ecf8077-cf51-4820-aadd-14040956f35d                                    \n",
       "4  8ecf8077-cf51-4820-aadd-14040956f35d                                    \n",
       "\n",
       "      RecordType             TimeGenerated                    Operation  \\\n",
       "0             50 2021-07-22 01:03:05+00:00            MailItemsAccessed   \n",
       "1             50 2021-07-22 01:03:05+00:00            MailItemsAccessed   \n",
       "2             50 2021-07-22 01:03:05+00:00            MailItemsAccessed   \n",
       "3             50 2021-07-22 01:03:05+00:00            MailItemsAccessed   \n",
       "4  ExchangeAdmin 2021-07-22 01:06:47+00:00  Set-ConditionalAccessPolicy   \n",
       "\n",
       "                         OrganizationId                       OrganizationId_  \\\n",
       "0  4b2462a4-bbee-495a-a0e1-f23ae524cc9c  4b2462a4-bbee-495a-a0e1-f23ae524cc9c   \n",
       "1  4b2462a4-bbee-495a-a0e1-f23ae524cc9c  4b2462a4-bbee-495a-a0e1-f23ae524cc9c   \n",
       "2  4b2462a4-bbee-495a-a0e1-f23ae524cc9c  4b2462a4-bbee-495a-a0e1-f23ae524cc9c   \n",
       "3  4b2462a4-bbee-495a-a0e1-f23ae524cc9c  4b2462a4-bbee-495a-a0e1-f23ae524cc9c   \n",
       "4  4b2462a4-bbee-495a-a0e1-f23ae524cc9c  4b2462a4-bbee-495a-a0e1-f23ae524cc9c   \n",
       "\n",
       "  UserType  \\\n",
       "0  Regular   \n",
       "1  Regular   \n",
       "2  Regular   \n",
       "3  Regular   \n",
       "4  DcAdmin   \n",
       "\n",
       "                                                                      UserKey  \\\n",
       "0                                                            100320003F8A6FC7   \n",
       "1                                                            100320003F8A6FC7   \n",
       "2                                                            100320003F8A6FC7   \n",
       "3                                                            100320003F8A6FC7   \n",
       "4  NAMP221\\Administrator (Microsoft.Office.Datacenter.Torus.PowerShellWorker)   \n",
       "\n",
       "  OfficeWorkload ResultStatus ResultReasonType  \\\n",
       "0       Exchange    Succeeded        Succeeded   \n",
       "1       Exchange    Succeeded        Succeeded   \n",
       "2       Exchange    Succeeded        Succeeded   \n",
       "3       Exchange    Succeeded        Succeeded   \n",
       "4       Exchange         True             True   \n",
       "\n",
       "                                                     OfficeObjectId  \\\n",
       "0                                                                     \n",
       "1                                                                     \n",
       "2                                                                     \n",
       "3                                                                     \n",
       "4  seccxpninja.onmicrosoft.com\\8837fdaa-aaeb-4432-9622-43f6f583d583   \n",
       "\n",
       "                                                                       UserId  \\\n",
       "0                                                         MeganB@seccxp.ninja   \n",
       "1                                                         MeganB@seccxp.ninja   \n",
       "2                                                         MeganB@seccxp.ninja   \n",
       "3                                                         MeganB@seccxp.ninja   \n",
       "4  NAMP221\\Administrator (Microsoft.Office.Datacenter.Torus.PowerShellWorker)   \n",
       "\n",
       "                                                                      UserId_  \\\n",
       "0                                                         MeganB@seccxp.ninja   \n",
       "1                                                         MeganB@seccxp.ninja   \n",
       "2                                                         MeganB@seccxp.ninja   \n",
       "3                                                         MeganB@seccxp.ninja   \n",
       "4  NAMP221\\Administrator (Microsoft.Office.Datacenter.Torus.PowerShellWorker)   \n",
       "\n",
       "  ClientIP ClientIP_ Scope Site_ ItemType EventSource Source_Name  \\\n",
       "0                                                                   \n",
       "1                                                                   \n",
       "2                                                                   \n",
       "3                                                                   \n",
       "4                                                                   \n",
       "\n",
       "  MachineDomainInfo  ... ChannelType ChannelName ChannelGuid ExtraProperties  \\\n",
       "0                    ...                                                None   \n",
       "1                    ...                                                None   \n",
       "2                    ...                                                None   \n",
       "3                    ...                                                None   \n",
       "4                    ...                                                None   \n",
       "\n",
       "  AddOnType AddonName TabType Name OldValue NewValue ItemName ChatThreadId  \\\n",
       "0                                                                            \n",
       "1                                                                            \n",
       "2                                                                            \n",
       "3                                                                            \n",
       "4                                                                            \n",
       "\n",
       "  ChatName CommunicationType AADGroupId AddOnGuid AppDistributionMode  \\\n",
       "0                                                                       \n",
       "1                                                                       \n",
       "2                                                                       \n",
       "3                                                                       \n",
       "4                                                                       \n",
       "\n",
       "  TargetUserId OperationScope AzureADAppId  \\\n",
       "0                                            \n",
       "1                                            \n",
       "2                                            \n",
       "3                                            \n",
       "4                                            \n",
       "\n",
       "                                                                        OperationProperties  \\\n",
       "0  [{'Value': 'Bind', 'Name': 'MailAccessType'}, {'Value': 'False', 'Name': 'IsThrottled'}]   \n",
       "1  [{'Value': 'Bind', 'Name': 'MailAccessType'}, {'Value': 'False', 'Name': 'IsThrottled'}]   \n",
       "2  [{'Value': 'Bind', 'Name': 'MailAccessType'}, {'Value': 'False', 'Name': 'IsThrottled'}]   \n",
       "3  [{'Value': 'Bind', 'Name': 'MailAccessType'}, {'Value': 'False', 'Name': 'IsThrottled'}]   \n",
       "4                                                                                      None   \n",
       "\n",
       "                                  AppId ClientAppId            Type  \\\n",
       "0  414a677a-e50f-46ea-b89c-aebb8a9efbe2              OfficeActivity   \n",
       "1  414a677a-e50f-46ea-b89c-aebb8a9efbe2              OfficeActivity   \n",
       "2  414a677a-e50f-46ea-b89c-aebb8a9efbe2              OfficeActivity   \n",
       "3  414a677a-e50f-46ea-b89c-aebb8a9efbe2              OfficeActivity   \n",
       "4                                                    OfficeActivity   \n",
       "\n",
       "  _ResourceId  \n",
       "0              \n",
       "1              \n",
       "2              \n",
       "3              \n",
       "4              \n",
       "\n",
       "[5 rows x 131 columns]"
      ]
     },
     "metadata": {}
    }
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "<details>\r\n",
    "    <summary>Learn more about MSTICPy pre-defined queries...</summary>\r\n",
    "    <ul>\r\n",
    "      <li>\r\n",
    "        <a href=https://msticpy.readthedocs.io/en/latest/data_acquisition/DataProviders.html#running-an-pre-defined-query >Running MSTICPy pre-defined queries</a>\r\n",
    "      </li>\r\n",
    "      <li>\r\n",
    "        <a href=https://msticpy.readthedocs.io/en/latest/data_acquisition/DataQueries.html>MSTICPy query reference</a>\r\n",
    "      </li>\r\n",
    "    </ul>\r\n",
    "</details>\r\n",
    "<br>\r\n"
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "---\r\n",
    "\r\n",
    "# 6. Testing external data providers\r\n",
    "\r\n",
    "Threat intelligence and IP location are two common enrichments that you might apply to queried data.\r\n",
    "\r\n",
    "Let's test the VirusTotal provider with a known bad IP Address.\r\n",
    "\r\n",
    "<details>\r\n",
    "    <summary>Learn more...</summary>\r\n",
    "    <p>\r\n",
    "    </p>\r\n",
    "    <ul>\r\n",
    "        <li>More details are shown in the <i>A Tour of Cybersec notebook features</i> notebook</li>\r\n",
    "        <li><a href=https://msticpy.readthedocs.io/en/latest/data_acquisition/TIProviders.html >Threat Intel Lookups in MSTICPy</a></li>\r\n",
    "    </ul>\r\n",
    "</details>\r\n",
    "<br>\r\n",
    "\r\n",
    "\r\n",
    "## 6.1 Threat intelligence lookup using VirusTotal\r\n"
   ],
   "metadata": {}
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "source": [
    "# Create our TI provider\r\n",
    "ti = TILookup()\r\n",
    "\r\n",
    "# Lookup an IP Address\r\n",
    "ti_resp = ti.lookup_ioc(\"85.214.149.236\", providers=[\"VirusTotal\"])\r\n",
    "\r\n",
    "ti_df = ti.result_to_df(ti_resp)\r\n",
    "ti.browse_results(ti_df, severities=\"all\")"
   ],
   "outputs": [
    {
     "output_type": "stream",
     "name": "stdout",
     "text": [
      "Using Open PageRank. See https://www.domcop.com/openpagerank/what-is-openpagerank\n"
     ]
    },
    {
     "output_type": "display_data",
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "cb3eab2df65540c7b53cf256440e6bca",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "VBox(children=(Text(value='', description='Filter:', style=DescriptionStyle(description_width='initial')), SelÃ¢â‚¬Â¦"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "display_data",
     "data": {
      "text/html": [
       "<hr>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "display_data",
     "data": {
      "text/html": [
       "<h2 style='border: 1px solid;background-color: DarkGray; padding: 6px'>85.214.149.236</h2><h3 style='background-color: SteelBlue; padding: 6px'>Type: 'ipv4', Provider: VirusTotal, severity: high</h3><h4>Details</h4>\n",
       "<style>\n",
       "    .tb_ti_res {border-collapse: collapse; width: 60%; border: 1px solid #ddd !important;}\n",
       "    .cell_ti {border: 1px solid #ddd !important;\n",
       "        text-align: left !important; padding: 5px !important; height: 12px}\n",
       "    .cell_ti_first {border: 1px solid #ddd !important; width: 25%;\n",
       "        text-align: left !important; padding: 5px !important; height: 12px}\n",
       "</style>\n",
       "<table class='tb_ti_res'><tr class='cell_ti'><td class='cell_ti_first'>VirusTotal</td><tr class='cell_ti'><td class='cell_ti_first'>verbose_msg</td><td class='cell_ti'>IP address in dataset</td></tr><tr class='cell_ti'><td class='cell_ti_first'>response_code</td><td class='cell_ti'>1</td></tr><tr class='cell_ti'><td class='cell_ti_first'>positives</td><td class='cell_ti'>181</td></tr><tr class='cell_ti'><td class='cell_ti_first'>detected_urls</td><td class='cell_ti'>['http://85.214.149.236/sugarcrm/themes/default/images/', 'http://85.214.149.236:443/sugarcrm/themes/default/images/stock.jpg', 'http://85.214.149.236:443/sugarcrm/themes/default/images/tshd.jpg', 'http://85.214.149.236/', 'http://85.214.149.236:443/sugarcrm/themes/default/images/bioset.jpg', 'http://85.214.149.236:443/sugarcrm/themes/default/images/mod.jpg', 'http://85.214.149.236:443/sugarcrm/themes/default/images/default.jpg', 'http://dockerupdate.anondns.net/']</td></tr><tr class='cell_ti'><td class='cell_ti_first'>detected_downloaded_samples</td><td class='cell_ti'>['75a733d99d72d1d0d6ca99ec852d97ae8c515ed136e12195e96adf6df7bbad41', '252bf8c685289759b90c1de6f9db345c2cfe62e6f8aad9a7f44dfb3c8508487a', 'e15550481e89dbd154b875ce50cc5af4b49f9ff7b837d9ac5b5594e5d63966a3']</td></tr><tr class='cell_ti'><td class='cell_ti_first'>detected_communicating_samples</td><td class='cell_ti'>[]</td></tr></tr></table><h4>Reference: </h4><a href='https://www.virustotal.com/vtapi/v2/ip-address/report'>https://www.virustotal.com/vtapi/v2/ip-address/report</a><br><hr><h4>Raw Results</h4>\n",
       "        <details>\n",
       "        <summary> <u>Raw results from provider...</u></summary>\n",
       "        <pre  style=\"font-size:11px\">{'as_owner':&nbsp;'Strato&nbsp;AG',<br>&nbsp;'asn':&nbsp;6724,<br>&nbsp;'country':&nbsp;'DE',<br>&nbsp;'detected_communicating_samples':&nbsp;[{'date':&nbsp;'2021-06-11&nbsp;01:23:22',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;13,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'ab12b5d03f8467a1089d3d40ef9c4a54fb16ee61bb68714040e9edf96b5e763f',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;74},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2021-06-10&nbsp;07:31:53',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;30,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'1aaf7bc48ff75e870db4fe6ec0b3ed9d99876d7e2fb3d5c4613cca92bbb95e1b',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;75},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2021-06-09&nbsp;02:36:09',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;30,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'36bf7b2ab7968880ccc696927c03167b6056e73043fd97a33d2468383a5bafce',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;75},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2021-05-17&nbsp;21:40:23',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;13,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'39ac019520a278e350065d12ebc0c24201584390724f3d8e0dc828664fee6cae',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;74},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2021-05-12&nbsp;12:46:23',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;6,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'b60ffcc7153650d6a232b1cb249924b0c6384c27681860eb13b12f4705bc0a05',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;75},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2021-05-11&nbsp;08:32:51',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;14,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'1ad0104478301e73e3f49cdeb10f8c1a1d54bccf9248e34ff81352598f112e6b',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;75},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2021-04-21&nbsp;10:08:11',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;16,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'7b6f7c48256a8df2041e8726c3490ccb6987e1a76fee947e148ea68eee036889',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;76},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2021-03-31&nbsp;15:34:40',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;20,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'ae3e4a1c8a2b661265e6c8c756e3ba472dc7177cae79fe1861ab0c2d1af5167a',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;75},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2021-03-27&nbsp;04:35:12',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;22,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'3b280a4017ef2c2aef4b3ed8bb47516b816166998462899935afb39b533890ad',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;75},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2020-08-18&nbsp;19:53:07',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;3,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'0742efecbd7af343213a50cc5fd5cd2f8475613cfe6fb51f4296a7ec4533940d',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;74}],<br>&nbsp;'detected_downloaded_samples':&nbsp;[{'date':&nbsp;'2021-06-29&nbsp;11:54:16',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;26,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'75a733d99d72d1d0d6ca99ec852d97ae8c515ed136e12195e96adf6df7bbad41',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;75},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2021-07-08&nbsp;08:53:31',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;36,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'252bf8c685289759b90c1de6f9db345c2cfe62e6f8aad9a7f44dfb3c8508487a',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;74},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2021-07-08&nbsp;08:53:30',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;38,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'e15550481e89dbd154b875ce50cc5af4b49f9ff7b837d9ac5b5594e5d63966a3',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;74},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2021-06-10&nbsp;07:32:43',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;33,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'139f393594aabb20543543bd7d3192422b886f58e04a910637b41f14d0cad375',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;75},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2021-06-10&nbsp;07:31:49',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;34,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'a506c6cf25de202e6b2bf60fe0236911a6ff8aa33f12a78edad9165ab0851caf',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;75},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2021-03-02&nbsp;07:13:18',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;33,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'feb0a0f5ffba9d7b7d6878a8890a6d67d3f8ef6106e4e88719a63c3351e46a06',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;76},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2021-02-08&nbsp;02:39:20',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;18,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'230e2a06df2cd7574ee15cb13714d77182f28d50f83a6ed58af39f1966177769',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;76},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2020-10-31&nbsp;16:15:20',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;30,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'36bf7b2ab7968880ccc696927c03167b6056e73043fd97a33d2468383a5bafce',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;76},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2020-10-19&nbsp;16:08:06',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;28,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'1aaf7bc48ff75e870db4fe6ec0b3ed9d99876d7e2fb3d5c4613cca92bbb95e1b',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;75},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2020-09-09&nbsp;11:54:11',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;24,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'9750b3be953bd31322dd173ca18f29e5997029b28b24fbeb5fec7ebb1974cb09',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;73},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2020-09-06&nbsp;07:41:39',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;23,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'c0ab7d1caabdd090b2399cd1193d2cc2334218d3f3f0d3164b61b6014fd308e9',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;73},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2020-09-09&nbsp;11:30:10',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;1,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'767fc7ae032403bce2dbcefa525cf1a9fd02bbb185e45aa88d9bc28a5f22a2b6',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;73},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2020-07-22&nbsp;02:02:29',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;26,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'132df864f6750d29bf9f762b298f377c13b899aa8d07c0a6bda58adcffd0d6f7',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;76},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2020-08-20&nbsp;06:57:04',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;30,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'2c40b76408d59f906f60db97ea36503bfc59aed22a154f5d564d8449c300594f',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;75}],<br>&nbsp;'detected_referrer_samples':&nbsp;[{'date':&nbsp;'2020-09-09&nbsp;11:30:10',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;1,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'767fc7ae032403bce2dbcefa525cf1a9fd02bbb185e45aa88d9bc28a5f22a2b6',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;73}],<br>&nbsp;'detected_urls':&nbsp;[{'positives':&nbsp;10,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2021-07-22&nbsp;15:03:53',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;90,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236/sugarcrm/themes/default/images/'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;9,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2021-07-22&nbsp;00:27:37',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;90,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236:443/sugarcrm/themes/default/images/stock.jpg'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;11,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2021-07-09&nbsp;11:00:43',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;89,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236:443/sugarcrm/themes/default/images/tshd.jpg'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;8,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2021-07-08&nbsp;11:39:22',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;89,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236/'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;12,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2021-07-08&nbsp;08:55:14',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;90,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236:443/sugarcrm/themes/default/images/bioset.jpg'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;9,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2021-06-28&nbsp;02:32:40',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;89,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236:443/sugarcrm/themes/default/images/mod.jpg'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;10,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2021-06-26&nbsp;00:05:01',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;89,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236:443/sugarcrm/themes/default/images/default.jpg'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;12,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2021-06-23&nbsp;12:00:19',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;88,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://dockerupdate.anondns.net/'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;12,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2021-06-21&nbsp;01:57:07',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;88,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;8,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2021-06-21&nbsp;01:50:52',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;89,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236:443/sugarcrm/themes/default/images/'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;9,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2021-06-19&nbsp;00:07:04',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;89,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236:443/sugarcrm/themes/default/images/kube.jpg'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;7,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2021-06-16&nbsp;08:08:57',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;89,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236:443/'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;8,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2021-06-09&nbsp;03:40:07',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;89,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'https://85.214.149.236/sugarcrm/themes/default/images'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;7,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2021-06-09&nbsp;03:18:37',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;89,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'https://85.214.149.236/sugarcrm/themes/default/images/'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;8,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2021-06-08&nbsp;15:50:06',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;89,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236:443/sugarcrm/themes/default/images'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;6,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2021-04-21&nbsp;00:07:34',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;87,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236/sugarcrm/themes/default/images/stock.jpg'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;5,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2021-04-01&nbsp;13:42:58',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;85,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236/sugarcrm/themes/default/images/mod.jpg'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;9,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2021-03-19&nbsp;18:12:09',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;85,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/Carray.jpg'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;6,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2021-01-12&nbsp;10:34:27',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;83,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236/sugarcrm/themes/default/images/kube.jpg'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;10,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-12-28&nbsp;02:17:00',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;83,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://dockerupdate.anondns.net/sugarcrm/themes/default/images/'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;6,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-12-19&nbsp;10:34:37',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;83,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236/sugarcrm/themes/default/images/default.jpg'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;6,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-11-12&nbsp;16:50:51',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;81,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236/sugarcrm/themes'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;14,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-11-10&nbsp;11:01:42',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;81,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/mos.jpg'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;14,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-11-08&nbsp;15:00:49',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;81,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/nk.jpg'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;6,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-11-04&nbsp;19:21:25',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;81,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236/sugarcrm/themes/default'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;6,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-10-29&nbsp;00:55:07',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;81,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236/sugarcrm/themes/default/images'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;12,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-09-28&nbsp;03:26:34',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;80,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://dockerupdate.anondns.net:443/sugarcrm'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;9,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-09-28&nbsp;03:06:19',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;80,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236/sugarcrm/.../dns'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;11,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-09-24&nbsp;14:01:08',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;80,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://dockerupdate.anondns.net/sugarcrm/themes/default/images'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;12,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-09-21&nbsp;17:20:19',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;80,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/carray.jpg'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;6,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-09-20&nbsp;16:04:57',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;80,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236/sugarcrm'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;9,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-09-17&nbsp;17:36:08',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;80,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236:443/sugarcrm/banner.php'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;11,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-09-10&nbsp;07:55:21',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;80,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://dockerupdate.anondns.net:443/sugarcrm/'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;10,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-09-09&nbsp;12:06:14',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;80,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/Carray.jpg/'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;4,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-09-09&nbsp;12:05:12',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;80,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236:443/sugarcrm/themes/default/images/bioset.jpg/'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;11,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-09-09&nbsp;11:59:35',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;80,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://dockerupdate.anondns.net/sugarcrm/themes/default/images/mos.jpg'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;5,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-09-09&nbsp;11:48:55',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;80,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236:443/sugarcrm/.../run'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;4,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-09-09&nbsp;11:44:28',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;80,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236:443/sugarcrm/themes/default/images/mod.js'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;6,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-09-09&nbsp;11:35:26',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;80,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236:443/sugarcrm/.../cron.sh'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;11,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-09-09&nbsp;11:30:00',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;80,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://dockerupdate.anondns.net/sugarcrm/themes/default/images/nk.jpg'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;5,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-09-05&nbsp;03:44:35',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;80,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236/sugarcrm/...'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;8,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-09-02&nbsp;06:09:23',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;80,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'https://dockerupdate.anondns.net/'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;6,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-09-01&nbsp;17:37:50',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;79,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236:443/sugarcrm/.../dns'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;1,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-08-28&nbsp;08:15:47',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;78,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236:443/sugarcrm/themes/default/images/mod.js\"'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;2,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-08-27&nbsp;13:22:06',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;78,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://85.214.149.236:443/sugarcrm/themes/default/images/zgrab.jpg'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;7,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-08-25&nbsp;14:52:00',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;79,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/portjoe.jpg'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;7,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-08-25&nbsp;07:02:55',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;79,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'positives':&nbsp;4,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'scan_date':&nbsp;'2020-08-24&nbsp;07:34:44',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;79,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'url':&nbsp;'http://dockerupdate.anondns.net:443/sugarcrm/themes/default/images/01.jpg'}],<br>&nbsp;'resolutions':&nbsp;[{'hostname':&nbsp;'dockerupdate.anondns.net',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'last_resolved':&nbsp;'2020-08-14&nbsp;18:56:08'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'hostname':&nbsp;'h2381205.stratoserver.net',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'last_resolved':&nbsp;'2020-08-06&nbsp;12:19:57'}],<br>&nbsp;'response_code':&nbsp;1,<br>&nbsp;'undetected_communicating_samples':&nbsp;[{'date':&nbsp;'2021-06-24&nbsp;10:15:37',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;0,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'7149b53e4a3f9de2a7d47190af64f8b609618ed09f8440a64175049a90336775',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;75},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2021-06-09&nbsp;10:51:49',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;0,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'45cc4f38340bf1d4bb0010114ccf03112d14dee7815aa797d20854605fdca2d2',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;74},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2021-06-12&nbsp;19:00:20',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;0,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'020531aef7e069ee6e384f2fe9c49db9d99292d559c72da95276c2788b17d386',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;74},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2020-12-10&nbsp;15:39:02',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;0,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'d9c46904d5bb808f2f0c28e819a31703f5155c4df66c4c4669f5d9e81f25dc66',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;75},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2020-08-28&nbsp;07:36:29',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;0,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'d333c3cfb8b9ad1da5ee50f96a55dfbe70196f05fd88b5f04e925e32305cfff8',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;73},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2020-08-28&nbsp;07:40:32',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;0,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'18c178fb224ec17718e5f70a92041e721d9e380e70063cc4bfe3f61d6feb72d9',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;73},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2020-08-28&nbsp;07:35:10',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;0,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'a5d14bb053b03e81e58101516c782360fe64d6469852c6aa06fc47c08b30b127',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;73},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2020-08-26&nbsp;22:30:40',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;0,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'ba16f24e6294e8da28782c1d8e00189950dd4cbbb061ef13d1a4d84305651768',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;73},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2020-08-26&nbsp;14:29:14',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;0,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'1861eee8333dadcfe0d0dc10461f5f82fada8e42db9aa9efba6f258182e9c546',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;73},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2020-08-24&nbsp;07:12:27',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;0,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'b485e6ccc9cfeb9c2034cebfeaf1bb3b3db0ac9996e5260fc1e95ce852b757c4',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;73}],<br>&nbsp;'undetected_downloaded_samples':&nbsp;[{'date':&nbsp;'2020-09-09&nbsp;11:44:35',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;0,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'e8812c8ff47b0542c7ee4d6bdff5bfbfd488a8e363d884074089c54b6ffc9789',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;73},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{'date':&nbsp;'2020-07-16&nbsp;04:03:02',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'positives':&nbsp;0,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'sha256':&nbsp;'1474298ed7a5c63ca8098794cd743a276807cca0e678e046160718626bb038f3',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'total':&nbsp;76}],<br>&nbsp;'undetected_referrer_samples':&nbsp;[],<br>&nbsp;'undetected_urls':&nbsp;[['http://h2381205.stratoserver.net/',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'011bcc2795245bb9fac15c54e0e189b0c6e2f24c42c57fec7cfc654a8bb95106',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;80,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'2020-11-02&nbsp;13:02:39'],<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;['http://85.214.149.236:443/sugarcrm/.../',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'9ffbd9455f6aa190b4270b0d8bfe2c863c6495b94b0f510169999135476e4ed4',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;79,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'2020-07-14&nbsp;10:52:05']],<br>&nbsp;'verbose_msg':&nbsp;'IP&nbsp;address&nbsp;in&nbsp;dataset'}</pre>\n",
       "        </details>\n",
       "        "
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {}
    }
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "## 6.2 IP geolocation lookup with Maxmind GeoLite2\r\n",
    "\r\n",
    "<div style=\"border: solid; padding: 5pt\"><b>Note:</b>\r\n",
    "You may see the GeoLite driver downloading its database the first time you run this.\r\n",
    "</div>\r\n",
    "<br>\r\n",
    "<details>\r\n",
    "    <summary>Learn more about MSTICPy GeoIP providers...</summary>\r\n",
    "    <p>\r\n",
    "    <a href=https://msticpy.readthedocs.io/en/latest/data_acquisition/GeoIPLookups.html >MSTICPy GeoIP Providers</a>\r\n",
    "    </p>\r\n",
    "</details>\r\n",
    "<br>\r\n"
   ],
   "metadata": {}
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "source": [
    "geo_ip = GeoLiteLookup()\r\n",
    "raw_res, ip_entity = geo_ip.lookup_ip(\"85.214.149.236\")\r\n",
    "display(ip_entity[0])"
   ],
   "outputs": [
    {
     "output_type": "display_data",
     "data": {
      "text/html": [
       "\n",
       "This product includes GeoLite2 data created by MaxMind, available from\n",
       "<a href=\"https://www.maxmind.com\">https://www.maxmind.com</a>.\n"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {}
    },
    {
     "output_type": "stream",
     "name": "stdout",
     "text": [
      "Latest local Maxmind City Database present is older than 30 days. Attempting to download new database to C:\\Users\\Ian\\.msticpy\n",
      "Downloading and extracting GeoLite DB archive from MaxMind....\n",
      "Extraction complete. Local Maxmind city DB: C:\\Users\\Ian\\.msticpy\\GeoLite2-City.mmdb\n"
     ]
    },
    {
     "output_type": "display_data",
     "data": {
      "text/html": [
       "<h3>ipaddress</h3>{&nbsp;'AdditionalData':&nbsp;{},<br>&nbsp;&nbsp;'Address':&nbsp;'85.214.149.236',<br>&nbsp;&nbsp;'Location':&nbsp;{&nbsp;'AdditionalData':&nbsp;{},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'CountryCode':&nbsp;'DE',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'CountryName':&nbsp;'Germany',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'Latitude':&nbsp;51.2993,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'Longitude':&nbsp;9.491,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'Type':&nbsp;'geolocation',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'edges':&nbsp;set()},<br>&nbsp;&nbsp;'ThreatIntelligence':&nbsp;[],<br>&nbsp;&nbsp;'Type':&nbsp;'ipaddress',<br>&nbsp;&nbsp;'edges':&nbsp;set()}"
      ],
      "text/plain": [
       "IpAddress(Address=85.214.149.236, Location={ 'AdditionalData': {},\n",
       "  'CountryCode': 'DE',\n",
       "...)"
      ]
     },
     "metadata": {}
    }
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "---\r\n",
    "\r\n",
    "# 7. Conclusion\r\n",
    "\r\n",
    "In this notebook, we've gone through the basics of installing MSTICPy and setting up configuration.\r\n",
    "We also briefly introduced:\r\n",
    "\r\n",
    "- QueryProviders and querying data from Azure Sentinel\r\n",
    "- Threat Intelligence lookups using VirusTotal\r\n",
    "- Geo-location lookups using MaxMind GeoLite2\r\n",
    "\r\n",
    "We encourage you to run through the **A Tour of Cybersec notebook features** notebook\r\n",
    "to get a better feel for some more of the capabilities of notebooks and MSTICPy.</br>\r\n",
    "\r\n",
    "This notebook includes:\r\n",
    "\r\n",
    "- more examples of queries\r\n",
    "- visualizing your data\r\n",
    "- brief introduction to using panda to manipulate your data.\r\n",
    "\r\n",
    "Also try out any of the notebooks in the [Azure Sentinel Notebooks GitHub repo](https://github.com/Azure/Azure-Sentinel-Notebooks)\r\n"
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "---\r\n",
    "\r\n",
    "# 8. Futher resources\r\n",
    "\r\n",
    " - [Jupyter Notebooks: An Introduction](https://realpython.com/jupyter-notebook-introduction/)\r\n",
    " - [Threat Hunting in the cloud with Azure Notebooks](https://medium.com/@maarten.goet/threat-hunting-in-the-cloud-with-azure-notebooks-supercharge-your-hunting-skills-using-jupyter-8d69218e7ca0)\r\n",
    " - [MSTICPy documentation](https://msticpy.readthedocs.io/)\r\n",
    " - [Azure Sentinel Notebooks documentation](https://docs.microsoft.com/en-us/azure/sentinel/notebooks)\r\n",
    " - [The Infosec Jupyterbook](https://infosecjupyterbook.com/introduction.html)\r\n",
    " - [Linux Host Explorer Notebook walkthrough](https://techcommunity.microsoft.com/t5/azure-sentinel/explorer-notebook-series-the-linux-host-explorer/ba-p/1138273)\r\n",
    " - [Why use Jupyter for Security Investigations](https://techcommunity.microsoft.com/t5/azure-sentinel/why-use-jupyter-for-security-investigations/ba-p/475729)\r\n",
    " - [Security Investigtions with Azure Sentinel & Notebooks](https://techcommunity.microsoft.com/t5/azure-sentinel/security-investigation-with-azure-sentinel-and-jupyter-notebooks/ba-p/432921)\r\n",
    " - [Pandas Documentation](https://pandas.pydata.org/pandas-docs/stable/user_guide/index.html)\r\n",
    " - [Bokeh Documentation](https://docs.bokeh.org/en/latest/)"
   ],
   "metadata": {}
  },
  {
   "cell_type": "markdown",
   "source": [
    "---\r\n",
    "\r\n",
    "# 9. FAQs\r\n",
    "\r\n",
    "The following links take you to short articles in the Azure-Sentinel-Notebooks Wiki\r\n",
    "that answer common questions.\r\n",
    "\r\n",
    "## [How can I download all Azure-Sentinel-Notebooks notebooks to my Azure ML workspace?](https://github.com/Azure/Azure-Sentinel-Notebooks/wiki/How-can-I-download-all-Azure-Sentinel-Notebooks-notebooks-to-my-Azure-ML-workspace%3F)\r\n",
    "\r\n",
    "## [Can I install MSTICPy by default on a new AML compute?](https://github.com/Azure/Azure-Sentinel-Notebooks/wiki/Can-I-install-MSTICPy-by-default-on-a-new-AML-compute%3F)\r\n",
    "\r\n",
    "## [I see error \"Runtime dependency of PyGObject is missing\" when I load a query provider](https://github.com/Azure/Azure-Sentinel-Notebooks/wiki/%22Runtime-dependency-of-PyGObject-is-missing%22-error)\r\n",
    "\r\n",
    "## [MSTICPy and other packages do not install properly when switching between the Python 3.6 or 3.8 Kernels](https://github.com/Azure/Azure-Sentinel-Notebooks/wiki/MSTICPy-and-other-packages-do-not-install-properly-when-switching-between-the-Python-3.6-or-3.8-Kernels)\r\n",
    "\r\n",
    "## [My user account/credentials do not get cached between notebook runs - using Azure CLI](https://github.com/Azure/Azure-Sentinel-Notebooks/wiki/Caching-credentials-with-Azure-CLI)\r\n",
    "\r\n"
   ],
   "metadata": {}
  }
 ],
 "metadata": {
  "interpreter": {
   "hash": "b736adfe05d9ae282eea4c01a733d58a0215ef3399d39339e6557e4c515b0f48"
  },
  "kernelspec": {
   "display_name": "Python 3.8 - AzureML",
   "name": "python38-azureml"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.10"
  },
  "widgets": {
   "application/vnd.jupyter.widget-state+json": {
    "state": {},
    "version_major": 2,
    "version_minor": 0
   }
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}