docs/notebooks/NotebookletsDemo.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Jupyter Notebooklets Demo\n",
    "\n",
    "### [@ianhellen](https://twitter.com/ianhellen)\n",
    "#### Principal Dev - MSTIC, Azure Security"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# What are notebooklets?\n",
    "\n",
    "Collections of notebook cells that implement some useful reusable sequence\n",
    "\n",
    "## Rationale\n",
    "- Notebook code can quickly become complex and length:\n",
    "  - Can obscure the information you are trying to display\n",
    "  - Can be intimidating to non-developers\n",
    "- Notebook code cells are not easily re-useable:\n",
    "  - You can copy and paste but how do you sync changes back to original notebook?\n",
    "  - Difficult to discover code snippets in notebooks\n",
    "- Notebook code is often fragile:\n",
    "  - Often not parameterized\n",
    "  - Code blocks are frequently dependent on global values assigned earlier\n",
    "  - Output data is not in any standard format\n",
    "  - Difficult to test\n",
    "\n",
    "## Characteristics of Notebooklets\n",
    "- One or small number of entry points\n",
    "- Must be paramertizable (e.g. you can supply hostname, IP Address, time range, etc.)\n",
    "- Can query, process or visualize data (or any combination)\n",
    "- Typically return a result or package of results for use later in the notebook\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "---\n",
    "# Initializing the Notebook\n",
    "Notebooklets depend on msticpy so we import/initialize this package."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {
    "ExecuteTime": {
     "end_time": "2020-02-28T21:13:24.369073Z",
     "start_time": "2020-02-28T21:13:24.260137Z"
    }
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Processing imports....\n",
      "Checking configuration....\n",
      "No errors found.\n",
      "\n",
      "The following configuration warnings were found: \n",
      " -------------------------------------------------\n",
      "No AzureCLI section in settings.\n",
      "Setting options....\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<h3>Notebook setup complete</h3>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "import sys\n",
    "import os\n",
    "from IPython.display import display, HTML, Markdown\n",
    "\n",
    "from msticpy.nbtools.nbinit import init_notebook\n",
    "init_notebook(namespace=globals());"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "---\n",
    "# Notebooklets in use\n",
    "\n",
    "## Import the package\n",
    "- Discovers and imports notebooklet classes/modules"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [],
   "source": [
    "# pip install msticnb"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "7 notebooklets loaded.\n"
     ]
    }
   ],
   "source": [
    "import msticnb as nb"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "---\n",
    "## Calling init()\n",
    "Before using any of the notebooklets you need to initialize the providers.\n",
    "\n",
    "Providers are the libraries that do the work of fetching data from external sources that are\n",
    "then used by the notebooklet code.\n",
    "\n",
    "init() does the following:\n",
    "- Loads required data providers\n",
    "- Authenticates to providers if required at startup\n",
    "- Can supply list of providers to load\n",
    "- Can pass parameters to each provider (settings loaded from config by default)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "\u001b[1;31mSignature:\u001b[0m\n",
       "\u001b[0mnb\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0minit\u001b[0m\u001b[1;33m(\u001b[0m\u001b[1;33m\n",
       "\u001b[0m    \u001b[0mquery_provider\u001b[0m\u001b[1;33m:\u001b[0m\u001b[0mstr\u001b[0m\u001b[1;33m=\u001b[0m\u001b[1;34m'LogAnalytics'\u001b[0m\u001b[1;33m,\u001b[0m\u001b[1;33m\n",
       "\u001b[0m    \u001b[0mproviders\u001b[0m\u001b[1;33m:\u001b[0m\u001b[0mUnion\u001b[0m\u001b[1;33m[\u001b[0m\u001b[0mList\u001b[0m\u001b[1;33m[\u001b[0m\u001b[0mstr\u001b[0m\u001b[1;33m]\u001b[0m\u001b[1;33m,\u001b[0m \u001b[0mNoneType\u001b[0m\u001b[1;33m]\u001b[0m\u001b[1;33m=\u001b[0m\u001b[1;32mNone\u001b[0m\u001b[1;33m,\u001b[0m\u001b[1;33m\n",
       "\u001b[0m    \u001b[1;33m**\u001b[0m\u001b[0mkwargs\u001b[0m\u001b[1;33m,\u001b[0m\u001b[1;33m\n",
       "\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n",
       "\u001b[1;31mDocstring:\u001b[0m\n",
       "Instantiate an instance of DataProviders.\n",
       "\n",
       "Parameters\n",
       "----------\n",
       "query_provider : str, optional\n",
       "    DataEnvironment name of the primary query provider.\n",
       "    You can add addtional query providers by including them\n",
       "    in the `providers` list.\n",
       "providers : Optional[List[str]], optional\n",
       "    A list of provider names, by default \"LogAnalytics\"\n",
       "\n",
       "Other Parameters\n",
       "----------------\n",
       "kwargs\n",
       "    You can pass parameters to individual providers using\n",
       "    the following notation:\n",
       "    `ProviderName_param_name=\"param_value\"\n",
       "    Where `ProviderName` is the name of the data provider,\n",
       "    `param_name` is the parameter name expected by the\n",
       "    provider and `param_value` is the value to assign to\n",
       "    `param_name`. `param_value` can be any type.\n",
       "\n",
       "    Depending on the provider, these parameters (with the\n",
       "    prefix stripped) are sent to either the constructor or\n",
       "    `connect` method.\n",
       "\n",
       "Notes\n",
       "-----\n",
       "To see a list of currently supported providers call:\n",
       "`DataProviders.list_providers()`\n",
       "\u001b[1;31mFile:\u001b[0m      e:\\src\\msticnb\\msticnb\\data_providers.py\n",
       "\u001b[1;31mType:\u001b[0m      function\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "nb.init?"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Available Providers"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "['LogAnalytics',\n",
       " 'AzureSentinel',\n",
       " 'Kusto',\n",
       " 'AzureSecurityCenter',\n",
       " 'SecurityGraph',\n",
       " 'MDATP',\n",
       " 'LocalData',\n",
       " 'Splunk',\n",
       " 'tilookup',\n",
       " 'geolitelookup',\n",
       " 'ipstacklookup']"
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "nb.DataProviders.list_providers()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Default Providers"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "['tilookup', 'geolitelookup']"
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "nb.DataProviders.get_def_providers()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Running init, adding ipstacklookup to the default set of providers.\n",
    "You can also prefix a provider name with \"-\" to remove it from the default set.\n",
    "\n",
    "You can also specify an explicit list of providers to override the defaults entirely. E.g\n",
    "```\n",
    "nb.init(query_provider=\"AzureSentinel\", providers=[\"ipstacklookup\", \"tilookup\"])\n",
    "```\n",
    "\n",
    "> **Note** you cannot mix the \"+\"/\"-\" with un-prefixed provider names.\n",
    "> Doing this will cause an error to be thrown.\n",
    "> e.g. <br>\n",
    "> `nb.init(query_provider=\"AzureSentinel\", providers=[\"+ipstacklookup\", \"tilookup\"])`\n",
    "> <br>is illegal."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Using Open PageRank. See https://www.domcop.com/openpagerank/what-is-openpagerank\n",
      "Loaded providers: LogAnalytics, geolitelookup, tilookup\n"
     ]
    }
   ],
   "source": [
    "nb.init(query_provider=\"AzureSentinel\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "---\n",
    "## Using LocalData Provider\n",
    "The LocalData provider allows you to substitue local files for queries that you normally\n",
    "make to online data sources such as AzureSentinel.\n",
    "\n",
    "When we call init() we use the \"LocalData_\" prefix to pass the \"query_paths\" and \"data_paths\"\n",
    "parameters to the underlying provider.\n",
    "\n",
    "- Specify a folder where data files are stored with `LocalData_data_paths` (list[str])\n",
    "- Specify a folder containing query definition files `LocalData_query_paths` (list[str])\n",
    "\n",
    "\n",
    "In notebooklets queries are available as self.query_provider"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Loaded providers: LocalData, geolitelookup\n"
     ]
    }
   ],
   "source": [
    "nb.init(\n",
    "    \"LocalData\", providers=[\"-tilookup\"],\n",
    "    LocalData_data_paths=[\"/src/msticnb/tests/testdata\"],\n",
    "    LocalData_query_paths=[\"/src/msticnb/tests/testdata\"],\n",
    ")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "---\n",
    "## Notebooklet classes are discovered and imported at load time\n",
    "\n",
    "Although you can manually initiate a a run to read more notebooklets.\n",
    "\n",
    "#### The `nblts` attribute exposes notebooklets (niblets?) in a tree structure\n",
    "- Useful for autocomplete when you more or less know what you're looking for\n",
    "\n",
    "The top level in the hierarchy is the data environment (e.g. azsent == AzureSentinel). Beneath these the notebooklets are grouped into various categories such as host, network, etc."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "azsent\n",
      "  account\n",
      "    AccountSummary (Notebooklet)\n",
      "  alert\n",
      "    EnrichAlerts (Notebooklet)\n",
      "  host\n",
      "    HostLogonsSummary (Notebooklet)\n",
      "    HostSummary (Notebooklet)\n",
      "    WinHostEvents (Notebooklet)\n",
      "  network\n",
      "    NetworkFlowSummary (Notebooklet)\n",
      "template\n",
      "  TemplateNB (Notebooklet)\n",
      "\n"
     ]
    }
   ],
   "source": [
    "print(nb.nblts)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Access an individual notebook using this path structure"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "\u001b[1;31mInit signature:\u001b[0m\n",
       "\u001b[0mnb\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mnblts\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mazsent\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mhost\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mHostSummary\u001b[0m\u001b[1;33m(\u001b[0m\u001b[1;33m\n",
       "\u001b[0m    \u001b[0mdata_providers\u001b[0m\u001b[1;33m:\u001b[0m\u001b[0mUnion\u001b[0m\u001b[1;33m[\u001b[0m\u001b[1;33m<\u001b[0m\u001b[0mmsticnb\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mdata_providers\u001b[0m\u001b[1;33m.\u001b[0m\u001b[0mSingletonDecorator\u001b[0m \u001b[0mobject\u001b[0m \u001b[0mat\u001b[0m \u001b[1;36m0x00000223E99C63C8\u001b[0m\u001b[1;33m>\u001b[0m\u001b[1;33m,\u001b[0m \u001b[0mNoneType\u001b[0m\u001b[1;33m]\u001b[0m\u001b[1;33m=\u001b[0m\u001b[1;32mNone\u001b[0m\u001b[1;33m,\u001b[0m\u001b[1;33m\n",
       "\u001b[0m    \u001b[1;33m**\u001b[0m\u001b[0mkwargs\u001b[0m\u001b[1;33m,\u001b[0m\u001b[1;33m\n",
       "\u001b[0m\u001b[1;33m)\u001b[0m\u001b[1;33m\u001b[0m\u001b[1;33m\u001b[0m\u001b[0m\n",
       "\u001b[1;31mDocstring:\u001b[0m     \n",
       "HostSummary Notebooklet class.\n",
       "\n",
       "Queries and displays information about a host including:\n",
       "\n",
       "- IP address assignment\n",
       "- Related alerts\n",
       "- Related hunting/investigation bookmarks\n",
       "- Azure subscription/resource data.\n",
       "\n",
       "\n",
       "Default Options\n",
       "---------------\n",
       "- heartbeat: Query Heartbeat table for host information.\n",
       "- azure_net: Query AzureNetworkAnalytics table for host network topology information.\n",
       "- alerts: Query any alerts for the host.\n",
       "- bookmarks: Query any bookmarks for the host.\n",
       "- azure_api: Query Azure API for VM information.\n",
       "\n",
       "Other Options\n",
       "-------------\n",
       "None\n",
       "\u001b[1;31mInit docstring:\u001b[0m\n",
       "Intialize a new instance of the notebooklet class.\n",
       "\n",
       "Parameters\n",
       "----------\n",
       "data_providers : DataProviders, Optional\n",
       "    Optional DataProviders instance to query data.\n",
       "    Most classes require this.\n",
       "\n",
       "Raises\n",
       "------\n",
       "MsticnbDataProviderError\n",
       "    If DataProviders has not been initialized.\n",
       "    If required providers are specified by the notebooklet\n",
       "    but are not available.\n",
       "\u001b[1;31mFile:\u001b[0m           e:\\src\\msticnb\\msticnb\\nb\\azsent\\host\\host_summary.py\n",
       "\u001b[1;31mType:\u001b[0m           ABCMeta\n",
       "\u001b[1;31mSubclasses:\u001b[0m     \n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "nb.nblts.azsent.host.HostSummary?"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Notebooklets are exposed in `nb.nb_index`\n",
    "The values reflect the physical path in which the notebooklets are stored (you can ignore this)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "{'nblts.azsent.account.AccountSummary': msticnb.nb.azsent.account.account_summary.AccountSummary,\n",
       " 'nblts.azsent.alert.EnrichAlerts': msticnb.nb.azsent.alert.ti_enrich.EnrichAlerts,\n",
       " 'nblts.azsent.host.HostLogonsSummary': msticnb.nb.azsent.host.host_logons_summary.HostLogonsSummary,\n",
       " 'nblts.azsent.host.HostSummary': msticnb.nb.azsent.host.host_summary.HostSummary,\n",
       " 'nblts.azsent.host.WinHostEvents': msticnb.nb.azsent.host.win_host_events.WinHostEvents,\n",
       " 'nblts.azsent.network.NetworkFlowSummary': msticnb.nb.azsent.network.network_flow_summary.NetworkFlowSummary,\n",
       " 'nblts.template.TemplateNB': msticnb.nb.template.nb_template.TemplateNB}"
      ]
     },
     "execution_count": 12,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "nb.nb_index"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## There is a find function that looks for:\n",
    "- text or regulate expressions\n",
    "- searches class docstring\n",
    "- metadata such as entities supported and options supported"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "[('HostSummary', msticnb.nb.azsent.host.host_summary.HostSummary),\n",
       " ('NetworkFlowSummary',\n",
       "  msticnb.nb.azsent.network.network_flow_summary.NetworkFlowSummary)]"
      ]
     },
     "execution_count": 13,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "nb.find(\"host, net.*\", full_match=True)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "---\n",
    "# More detailed (and user-friendly) help in the `show_help()` method"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "nb.nblts.azsent.host.HostSummary.show_help()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "---\n",
    "# How are notebooklets used?"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Most require time range parameters\n",
    "\n",
    "Usually the notebooklet also the ID of the entity that you're running the notebooklet for. For example, a host name, an IP Address, etc.\n",
    "\n",
    "Some notebooklets process data in the form of a dataframe. Use the `data` parameter to pass this.\n",
    "\n",
    "> **Note** You can also pass other parameters used by the notebooklet as keyword arguments (`**kwargs`)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 30,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "19ca7b6a4f7b4587a32b236dbaeb313b",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "HTML(value='<h4>Set query time boundaries</h4>')"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "bda48c59266a4eb1b8363ecca7e42a59",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "HBox(children=(DatePicker(value=datetime.date(2019, 2, 10), description='Origin Date'), Text(value='00:00:00',…"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "10eea0e2e8a244bf9c6c9419a4e654dd",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "VBox(children=(IntRangeSlider(value=(-10, 1), description='Time Range (day):', layout=Layout(width='80%'), max…"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "time_span = nbwidgets.QueryTime(auto_display=True, units=\"day\", origin_time=pd.to_datetime(\"2019-02-10\"), before=10)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Run the notebooklet using the `run()` method\n",
    "\n",
    ">  **Note:** You'll want to assign the return value of `run()` to something or terminate with a semicolon<br>\n",
    ">  Both the notebooklet and the return `result` class generate displayable output - so you'll get\n",
    ">  a lot of duplicated output."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 31,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "        <style>\n",
       "            div.solid {border: thin solid black; padding:10px;}\n",
       "            p.title {background-color:Tomato; padding:5px;}\n",
       "            ul.circle {list-style-type: circle;}\n",
       "        </style>\n",
       "        <div class='solid'><h3><p class='title'>MsticpyAzureConfigError - no AzureCLI settings available.</p></h3>No AzureCLI section found in configuration settings.<br>Ensure that the path to your msticpyconfig.yaml is specified with the MSTICPYCONFIG environment variable.<br>Or ensure that a copy of this file is in the current directory.<br><br>For more help on fixing this error see:<br><ul class='circle'><li><a href='https://msticpy.readthedocs.io/en/latest/data_acquisition/AzureData.html#instantiating-and-connecting-with-an-azure-data-connector'>Using the Azure API connector</a></li></ul>You can find other related help here:<br><ul class='circle'><li><a href='https://msticpy.readthedocs.io/en/latest/data_acquisition/AzureData.html#instantiating-and-connecting-with-an-azure-data-connector'>Using the Azure API connector</a></li></ul></div>"
      ],
      "text/plain": [
       "msticpy.common.exceptions.MsticpyAzureConfigError('No AzureCLI section found in configuration settings.')"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Warning: ('no AzureCLI settings available.', 'No AzureCLI section found in configuration settings.', 'Ensure that the path to your msticpyconfig.yaml is specified with the MSTICPYCONFIG environment variable.', 'Or ensure that a copy of this file is in the current directory.', ('Using the Azure API connector', 'https://msticpy.readthedocs.io/en/latest/data_acquisition/AzureData.html#instantiating-and-connecting-with-an-azure-data-connector'), ('Using the Azure API connector', 'https://msticpy.readthedocs.io/en/latest/data_acquisition/AzureData.html#instantiating-and-connecting-with-an-azure-data-connector'))\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<h1>Host Entity Summary</h1>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "This shows a summary data for a host. It shows host properties obtained from OMS Heartbeat and Azure API.<br>It also lists Azure Sentinel alerts and bookmakrs related to to the host.<br>Data and plots are stored in the result class returned by this function."
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Getting data from SecurityEvent...\n"
     ]
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Getting data from Syslog...\n"
     ]
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Unique host found: MSTICAlertsWin1\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<h2>Host Entity details</h2>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "These are the host entity details gathered from Heartbeat and, if applicable, AzureNetworkAnalytics and Azure management API.<br>The data shows OS information, IP Addresses assigned the host and any Azure VM information available."
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{ 'AdditionalData': {},\n",
      "  'AzureDetails': { 'ResourceGroup': 'ASIHUNTOMSWORKSPACERG',\n",
      "                    'ResourceId': '/subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourceGroups/ASIHUNTOMSWORKSPACERG/providers/Microsoft.Compute/virtualMachines/MSTICAlertsWin1',\n",
      "                    'ResourceProvider': 'Microsoft.Compute',\n",
      "                    'ResourceType': 'virtualMachines',\n",
      "                    'Solutions': '\"security\", \"changeTracking\", \"networkMonitoring\", \"serviceMap\", '\n",
      "                                 '\"dnsAnalytics\", \"securityCenterFree\", \"securityInsights\", '\n",
      "                                 '\"windowsEventForwarding\"',\n",
      "                    'SubscriptionId': '40dcc8bf-0478-4f3b-b275-ed0a94f2c013'},\n",
      "  'Environment': 'Azure',\n",
      "  'HostName': 'MSTICAlertsWin1',\n",
      "  'IPAddress': { 'AdditionalData': {},\n",
      "                 'Address': '40.76.43.124',\n",
      "                 'Location': { 'AdditionalData': {},\n",
      "                               'CountryName': 'United States',\n",
      "                               'Latitude': 38.71,\n",
      "                               'Longitude': -78.16,\n",
      "                               'Type': 'geolocation'},\n",
      "                 'Type': 'ipaddress'},\n",
      "  'OSName': '',\n",
      "  'OSType': 'Windows',\n",
      "  'OSVMajorVersion': '10',\n",
      "  'OSVMinorVersion': '0',\n",
      "  'OmsSolutions': [ '\"security\"',\n",
      "                    '\"changeTracking\"',\n",
      "                    '\"networkMonitoring\"',\n",
      "                    '\"serviceMap\"',\n",
      "                    '\"dnsAnalytics\"',\n",
      "                    '\"securityCenterFree\"',\n",
      "                    '\"securityInsights\"',\n",
      "                    '\"windowsEventForwarding\"'],\n",
      "  'SourceComputerId': '263a788b-6526-4cdc-8ed9-d79402fe4aa0',\n",
      "  'Type': 'host',\n",
      "  'VMUUID': '3b8d40a2-33fa-4230-9dc1-794aabdd225c',\n",
      "  'private_ips': [IpAddress(Type=ipaddress, Address=10.0.3.5)],\n",
      "  'public_ips': [ IpAddress(Type=ipaddress, Address=40.76.43.124, Location={ 'AdditionalData': {},\n",
      "  'City':...)]}\n"
     ]
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<p style=''>Found 301 related alerts (53) types</p>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<h2>Timeline of related alerts</h2>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "Each marker on the timeline indicates one or more alerts related to the host."
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"2995\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "\n",
       "(function(root) {\n",
       "  function now() {\n",
       "    return new Date();\n",
       "  }\n",
       "\n",
       "  var force = true;\n",
       "\n",
       "  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n",
       "    root._bokeh_onload_callbacks = [];\n",
       "    root._bokeh_is_loading = undefined;\n",
       "  }\n",
       "\n",
       "  var JS_MIME_TYPE = 'application/javascript';\n",
       "  var HTML_MIME_TYPE = 'text/html';\n",
       "  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n",
       "  var CLASS_NAME = 'output_bokeh rendered_html';\n",
       "\n",
       "  /**\n",
       "   * Render data to the DOM node\n",
       "   */\n",
       "  function render(props, node) {\n",
       "    var script = document.createElement(\"script\");\n",
       "    node.appendChild(script);\n",
       "  }\n",
       "\n",
       "  /**\n",
       "   * Handle when an output is cleared or removed\n",
       "   */\n",
       "  function handleClearOutput(event, handle) {\n",
       "    var cell = handle.cell;\n",
       "\n",
       "    var id = cell.output_area._bokeh_element_id;\n",
       "    var server_id = cell.output_area._bokeh_server_id;\n",
       "    // Clean up Bokeh references\n",
       "    if (id != null && id in Bokeh.index) {\n",
       "      Bokeh.index[id].model.document.clear();\n",
       "      delete Bokeh.index[id];\n",
       "    }\n",
       "\n",
       "    if (server_id !== undefined) {\n",
       "      // Clean up Bokeh references\n",
       "      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n",
       "      cell.notebook.kernel.execute(cmd, {\n",
       "        iopub: {\n",
       "          output: function(msg) {\n",
       "            var id = msg.content.text.trim();\n",
       "            if (id in Bokeh.index) {\n",
       "              Bokeh.index[id].model.document.clear();\n",
       "              delete Bokeh.index[id];\n",
       "            }\n",
       "          }\n",
       "        }\n",
       "      });\n",
       "      // Destroy server and session\n",
       "      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n",
       "      cell.notebook.kernel.execute(cmd);\n",
       "    }\n",
       "  }\n",
       "\n",
       "  /**\n",
       "   * Handle when a new output is added\n",
       "   */\n",
       "  function handleAddOutput(event, handle) {\n",
       "    var output_area = handle.output_area;\n",
       "    var output = handle.output;\n",
       "\n",
       "    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n",
       "    if ((output.output_type != \"display_data\") || (!output.data.hasOwnProperty(EXEC_MIME_TYPE))) {\n",
       "      return\n",
       "    }\n",
       "\n",
       "    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n",
       "\n",
       "    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n",
       "      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n",
       "      // store reference to embed id on output_area\n",
       "      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n",
       "    }\n",
       "    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n",
       "      var bk_div = document.createElement(\"div\");\n",
       "      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n",
       "      var script_attrs = bk_div.children[0].attributes;\n",
       "      for (var i = 0; i < script_attrs.length; i++) {\n",
       "        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n",
       "        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n",
       "      }\n",
       "      // store reference to server id on output_area\n",
       "      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n",
       "    }\n",
       "  }\n",
       "\n",
       "  function register_renderer(events, OutputArea) {\n",
       "\n",
       "    function append_mime(data, metadata, element) {\n",
       "      // create a DOM node to render to\n",
       "      var toinsert = this.create_output_subarea(\n",
       "        metadata,\n",
       "        CLASS_NAME,\n",
       "        EXEC_MIME_TYPE\n",
       "      );\n",
       "      this.keyboard_manager.register_events(toinsert);\n",
       "      // Render to node\n",
       "      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n",
       "      render(props, toinsert[toinsert.length - 1]);\n",
       "      element.append(toinsert);\n",
       "      return toinsert\n",
       "    }\n",
       "\n",
       "    /* Handle when an output is cleared or removed */\n",
       "    events.on('clear_output.CodeCell', handleClearOutput);\n",
       "    events.on('delete.Cell', handleClearOutput);\n",
       "\n",
       "    /* Handle when a new output is added */\n",
       "    events.on('output_added.OutputArea', handleAddOutput);\n",
       "\n",
       "    /**\n",
       "     * Register the mime type and append_mime function with output_area\n",
       "     */\n",
       "    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n",
       "      /* Is output safe? */\n",
       "      safe: true,\n",
       "      /* Index of renderer in `output_area.display_order` */\n",
       "      index: 0\n",
       "    });\n",
       "  }\n",
       "\n",
       "  // register the mime type if in Jupyter Notebook environment and previously unregistered\n",
       "  if (root.Jupyter !== undefined) {\n",
       "    var events = require('base/js/events');\n",
       "    var OutputArea = require('notebook/js/outputarea').OutputArea;\n",
       "\n",
       "    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n",
       "      register_renderer(events, OutputArea);\n",
       "    }\n",
       "  }\n",
       "\n",
       "  \n",
       "  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n",
       "    root._bokeh_timeout = Date.now() + 5000;\n",
       "    root._bokeh_failed_load = false;\n",
       "  }\n",
       "\n",
       "  var NB_LOAD_WARNING = {'data': {'text/html':\n",
       "     \"<div style='background-color: #fdd'>\\n\"+\n",
       "     \"<p>\\n\"+\n",
       "     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n",
       "     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n",
       "     \"</p>\\n\"+\n",
       "     \"<ul>\\n\"+\n",
       "     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n",
       "     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n",
       "     \"</ul>\\n\"+\n",
       "     \"<code>\\n\"+\n",
       "     \"from bokeh.resources import INLINE\\n\"+\n",
       "     \"output_notebook(resources=INLINE)\\n\"+\n",
       "     \"</code>\\n\"+\n",
       "     \"</div>\"}};\n",
       "\n",
       "  function display_loaded() {\n",
       "    var el = document.getElementById(\"2995\");\n",
       "    if (el != null) {\n",
       "      el.textContent = \"BokehJS is loading...\";\n",
       "    }\n",
       "    if (root.Bokeh !== undefined) {\n",
       "      if (el != null) {\n",
       "        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n",
       "      }\n",
       "    } else if (Date.now() < root._bokeh_timeout) {\n",
       "      setTimeout(display_loaded, 100)\n",
       "    }\n",
       "  }\n",
       "\n",
       "\n",
       "  function run_callbacks() {\n",
       "    try {\n",
       "      root._bokeh_onload_callbacks.forEach(function(callback) {\n",
       "        if (callback != null)\n",
       "          callback();\n",
       "      });\n",
       "    } finally {\n",
       "      delete root._bokeh_onload_callbacks\n",
       "    }\n",
       "    console.debug(\"Bokeh: all callbacks have finished\");\n",
       "  }\n",
       "\n",
       "  function load_libs(css_urls, js_urls, callback) {\n",
       "    if (css_urls == null) css_urls = [];\n",
       "    if (js_urls == null) js_urls = [];\n",
       "\n",
       "    root._bokeh_onload_callbacks.push(callback);\n",
       "    if (root._bokeh_is_loading > 0) {\n",
       "      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n",
       "      return null;\n",
       "    }\n",
       "    if (js_urls == null || js_urls.length === 0) {\n",
       "      run_callbacks();\n",
       "      return null;\n",
       "    }\n",
       "    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n",
       "    root._bokeh_is_loading = css_urls.length + js_urls.length;\n",
       "\n",
       "    function on_load() {\n",
       "      root._bokeh_is_loading--;\n",
       "      if (root._bokeh_is_loading === 0) {\n",
       "        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n",
       "        run_callbacks()\n",
       "      }\n",
       "    }\n",
       "\n",
       "    function on_error() {\n",
       "      console.error(\"failed to load \" + url);\n",
       "    }\n",
       "\n",
       "    for (var i = 0; i < css_urls.length; i++) {\n",
       "      var url = css_urls[i];\n",
       "      const element = document.createElement(\"link\");\n",
       "      element.onload = on_load;\n",
       "      element.onerror = on_error;\n",
       "      element.rel = \"stylesheet\";\n",
       "      element.type = \"text/css\";\n",
       "      element.href = url;\n",
       "      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n",
       "      document.body.appendChild(element);\n",
       "    }\n",
       "\n",
       "    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.1.1.min.js\": \"kLr4fYcqcSpbuI95brIH3vnnYCquzzSxHPU6XGQCIkQRGJwhg0StNbj1eegrHs12\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.1.1.min.js\": \"xIGPmVtaOm+z0BqfSOMn4lOR6ciex448GIKG4eE61LsAvmGj48XcMQZtKcE/UXZe\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.1.1.min.js\": \"Dc9u1wF/0zApGIWoBbH77iWEHtdmkuYWG839Uzmv8y8yBLXebjO9ZnERsde5Ln/P\", \"https://cdn.bokeh.org/bokeh/release/bokeh-gl-2.1.1.min.js\": \"cT9JaBz7GiRXdENrJLZNSC6eMNF3nh3fa5fTF51Svp+ukxPdwcU5kGXGPBgDCa2j\"};\n",
       "\n",
       "    for (var i = 0; i < js_urls.length; i++) {\n",
       "      var url = js_urls[i];\n",
       "      var element = document.createElement('script');\n",
       "      element.onload = on_load;\n",
       "      element.onerror = on_error;\n",
       "      element.async = false;\n",
       "      element.src = url;\n",
       "      if (url in hashes) {\n",
       "        element.crossOrigin = \"anonymous\";\n",
       "        element.integrity = \"sha384-\" + hashes[url];\n",
       "      }\n",
       "      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n",
       "      document.head.appendChild(element);\n",
       "    }\n",
       "  };\n",
       "\n",
       "  function inject_raw_css(css) {\n",
       "    const element = document.createElement(\"style\");\n",
       "    element.appendChild(document.createTextNode(css));\n",
       "    document.body.appendChild(element);\n",
       "  }\n",
       "\n",
       "  \n",
       "  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.1.1.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.1.1.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.1.1.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-gl-2.1.1.min.js\"];\n",
       "  var css_urls = [];\n",
       "  \n",
       "\n",
       "  var inline_js = [\n",
       "    function(Bokeh) {\n",
       "      Bokeh.set_log_level(\"info\");\n",
       "    },\n",
       "    function(Bokeh) {\n",
       "    \n",
       "    \n",
       "    }\n",
       "  ];\n",
       "\n",
       "  function run_inline_js() {\n",
       "    \n",
       "    if (root.Bokeh !== undefined || force === true) {\n",
       "      \n",
       "    for (var i = 0; i < inline_js.length; i++) {\n",
       "      inline_js[i].call(root, root.Bokeh);\n",
       "    }\n",
       "    if (force === true) {\n",
       "        display_loaded();\n",
       "      }} else if (Date.now() < root._bokeh_timeout) {\n",
       "      setTimeout(run_inline_js, 100);\n",
       "    } else if (!root._bokeh_failed_load) {\n",
       "      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n",
       "      root._bokeh_failed_load = true;\n",
       "    } else if (force !== true) {\n",
       "      var cell = $(document.getElementById(\"2995\")).parents('.cell').data().cell;\n",
       "      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n",
       "    }\n",
       "\n",
       "  }\n",
       "\n",
       "  if (root._bokeh_is_loading === 0) {\n",
       "    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n",
       "    run_inline_js();\n",
       "  } else {\n",
       "    load_libs(css_urls, js_urls, function() {\n",
       "      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n",
       "      run_inline_js();\n",
       "    });\n",
       "  }\n",
       "}(window));"
      ],
      "application/vnd.bokehjs_load.v0+json": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  \n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"2995\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error() {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (var i = 0; i < css_urls.length; i++) {\n      var url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error;\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.1.1.min.js\": \"kLr4fYcqcSpbuI95brIH3vnnYCquzzSxHPU6XGQCIkQRGJwhg0StNbj1eegrHs12\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.1.1.min.js\": \"xIGPmVtaOm+z0BqfSOMn4lOR6ciex448GIKG4eE61LsAvmGj48XcMQZtKcE/UXZe\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.1.1.min.js\": \"Dc9u1wF/0zApGIWoBbH77iWEHtdmkuYWG839Uzmv8y8yBLXebjO9ZnERsde5Ln/P\", \"https://cdn.bokeh.org/bokeh/release/bokeh-gl-2.1.1.min.js\": \"cT9JaBz7GiRXdENrJLZNSC6eMNF3nh3fa5fTF51Svp+ukxPdwcU5kGXGPBgDCa2j\"};\n\n    for (var i = 0; i < js_urls.length; i++) {\n      var url = js_urls[i];\n      var element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error;\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.1.1.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.1.1.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.1.1.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-gl-2.1.1.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"2995\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));"
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "  <div class=\"bk-root\" id=\"7c5dc3cb-ff8c-49ef-8cd5-9f4afb813f2d\" data-root-id=\"3066\"></div>\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "(function(root) {\n",
       "  function embed_document(root) {\n",
       "    \n",
       "  var docs_json = {\"301f585a-aee0-405b-8809-2929c58514f3\":{\"roots\":{\"references\":[{\"attributes\":{\"children\":[{\"id\":\"2998\"},{\"id\":\"3030\"}]},\"id\":\"3066\",\"type\":\"Column\"},{\"attributes\":{\"fill_color\":{\"value\":\"navy\"},\"line_color\":{\"value\":\"navy\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3050\",\"type\":\"Circle\"},{\"attributes\":{\"base\":24,\"mantissas\":[1,2,4,6,8,12],\"max_interval\":43200000.0,\"min_interval\":3600000.0,\"num_minor_ticks\":0},\"id\":\"3077\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"bottom_units\":\"screen\",\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"top_units\":\"screen\"},\"id\":\"3022\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"axis\":{\"id\":\"3013\"},\"dimension\":1,\"grid_line_color\":null,\"ticker\":null},\"id\":\"3016\",\"type\":\"Grid\"},{\"attributes\":{},\"id\":\"3037\",\"type\":\"LinearScale\"},{\"attributes\":{\"callback\":null,\"formatters\":{\"@TimeGenerated\":\"datetime\"},\"tooltips\":[[\"AlertName\",\"@AlertName\"],[\"TimeGenerated\",\"@TimeGenerated{%F %T.%3N}\"]]},\"id\":\"2997\",\"type\":\"HoverTool\"},{\"attributes\":{\"data_source\":{\"id\":\"2996\"},\"glyph\":{\"id\":\"3050\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3051\"},\"selection_glyph\":null,\"view\":{\"id\":\"3053\"}},\"id\":\"3052\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"overlay\":{\"id\":\"3022\"}},\"id\":\"3018\",\"type\":\"BoxZoomTool\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"navy\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"navy\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3051\",\"type\":\"Circle\"},{\"attributes\":{\"days\":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31]},\"id\":\"3078\",\"type\":\"DaysTicker\"},{\"attributes\":{\"align\":\"right\",\"text\":\"Drag the middle or edges of the selection box to change the range in the main chart\",\"text_font_size\":{\"value\":\"10px\"}},\"id\":\"3046\",\"type\":\"Title\"},{\"attributes\":{\"days\":[1,4,7,10,13,16,19,22,25,28]},\"id\":\"3079\",\"type\":\"DaysTicker\"},{\"attributes\":{\"end\":1549845639049.9998,\"start\":1549251815950.0002},\"id\":\"3033\",\"type\":\"Range1d\"},{\"attributes\":{\"source\":{\"id\":\"2996\"}},\"id\":\"3053\",\"type\":\"CDSView\"},{\"attributes\":{\"data\":{\"AlertName\":[\"Security incident with shared process detected\",\"Digital currency mining related behavior detected\",\"Suspiciously named process detected\",\"Sample Alert Rule\",\"Potential attempt to bypass AppLocker detected\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Antimalware Action Taken\",\"Suspicious SVCHOST process executed\",\"Suspicious Activity Detected\",\"Suspicious SVCHOST process executed\",\"Digital currency mining related behavior detected\",\"Executable found running from a suspicious\\nlocation\",\"Suspicious Powershell Activity Detected\",\"Suspicious system process executed\",\"Suspicious Powershell Activity Detected\",\"Suspiciously named process detected\",\"Sample Alert Rule\",\"Suspicious system process executed\",\"Antimalware Action Taken\",\"Antimalware Action Taken\",\"Antimalware Action Taken\",\"Potential attempt to bypass AppLocker detected\",\"Suspiciously named process detected\",\"Suspiciously named process detected\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Security incident with shared process detected\",\"Executable found running from a suspicious\\nlocation\",\"Potential attempt to bypass AppLocker detected\",\"Suspicious system process executed\",\"Security incident with shared process detected\",\"Potential attempt to bypass AppLocker detected\",\"Suspicious Powershell Activity Detected\",\"Suspiciously named process detected\",\"Suspicious system process executed\",\"Digital currency mining related behavior detected\",\"Suspiciously named process detected\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Suspicious system process executed\",\"Ransomware indicators detected\",\"Azure Security Center test alert (not a threat)\",\"Suspicious double extension file executed\",\"Suspicious Volume Shadow Copy Activity\",\"Detected Petya ransomware indicators\",\"Suspicious process executed\",\"Suspiciously named process detected\",\"Suspicious SVCHOST process executed\",\"Rare SVCHOST service group executed\",\"Executable found running from a suspicious\\nlocation\",\"Suspicious WindowPosition registry value detected\",\"Suspicious process executed\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Suspicious SVCHOST process executed\",\"Detected Petya ransomware indicators\",\"Detected anomalous mix of upper and lower case\\ncharacters in command-line\",\"Ransomware indicators detected\",\"Suspicious Volume Shadow Copy Activity\",\"Suspicious WindowPosition registry value detected\",\"Digital currency mining related behavior detected\",\"Potential attempt to bypass AppLocker detected\",\"Suspicious system process executed\",\"Suspicious process executed\",\"Suspiciously named process detected\",\"Rare SVCHOST service group executed\",\"Suspicious double extension file executed\",\"Azure Security Center test alert (not a threat)\",\"Suspicious process executed\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Suspiciously named process detected\",\"Potential attempt to bypass AppLocker detected\",\"Suspicious WindowPosition registry value detected\",\"Suspicious system process executed\",\"Detected obfuscated command line.\",\"Suspicious Powershell Activity Detected\",\"Suspicious process executed\",\"Suspicious Powershell Activity Detected\",\"Suspicious Powershell Activity Detected\",\"Suspicious Volume Shadow Copy Activity\",\"Executable found running from a suspicious\\nlocation\",\"Suspicious process executed\",\"Suspicious Powershell Activity Detected\",\"Suspicious SVCHOST process executed\",\"Detected Petya ransomware indicators\",\"Azure Security Center test alert (not a threat)\",\"Ransomware indicators detected\",\"Security incident with shared process detected\",\"Suspicious double extension file executed\",\"Detected anomalous mix of upper and lower case\\ncharacters in command-line\",\"Digital currency mining related behavior detected\",\"Rare SVCHOST service group executed\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Suspicious WindowPosition registry value detected\",\"Suspicious system process executed\",\"Executable found running from a suspicious\\nlocation\",\"Suspicious process executed\",\"Suspicious process executed\",\"Suspiciously named process detected\",\"Rare SVCHOST service group executed\",\"Suspicious double extension file executed\",\"Detected Petya ransomware indicators\",\"Suspicious SVCHOST process executed\",\"Suspicious Volume Shadow Copy Activity\",\"Azure Security Center test alert (not a threat)\",\"Ransomware indicators detected\",\"Suspicious Account Creation Detected\",\"Potential attempt to bypass AppLocker detected\",\"Executable found running from a suspicious\\nlocation\",\"Suspicious system process executed\",\"Suspicious double extension file executed\",\"Suspicious process executed\",\"Suspicious WindowPosition registry value detected\",\"Suspicious Volume Shadow Copy Activity\",\"Azure Security Center test alert (not a threat)\",\"Detected obfuscated command line.\",\"Suspicious Powershell Activity Detected\",\"Rare SVCHOST service group executed\",\"Suspicious Powershell Activity Detected\",\"Ransomware indicators detected\",\"Detected Petya ransomware indicators\",\"Digital currency mining related behavior detected\",\"Executable found running from a suspicious\\nlocation\",\"Suspicious Powershell Activity Detected\",\"Suspiciously named process detected\",\"Suspicious Powershell Activity Detected\",\"Suspicious process executed\",\"Suspicious SVCHOST process executed\",\"Detected anomalous mix of upper and lower case\\ncharacters in command-line\",\"Suspicious SVCHOST process executed\",\"Ransomware indicators detected\",\"Detected anomalous mix of upper and lower case\\ncharacters in command-line\",\"Suspicious Account Creation Detected\",\"Detected obfuscated command line.\",\"Executable found running from a suspicious\\nlocation\",\"Suspicious Powershell Activity Detected\",\"Suspiciously named process detected\",\"Suspicious Powershell Activity Detected\",\"Suspicious system process executed\",\"Suspicious double extension file executed\",\"Suspicious Volume Shadow Copy Activity\",\"Detected Petya ransomware indicators\",\"Suspicious Powershell Activity Detected\",\"Rare SVCHOST service group executed\",\"Suspicious Powershell Activity Detected\",\"Suspicious WindowPosition registry value detected\",\"Potential attempt to bypass AppLocker detected\",\"Suspicious process executed\",\"Azure Security Center test alert (not a threat)\",\"Suspicious process executed\",\"Digital currency mining related behavior detected\",\"Executable found running from a suspicious\\nlocation\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Suspicious Account Creation Detected\",\"Suspicious Powershell Activity Detected\",\"Suspicious Powershell Activity Detected\",\"Suspicious WindowPosition registry value detected\",\"Suspicious Powershell Activity Detected\",\"Suspicious double extension file executed\",\"Suspicious Powershell Activity Detected\",\"Suspicious process executed\",\"Detected anomalous mix of upper and lower case\\ncharacters in command-line\",\"Executable found running from a suspicious\\nlocation\",\"Suspicious system process executed\",\"Suspiciously named process detected\",\"Suspicious process executed\",\"Detected obfuscated command line.\",\"Executable found running from a suspicious\\nlocation\",\"Potential attempt to bypass AppLocker detected\",\"Digital currency mining related behavior detected\",\"Suspicious Volume Shadow Copy Activity\",\"Suspicious SVCHOST process executed\",\"Detected Petya ransomware indicators\",\"Ransomware indicators detected\",\"Azure Security Center test alert (not a threat)\",\"Rare SVCHOST service group executed\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Detected Petya ransomware indicators\",\"Executable found running from a suspicious\\nlocation\",\"Suspiciously named process detected\",\"Azure Security Center test alert (not a threat)\",\"Suspicious SVCHOST process executed\",\"Suspicious process executed\",\"Suspicious WindowPosition registry value detected\",\"Rare SVCHOST service group executed\",\"Suspicious Volume Shadow Copy Activity\",\"Suspicious process executed\",\"Ransomware indicators detected\",\"Suspicious system process executed\",\"Random process name detected\",\"Suspicious double extension file executed\",\"Anomalous account creation detected\",\"Suspicious Account Creation Detected\",\"Suspiciously named process detected\",\"Suspicious Account Creation Detected\",\"Digital currency mining related behavior detected\",\"Detected encoded executable in command line data\",\"Detected suspicious new firewall rule\",\"Suspected Kerberos Golden Ticket attack parameters\\nobserved\",\"Detected suspicious commandline used to start all\\nexecutables in a directory\",\"Random process name detected\",\"Suspicious double extension file executed\",\"Suspicious Powershell Activity Detected\",\"Executable found running from a suspicious\\nlocation\",\"Potential attempt to bypass AppLocker detected\",\"Suspicious process executed\",\"Executable found running from a suspicious\\nlocation\",\"Suspicious Powershell Activity Detected\",\"Detected change to a registry key that can be\\nabused to bypass UAC\",\"Detected suspicious Set-ExecutionPolicy and WinRM\\nchanges\",\"Detected suspicious use of FTP -s Switch\",\"Suspicious Powershell Activity Detected\",\"Suspicious powershell cmdlets executed\",\"Possible credential dumping detected\",\"Detected suspicious credentials in commandline\",\"Suspicious Powershell Activity Detected\",\"Sample Alert Rule\",\"Suspicious WindowPosition registry value detected\",\"Detected actions indicative of disabling and\\ndeleting IIS log files.\",\"Potential attempt to bypass AppLocker detected\",\"Suspicious download using Certutil detected\",\"Sticky keys attack detected\",\"Detected suspicious named pipe communications\",\"Suspicious system process executed\",\"Detected decoding of an executable using built-in\\ncertutil.exe tool\",\"Detected potentially suspicious use of Telegram\\ntool\",\"Detected obfuscated command line.\",\"Detected possible local reconnaissance activity\",\"Suspicious process executed\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Suspicious SVCHOST process executed\",\"Detected suspicious execution via rundll32.exe\",\"Executable found running from a suspicious\\nlocation\",\"Detected suspicious execution via rundll32.exe\",\"Potential attempt to bypass AppLocker detected\",\"Suspicious system process executed\",\"Detected anomalous mix of upper and lower case\\ncharacters in command-line\",\"Detected suspicious commandline arguments\",\"Rare SVCHOST service group executed\",\"Suspiciously named process detected\",\"Executable found running from a suspicious\\nlocation\",\"Detected suspicious document credentials\",\"Detected suspicious execution of VBScript.Encode\\ncommand\",\"Detected suspicious file creation\",\"Detected suspicious use of Pcalua.exe to launch\\nexecutable code\",\"Detected suspicious use of Cacls to lower the\\nsecurity state of the system.\",\"Ransomware indicators detected\",\"Detected possible execution of malware dropper\",\"High risk software detected\",\"Detected suspicious file cleanup commands\",\"Detected possible execution of keygen executable\",\"Detected the disabling of critical services\",\"Suspicious double extension file executed\",\"Suspicious process executed\",\"Suspicious WindowPosition registry value detected\",\"Suspicious process executed\",\"Detected Petya ransomware indicators\",\"Suspicious Volume Shadow Copy Activity\",\"Azure Security Center test alert (not a threat)\",\"Digital currency mining related behavior detected\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Detected obfuscated command line.\",\"Suspiciously named process detected\",\"Potential attempt to bypass AppLocker detected\",\"Digital currency mining related behavior detected\",\"Suspicious Powershell Activity Detected\",\"Suspicious Powershell Activity Detected\",\"Suspicious Powershell Activity Detected\",\"Suspicious Powershell Activity Detected\",\"Suspicious Volume Shadow Copy Activity\",\"Suspicious WindowPosition registry value detected\",\"Rare SVCHOST service group executed\",\"Detected anomalous mix of upper and lower case\\ncharacters in command-line\",\"Executable found running from a suspicious\\nlocation\",\"Suspicious double extension file executed\",\"Suspicious process executed\",\"Detected Petya ransomware indicators\",\"Suspicious system process executed\",\"Ransomware indicators detected\",\"Azure Security Center test alert (not a threat)\",\"Suspicious process executed\",\"Suspicious SVCHOST process executed\",\"Security incident with shared process detected\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Sample Alert Rule\"],\"TimeGenerated\":{\"__ndarray__\":\"AIDuol6NdkIAgPdjSY12QgCAdGRJjXZCAIAwaVeMdkIAADRwVIx2QgCA9RxNjHZCAIDAz0KMdkIAgN84Qox2QgCA845BjHZCAAD2G0GMdkIAAPQVSYx2QgAAKZNLjHZCAAApk0uMdkIAACmTS4x2QgAAKZNLjHZCAAApk0uMdkIAgGeTS4x2QgAAya5JjHZCAACaiU2MdkIAgJeFTIx2QgCAl4VMjHZCAICXhUyMdkIAgHVtSox2QgCAjGxNjHZCAADBRE2MdkIAgMX6U4x2QgAAHIxQjHZCAIAdlpKMdkIAAPRUfYx2QgAA9FR9jHZCAAD0VH2MdkIAALqsaYx2QgAA5Rs+jHZCAACRKT6MdkIAAJEpPox2QgAAkSk+jHZCAACRKT6MdkIAAExzPox2QgAAF2E/jHZCAIDw8TuMdkIAANwUNYx2QgCACsASjHZCAAC0LhaMdkIAgCJRD4x2QgCAveELjHZCAICO+AWMdkIAgAX6BYx2QgCABfoFjHZCAIAL+QWMdkIAgAX6BYx2QgCABfoFjHZCAICO+AWMdkIAgAv5BYx2QgCABfoFjHZCAIAF+gWMdkIAgI74BYx2QgCAjvgFjHZCAIAL+QWMdkIAgMl0CIx2QgAArwMFjHZCAICgJf6LdkIAAHfRAIx2QgCAr9IAjHZCAAB30QCMdkIAgK/SAIx2QgAAd9EAjHZCAIA+0ACMdkIAgD7QAIx2QgCAPtAAjHZCAIA+0ACMdkIAgD7QAIx2QgAAfdAAjHZCAAB30QCMdkIAAHfRAIx2QgAAd9EAjHZCAAB30QCMdkIAgAWVAYx2QgAAbrj6i3ZCAIDuPPiLdkIAgHE8+It2QgCA6D34i3ZCAIDoPfiLdkIAgOg9+It2QgCA6D34i3ZCAIDoPfiLdkIAgOg9+It2QgCA6D34i3ZCAIDoPfiLdkIAgOg9+It2QgCA6D34i3ZCAIDoPfiLdkIAgOI++It2QgCA4j74i3ZCAIDiPviLdkIAgOI++It2QgCAh9/4i3ZCAIDoPfiLdkIAgOg9+It2QgCAcTz4i3ZCAIDiPviLdkIAAA9I94t2QgCADdHbi3ZCAADnYdiLdkIAgCvG3It2QgCAK8bci3ZCAIArxtyLdkIAgCvG3It2QgCAK8bci3ZCAABqxtyLdkIAAGTH3It2QgAAZMfci3ZCAABkx9yLdkIAAGTH3It2QgAAZMfci3ZCAABkx9yLdkIAAGTH3It2QgAAnZ3Xi3ZCAACdndeLdkIAgFie14t2QgCAWJ7Xi3ZCAIBYnteLdkIAgFie14t2QgCAWJ7Xi3ZCAIBYnteLdkIAgFie14t2QgCAWJ7Xi3ZCAIBYnteLdkIAgFie14t2QgCAWJ7Xi3ZCAIDVnteLdkIAgNWe14t2QgAAnZ3Xi3ZCAIBYnteLdkIAgFie14t2QgCA253Xi3ZCAIBYnteLdkIAgFie14t2QgCAWJ7Xi3ZCAIBYnteLdkIAgAgLz4t2QgAAQQzPi3ZCAIAIC8+LdkIAAFkIz4t2QgAA0AnPi3ZCAADQCc+LdkIAANAJz4t2QgCADgrPi3ZCAADQCc+LdkIAANAJz4t2QgCACAvPi3ZCAIAIC8+LdkIAAEEMz4t2QgAA0AnPi3ZCAIAIC8+LdkIAANAJz4t2QgAA0AnPi3ZCAADQCc+LdkIAgAgLz4t2QgCACAvPi3ZCAIAIC8+LdkIAANAJz4t2QgCACAvPi3ZCAAD0yMOLdkIAAJ2Ax4t2QgCAx1rAi3ZCAIB6TMGLdkIAAK1OwYt2QgAArU7Bi3ZCAACtTsGLdkIAAK1OwYt2QgCA607Bi3ZCAACtTsGLdkIAAK1OwYt2QgAArU7Bi3ZCAACtTsGLdkIAAK1OwYt2QgCA607Bi3ZCAACtTsGLdkIAAK1OwYt2QgAArU7Bi3ZCAACtTsGLdkIAAK1OwYt2QgAAJFDBi3ZCAAAkUMGLdkIAACRQwYt2QgAAJFDBi3ZCAAAkUMGLdkIAACRQwYt2QgCAFQ22i3ZCAIAhoLKLdkIAgD+Vs4t2QgAAB5Szi3ZCAIBLk7OLdkIAAAeUs4t2QgAAB5Szi3ZCAAAHlLOLdkIAAAeUs4t2QgAAB5Szi3ZCAAAHlLOLdkIAAAeUs4t2QgCAP5Wzi3ZCAAAHlLOLdkIAAAeUs4t2QgAAB5Szi3ZCAIBema6LdkIAAMEQr4t2QgCA6QKri3ZCAACrAquLdkIAAKsCq4t2QgCA4wOri3ZCAIDjA6uLdkIAgOMDq4t2QgCA4wOri3ZCAIDjA6uLdkIAgOMDq4t2QgCA4wOri3ZCAIDjA6uLdkIAAKsCq4t2QgCA4wOri3ZCAIDjA6uLdkIAgOMDq4t2QgCA4wOri3ZCAIDjA6uLdkIAgOMDq4t2QgCA4wOri3ZCAIDjA6uLdkIAgOMDq4t2QgCA4wOri3ZCAIDjA6uLdkIAAM787It2QgCA4wOri3ZCAIDjA6uLdkIAgOMDq4t2QgCA4wOri3ZCAIDjA6uLdkIAgOMDq4t2QgCA4wOri3ZCAIDjA6uLdkIAgOMDq4t2QgCA4wOri3ZCAIDjA6uLdkIAgOMDq4t2QgCA4L+ri3ZCAADCeK+LdkIAgL0br4t2QgCAvRuvi3ZCAIC9G6+LdkIAgL0br4t2QgCAvRuvi3ZCAIC9G6+LdkIAgL0br4t2QgCAvRuvi3ZCAIC9G6+LdkIAAPwbr4t2QgCAvRuvi3ZCAIC9G6+LdkIAAPYcr4t2QgAA9hyvi3ZCAAD2HK+LdkIAAPYcr4t2QgAA9hyvi3ZCAAD2HK+LdkIAAPYcr4t2QgAA9hyvi3ZCAAD2HK+LdkIAAPYcr4t2QgCAvRuvi3ZCAIC9G6+LdkIAgL0br4t2QgCAvRuvi3ZCAAD2HK+LdkIAgL0br4t2QgAA9hyvi3ZCAIC9G6+LdkIAgFWE0Yt2QgCA9T/fi3ZCAIDRgOqLdkIAgNGA6ot2QgCA0YDqi3ZCAIDRgOqLdkIAgNGA6ot2QgCA0YDqi3ZCAIDRgOqLdkIAgNGA6ot2QgAAh4Lqi3ZCAACHguqLdkIAAIeC6ot2QgAAh4Lqi3ZCAACHguqLdkIAAIeC6ot2QgAAh4Lqi3ZCAACHguqLdkIAAIeC6ot2QgAAh4Lqi3ZCAACHguqLdkIAAIeC6ot2QgAAh4Lqi3ZCAIDvTxuMdkIAgEUMHYx2QgCAXZ0ZjHZCAABseyCMdkI=\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[301]},\"index\":[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300],\"y_index\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]},\"selected\":{\"id\":\"3073\"},\"selection_policy\":{\"id\":\"3074\"}},\"id\":\"2996\",\"type\":\"ColumnDataSource\"},{\"attributes\":{},\"id\":\"3005\",\"type\":\"LinearScale\"},{\"attributes\":{\"overlay\":{\"id\":\"3055\"},\"x_range\":{\"id\":\"3001\"},\"y_range\":null},\"id\":\"3054\",\"type\":\"RangeTool\"},{\"attributes\":{\"days\":[1,8,15,22]},\"id\":\"3080\",\"type\":\"DaysTicker\"},{\"attributes\":{\"dimensions\":\"width\"},\"id\":\"3017\",\"type\":\"WheelZoomTool\"},{\"attributes\":{\"fill_alpha\":0.2,\"fill_color\":\"navy\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[2,2],\"line_width\":0.5},\"id\":\"3055\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"days\":[1,15]},\"id\":\"3081\",\"type\":\"DaysTicker\"},{\"attributes\":{\"below\":[{\"id\":\"3009\"}],\"center\":[{\"id\":\"3012\"},{\"id\":\"3016\"}],\"left\":[{\"id\":\"3013\"}],\"min_border_left\":50,\"plot_height\":200,\"plot_width\":900,\"renderers\":[{\"id\":\"3064\"}],\"title\":{\"id\":\"2999\"},\"toolbar\":{\"id\":\"3023\"},\"x_range\":{\"id\":\"3001\"},\"x_scale\":{\"id\":\"3005\"},\"y_range\":{\"id\":\"3003\"},\"y_scale\":{\"id\":\"3007\"}},\"id\":\"2998\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"days\":[\"%m-%d %H:%M\"],\"hours\":[\"%H:%M:%S\"],\"milliseconds\":[\"%H:%M:%S.%3N\"],\"minutes\":[\"%H:%M:%S\"],\"seconds\":[\"%H:%M:%S\"]},\"id\":\"3059\",\"type\":\"DatetimeTickFormatter\"},{\"attributes\":{\"months\":[0,1,2,3,4,5,6,7,8,9,10,11]},\"id\":\"3082\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"active_drag\":\"auto\",\"active_inspect\":\"auto\",\"active_multi\":null,\"active_scroll\":\"auto\",\"active_tap\":\"auto\",\"tools\":[{\"id\":\"2997\"},{\"id\":\"3017\"},{\"id\":\"3018\"},{\"id\":\"3019\"},{\"id\":\"3020\"},{\"id\":\"3021\"}]},\"id\":\"3023\",\"type\":\"Toolbar\"},{\"attributes\":{\"text\":\"Timeline: Related Alerts\"},\"id\":\"2999\",\"type\":\"Title\"},{\"attributes\":{\"months\":[0,6]},\"id\":\"3098\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"months\":[0,2,4,6,8,10]},\"id\":\"3083\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"axis\":{\"id\":\"3041\"},\"ticker\":null},\"id\":\"3044\",\"type\":\"Grid\"},{\"attributes\":{\"months\":[0,1,2,3,4,5,6,7,8,9,10,11]},\"id\":\"3095\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"end\":1549822799700.0,\"start\":1549274655300.0},\"id\":\"3001\",\"type\":\"Range1d\"},{\"attributes\":{\"months\":[0,4,8]},\"id\":\"3084\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"axis_label\":\"Event Time\",\"formatter\":{\"id\":\"3059\"},\"ticker\":{\"id\":\"3010\"}},\"id\":\"3009\",\"type\":\"DatetimeAxis\"},{\"attributes\":{\"days\":[1,8,15,22]},\"id\":\"3093\",\"type\":\"DaysTicker\"},{\"attributes\":{\"source\":{\"id\":\"2996\"}},\"id\":\"3065\",\"type\":\"CDSView\"},{\"attributes\":{\"months\":[0,6]},\"id\":\"3085\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"months\":[0,2,4,6,8,10]},\"id\":\"3096\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"num_minor_ticks\":5,\"tickers\":[{\"id\":\"3088\"},{\"id\":\"3089\"},{\"id\":\"3090\"},{\"id\":\"3091\"},{\"id\":\"3092\"},{\"id\":\"3093\"},{\"id\":\"3094\"},{\"id\":\"3095\"},{\"id\":\"3096\"},{\"id\":\"3097\"},{\"id\":\"3098\"},{\"id\":\"3099\"}]},\"id\":\"3042\",\"type\":\"DatetimeTicker\"},{\"attributes\":{},\"id\":\"3086\",\"type\":\"YearsTicker\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"navy\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"navy\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3063\",\"type\":\"Diamond\"},{\"attributes\":{},\"id\":\"3019\",\"type\":\"ResetTool\"},{\"attributes\":{\"base\":60,\"mantissas\":[1,2,5,10,15,20,30],\"max_interval\":1800000.0,\"min_interval\":1000.0,\"num_minor_ticks\":0},\"id\":\"3076\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"formatter\":{\"id\":\"3047\"},\"ticker\":{\"id\":\"3042\"}},\"id\":\"3041\",\"type\":\"DatetimeAxis\"},{\"attributes\":{\"mantissas\":[1,2,5],\"max_interval\":500.0,\"num_minor_ticks\":0},\"id\":\"3088\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"data_source\":{\"id\":\"2996\"},\"glyph\":{\"id\":\"3062\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3063\"},\"selection_glyph\":null,\"view\":{\"id\":\"3065\"}},\"id\":\"3064\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"navy\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"navy\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3062\",\"type\":\"Diamond\"},{\"attributes\":{\"start\":-1.0},\"id\":\"3003\",\"type\":\"Range1d\"},{\"attributes\":{},\"id\":\"3007\",\"type\":\"LinearScale\"},{\"attributes\":{\"base\":60,\"mantissas\":[1,2,5,10,15,20,30],\"max_interval\":1800000.0,\"min_interval\":1000.0,\"num_minor_ticks\":0},\"id\":\"3089\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"months\":[0,4,8]},\"id\":\"3097\",\"type\":\"MonthsTicker\"},{\"attributes\":{},\"id\":\"3070\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"base\":24,\"mantissas\":[1,2,4,6,8,12],\"max_interval\":43200000.0,\"min_interval\":3600000.0,\"num_minor_ticks\":0},\"id\":\"3090\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"num_minor_ticks\":10,\"tickers\":[{\"id\":\"3075\"},{\"id\":\"3076\"},{\"id\":\"3077\"},{\"id\":\"3078\"},{\"id\":\"3079\"},{\"id\":\"3080\"},{\"id\":\"3081\"},{\"id\":\"3082\"},{\"id\":\"3083\"},{\"id\":\"3084\"},{\"id\":\"3085\"},{\"id\":\"3086\"}]},\"id\":\"3010\",\"type\":\"DatetimeTicker\"},{\"attributes\":{},\"id\":\"3073\",\"type\":\"Selection\"},{\"attributes\":{\"below\":[{\"id\":\"3041\"},{\"id\":\"3046\"}],\"center\":[{\"id\":\"3044\"}],\"plot_height\":120,\"plot_width\":900,\"renderers\":[{\"id\":\"3052\"}],\"title\":{\"id\":\"3031\"},\"toolbar\":{\"id\":\"3045\"},\"toolbar_location\":null,\"x_range\":{\"id\":\"3033\"},\"x_scale\":{\"id\":\"3037\"},\"y_range\":{\"id\":\"3035\"},\"y_scale\":{\"id\":\"3039\"}},\"id\":\"3030\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"active_drag\":\"auto\",\"active_inspect\":\"auto\",\"active_multi\":{\"id\":\"3054\"},\"active_scroll\":\"auto\",\"active_tap\":\"auto\",\"tools\":[{\"id\":\"3054\"}]},\"id\":\"3045\",\"type\":\"Toolbar\"},{\"attributes\":{\"dimensions\":\"width\"},\"id\":\"3021\",\"type\":\"PanTool\"},{\"attributes\":{\"days\":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31]},\"id\":\"3091\",\"type\":\"DaysTicker\"},{\"attributes\":{\"days\":[1,15]},\"id\":\"3094\",\"type\":\"DaysTicker\"},{\"attributes\":{},\"id\":\"3035\",\"type\":\"DataRange1d\"},{\"attributes\":{},\"id\":\"3074\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"text\":\"Range Selector\"},\"id\":\"3031\",\"type\":\"Title\"},{\"attributes\":{\"days\":[1,4,7,10,13,16,19,22,25,28]},\"id\":\"3092\",\"type\":\"DaysTicker\"},{\"attributes\":{\"days\":[\"%m-%d %H:%M\"],\"hours\":[\"%H:%M:%S\"],\"milliseconds\":[\"%H:%M:%S.%3N\"],\"minutes\":[\"%H:%M:%S\"],\"seconds\":[\"%H:%M:%S\"]},\"id\":\"3047\",\"type\":\"DatetimeTickFormatter\"},{\"attributes\":{\"mantissas\":[1,2,5],\"max_interval\":500.0,\"num_minor_ticks\":0},\"id\":\"3075\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"axis\":{\"id\":\"3009\"},\"minor_grid_line_alpha\":0.3,\"minor_grid_line_color\":\"navy\",\"ticker\":null},\"id\":\"3012\",\"type\":\"Grid\"},{\"attributes\":{},\"id\":\"3039\",\"type\":\"LinearScale\"},{\"attributes\":{},\"id\":\"3099\",\"type\":\"YearsTicker\"},{\"attributes\":{},\"id\":\"3014\",\"type\":\"BasicTicker\"},{\"attributes\":{},\"id\":\"3020\",\"type\":\"SaveTool\"},{\"attributes\":{\"formatter\":{\"id\":\"3070\"},\"ticker\":{\"id\":\"3014\"},\"visible\":false},\"id\":\"3013\",\"type\":\"LinearAxis\"}],\"root_ids\":[\"3066\"]},\"title\":\"Bokeh Application\",\"version\":\"2.1.1\"}};\n",
       "  var render_items = [{\"docid\":\"301f585a-aee0-405b-8809-2929c58514f3\",\"root_ids\":[\"3066\"],\"roots\":{\"3066\":\"7c5dc3cb-ff8c-49ef-8cd5-9f4afb813f2d\"}}];\n",
       "  root.Bokeh.embed.embed_items_notebook(docs_json, render_items);\n",
       "\n",
       "  }\n",
       "  if (root.Bokeh !== undefined) {\n",
       "    embed_document(root);\n",
       "  } else {\n",
       "    var attempts = 0;\n",
       "    var timer = setInterval(function(root) {\n",
       "      if (root.Bokeh !== undefined) {\n",
       "        clearInterval(timer);\n",
       "        embed_document(root);\n",
       "      } else {\n",
       "        attempts++;\n",
       "        if (attempts > 100) {\n",
       "          clearInterval(timer);\n",
       "          console.log(\"Bokeh: ERROR: Unable to run BokehJS code because BokehJS library is missing\");\n",
       "        }\n",
       "      }\n",
       "    }, 10, root)\n",
       "  }\n",
       "})(window);"
      ],
      "application/vnd.bokehjs_exec.v0+json": ""
     },
     "metadata": {
      "application/vnd.bokehjs_exec.v0+json": {
       "id": "3066"
      }
     },
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Getting data from Bookmarks...\n"
     ]
    },
    {
     "data": {
      "application/javascript": [
       "try {IPython.notebook.kernel.execute(\"NOTEBOOK_URL = '\" + window.location + \"'\");} catch(err) {;}"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<p style=''>No bookmarks found.</p>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "host_summary = nb.nblts.azsent.host.HostSummary()\n",
    "host_sum_rslt = host_summary.run(value=\"Msticalertswin1\", timespan=time_span)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Result classes content can be displayed in the notebook\n",
    "Use `display(result)` if you want to display the content in the middle of a cell"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 32,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "  <div class=\"bk-root\" id=\"eaf1ffc7-f731-41f6-8cb8-d2b443dd6820\" data-root-id=\"3066\"></div>\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "(function(root) {\n",
       "  function embed_document(root) {\n",
       "    \n",
       "  var docs_json = {\"10e43c03-8a8e-4028-90c9-c43046977411\":{\"roots\":{\"references\":[{\"attributes\":{\"children\":[{\"id\":\"2998\"},{\"id\":\"3030\"}]},\"id\":\"3066\",\"type\":\"Column\"},{\"attributes\":{\"fill_color\":{\"value\":\"navy\"},\"line_color\":{\"value\":\"navy\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3050\",\"type\":\"Circle\"},{\"attributes\":{\"base\":24,\"mantissas\":[1,2,4,6,8,12],\"max_interval\":43200000.0,\"min_interval\":3600000.0,\"num_minor_ticks\":0},\"id\":\"3077\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"bottom_units\":\"screen\",\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"top_units\":\"screen\"},\"id\":\"3022\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"axis\":{\"id\":\"3013\"},\"dimension\":1,\"grid_line_color\":null,\"ticker\":null},\"id\":\"3016\",\"type\":\"Grid\"},{\"attributes\":{},\"id\":\"3037\",\"type\":\"LinearScale\"},{\"attributes\":{\"callback\":null,\"formatters\":{\"@TimeGenerated\":\"datetime\"},\"tooltips\":[[\"AlertName\",\"@AlertName\"],[\"TimeGenerated\",\"@TimeGenerated{%F %T.%3N}\"]]},\"id\":\"2997\",\"type\":\"HoverTool\"},{\"attributes\":{\"data_source\":{\"id\":\"2996\"},\"glyph\":{\"id\":\"3050\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3051\"},\"selection_glyph\":null,\"view\":{\"id\":\"3053\"}},\"id\":\"3052\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"overlay\":{\"id\":\"3022\"}},\"id\":\"3018\",\"type\":\"BoxZoomTool\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"navy\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"navy\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3051\",\"type\":\"Circle\"},{\"attributes\":{\"days\":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31]},\"id\":\"3078\",\"type\":\"DaysTicker\"},{\"attributes\":{\"align\":\"right\",\"text\":\"Drag the middle or edges of the selection box to change the range in the main chart\",\"text_font_size\":{\"value\":\"10px\"}},\"id\":\"3046\",\"type\":\"Title\"},{\"attributes\":{\"days\":[1,4,7,10,13,16,19,22,25,28]},\"id\":\"3079\",\"type\":\"DaysTicker\"},{\"attributes\":{\"end\":1549845639049.9998,\"start\":1549251815950.0002},\"id\":\"3033\",\"type\":\"Range1d\"},{\"attributes\":{\"source\":{\"id\":\"2996\"}},\"id\":\"3053\",\"type\":\"CDSView\"},{\"attributes\":{\"data\":{\"AlertName\":[\"Security incident with shared process detected\",\"Digital currency mining related behavior detected\",\"Suspiciously named process detected\",\"Sample Alert Rule\",\"Potential attempt to bypass AppLocker detected\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Antimalware Action Taken\",\"Suspicious SVCHOST process executed\",\"Suspicious Activity Detected\",\"Suspicious SVCHOST process executed\",\"Digital currency mining related behavior detected\",\"Executable found running from a suspicious\\nlocation\",\"Suspicious Powershell Activity Detected\",\"Suspicious system process executed\",\"Suspicious Powershell Activity Detected\",\"Suspiciously named process detected\",\"Sample Alert Rule\",\"Suspicious system process executed\",\"Antimalware Action Taken\",\"Antimalware Action Taken\",\"Antimalware Action Taken\",\"Potential attempt to bypass AppLocker detected\",\"Suspiciously named process detected\",\"Suspiciously named process detected\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Security incident with shared process detected\",\"Executable found running from a suspicious\\nlocation\",\"Potential attempt to bypass AppLocker detected\",\"Suspicious system process executed\",\"Security incident with shared process detected\",\"Potential attempt to bypass AppLocker detected\",\"Suspicious Powershell Activity Detected\",\"Suspiciously named process detected\",\"Suspicious system process executed\",\"Digital currency mining related behavior detected\",\"Suspiciously named process detected\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Suspicious system process executed\",\"Ransomware indicators detected\",\"Azure Security Center test alert (not a threat)\",\"Suspicious double extension file executed\",\"Suspicious Volume Shadow Copy Activity\",\"Detected Petya ransomware indicators\",\"Suspicious process executed\",\"Suspiciously named process detected\",\"Suspicious SVCHOST process executed\",\"Rare SVCHOST service group executed\",\"Executable found running from a suspicious\\nlocation\",\"Suspicious WindowPosition registry value detected\",\"Suspicious process executed\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Suspicious SVCHOST process executed\",\"Detected Petya ransomware indicators\",\"Detected anomalous mix of upper and lower case\\ncharacters in command-line\",\"Ransomware indicators detected\",\"Suspicious Volume Shadow Copy Activity\",\"Suspicious WindowPosition registry value detected\",\"Digital currency mining related behavior detected\",\"Potential attempt to bypass AppLocker detected\",\"Suspicious system process executed\",\"Suspicious process executed\",\"Suspiciously named process detected\",\"Rare SVCHOST service group executed\",\"Suspicious double extension file executed\",\"Azure Security Center test alert (not a threat)\",\"Suspicious process executed\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Suspiciously named process detected\",\"Potential attempt to bypass AppLocker detected\",\"Suspicious WindowPosition registry value detected\",\"Suspicious system process executed\",\"Detected obfuscated command line.\",\"Suspicious Powershell Activity Detected\",\"Suspicious process executed\",\"Suspicious Powershell Activity Detected\",\"Suspicious Powershell Activity Detected\",\"Suspicious Volume Shadow Copy Activity\",\"Executable found running from a suspicious\\nlocation\",\"Suspicious process executed\",\"Suspicious Powershell Activity Detected\",\"Suspicious SVCHOST process executed\",\"Detected Petya ransomware indicators\",\"Azure Security Center test alert (not a threat)\",\"Ransomware indicators detected\",\"Security incident with shared process detected\",\"Suspicious double extension file executed\",\"Detected anomalous mix of upper and lower case\\ncharacters in command-line\",\"Digital currency mining related behavior detected\",\"Rare SVCHOST service group executed\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Suspicious WindowPosition registry value detected\",\"Suspicious system process executed\",\"Executable found running from a suspicious\\nlocation\",\"Suspicious process executed\",\"Suspicious process executed\",\"Suspiciously named process detected\",\"Rare SVCHOST service group executed\",\"Suspicious double extension file executed\",\"Detected Petya ransomware indicators\",\"Suspicious SVCHOST process executed\",\"Suspicious Volume Shadow Copy Activity\",\"Azure Security Center test alert (not a threat)\",\"Ransomware indicators detected\",\"Suspicious Account Creation Detected\",\"Potential attempt to bypass AppLocker detected\",\"Executable found running from a suspicious\\nlocation\",\"Suspicious system process executed\",\"Suspicious double extension file executed\",\"Suspicious process executed\",\"Suspicious WindowPosition registry value detected\",\"Suspicious Volume Shadow Copy Activity\",\"Azure Security Center test alert (not a threat)\",\"Detected obfuscated command line.\",\"Suspicious Powershell Activity Detected\",\"Rare SVCHOST service group executed\",\"Suspicious Powershell Activity Detected\",\"Ransomware indicators detected\",\"Detected Petya ransomware indicators\",\"Digital currency mining related behavior detected\",\"Executable found running from a suspicious\\nlocation\",\"Suspicious Powershell Activity Detected\",\"Suspiciously named process detected\",\"Suspicious Powershell Activity Detected\",\"Suspicious process executed\",\"Suspicious SVCHOST process executed\",\"Detected anomalous mix of upper and lower case\\ncharacters in command-line\",\"Suspicious SVCHOST process executed\",\"Ransomware indicators detected\",\"Detected anomalous mix of upper and lower case\\ncharacters in command-line\",\"Suspicious Account Creation Detected\",\"Detected obfuscated command line.\",\"Executable found running from a suspicious\\nlocation\",\"Suspicious Powershell Activity Detected\",\"Suspiciously named process detected\",\"Suspicious Powershell Activity Detected\",\"Suspicious system process executed\",\"Suspicious double extension file executed\",\"Suspicious Volume Shadow Copy Activity\",\"Detected Petya ransomware indicators\",\"Suspicious Powershell Activity Detected\",\"Rare SVCHOST service group executed\",\"Suspicious Powershell Activity Detected\",\"Suspicious WindowPosition registry value detected\",\"Potential attempt to bypass AppLocker detected\",\"Suspicious process executed\",\"Azure Security Center test alert (not a threat)\",\"Suspicious process executed\",\"Digital currency mining related behavior detected\",\"Executable found running from a suspicious\\nlocation\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Suspicious Account Creation Detected\",\"Suspicious Powershell Activity Detected\",\"Suspicious Powershell Activity Detected\",\"Suspicious WindowPosition registry value detected\",\"Suspicious Powershell Activity Detected\",\"Suspicious double extension file executed\",\"Suspicious Powershell Activity Detected\",\"Suspicious process executed\",\"Detected anomalous mix of upper and lower case\\ncharacters in command-line\",\"Executable found running from a suspicious\\nlocation\",\"Suspicious system process executed\",\"Suspiciously named process detected\",\"Suspicious process executed\",\"Detected obfuscated command line.\",\"Executable found running from a suspicious\\nlocation\",\"Potential attempt to bypass AppLocker detected\",\"Digital currency mining related behavior detected\",\"Suspicious Volume Shadow Copy Activity\",\"Suspicious SVCHOST process executed\",\"Detected Petya ransomware indicators\",\"Ransomware indicators detected\",\"Azure Security Center test alert (not a threat)\",\"Rare SVCHOST service group executed\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Detected Petya ransomware indicators\",\"Executable found running from a suspicious\\nlocation\",\"Suspiciously named process detected\",\"Azure Security Center test alert (not a threat)\",\"Suspicious SVCHOST process executed\",\"Suspicious process executed\",\"Suspicious WindowPosition registry value detected\",\"Rare SVCHOST service group executed\",\"Suspicious Volume Shadow Copy Activity\",\"Suspicious process executed\",\"Ransomware indicators detected\",\"Suspicious system process executed\",\"Random process name detected\",\"Suspicious double extension file executed\",\"Anomalous account creation detected\",\"Suspicious Account Creation Detected\",\"Suspiciously named process detected\",\"Suspicious Account Creation Detected\",\"Digital currency mining related behavior detected\",\"Detected encoded executable in command line data\",\"Detected suspicious new firewall rule\",\"Suspected Kerberos Golden Ticket attack parameters\\nobserved\",\"Detected suspicious commandline used to start all\\nexecutables in a directory\",\"Random process name detected\",\"Suspicious double extension file executed\",\"Suspicious Powershell Activity Detected\",\"Executable found running from a suspicious\\nlocation\",\"Potential attempt to bypass AppLocker detected\",\"Suspicious process executed\",\"Executable found running from a suspicious\\nlocation\",\"Suspicious Powershell Activity Detected\",\"Detected change to a registry key that can be\\nabused to bypass UAC\",\"Detected suspicious Set-ExecutionPolicy and WinRM\\nchanges\",\"Detected suspicious use of FTP -s Switch\",\"Suspicious Powershell Activity Detected\",\"Suspicious powershell cmdlets executed\",\"Possible credential dumping detected\",\"Detected suspicious credentials in commandline\",\"Suspicious Powershell Activity Detected\",\"Sample Alert Rule\",\"Suspicious WindowPosition registry value detected\",\"Detected actions indicative of disabling and\\ndeleting IIS log files.\",\"Potential attempt to bypass AppLocker detected\",\"Suspicious download using Certutil detected\",\"Sticky keys attack detected\",\"Detected suspicious named pipe communications\",\"Suspicious system process executed\",\"Detected decoding of an executable using built-in\\ncertutil.exe tool\",\"Detected potentially suspicious use of Telegram\\ntool\",\"Detected obfuscated command line.\",\"Detected possible local reconnaissance activity\",\"Suspicious process executed\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Suspicious SVCHOST process executed\",\"Detected suspicious execution via rundll32.exe\",\"Executable found running from a suspicious\\nlocation\",\"Detected suspicious execution via rundll32.exe\",\"Potential attempt to bypass AppLocker detected\",\"Suspicious system process executed\",\"Detected anomalous mix of upper and lower case\\ncharacters in command-line\",\"Detected suspicious commandline arguments\",\"Rare SVCHOST service group executed\",\"Suspiciously named process detected\",\"Executable found running from a suspicious\\nlocation\",\"Detected suspicious document credentials\",\"Detected suspicious execution of VBScript.Encode\\ncommand\",\"Detected suspicious file creation\",\"Detected suspicious use of Pcalua.exe to launch\\nexecutable code\",\"Detected suspicious use of Cacls to lower the\\nsecurity state of the system.\",\"Ransomware indicators detected\",\"Detected possible execution of malware dropper\",\"High risk software detected\",\"Detected suspicious file cleanup commands\",\"Detected possible execution of keygen executable\",\"Detected the disabling of critical services\",\"Suspicious double extension file executed\",\"Suspicious process executed\",\"Suspicious WindowPosition registry value detected\",\"Suspicious process executed\",\"Detected Petya ransomware indicators\",\"Suspicious Volume Shadow Copy Activity\",\"Azure Security Center test alert (not a threat)\",\"Digital currency mining related behavior detected\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Detected obfuscated command line.\",\"Suspiciously named process detected\",\"Potential attempt to bypass AppLocker detected\",\"Digital currency mining related behavior detected\",\"Suspicious Powershell Activity Detected\",\"Suspicious Powershell Activity Detected\",\"Suspicious Powershell Activity Detected\",\"Suspicious Powershell Activity Detected\",\"Suspicious Volume Shadow Copy Activity\",\"Suspicious WindowPosition registry value detected\",\"Rare SVCHOST service group executed\",\"Detected anomalous mix of upper and lower case\\ncharacters in command-line\",\"Executable found running from a suspicious\\nlocation\",\"Suspicious double extension file executed\",\"Suspicious process executed\",\"Detected Petya ransomware indicators\",\"Suspicious system process executed\",\"Ransomware indicators detected\",\"Azure Security Center test alert (not a threat)\",\"Suspicious process executed\",\"Suspicious SVCHOST process executed\",\"Security incident with shared process detected\",\"Sample Alert Rule\",\"Sample Alert Rule\",\"Sample Alert Rule\"],\"TimeGenerated\":{\"__ndarray__\":\"AIDuol6NdkIAgPdjSY12QgCAdGRJjXZCAIAwaVeMdkIAADRwVIx2QgCA9RxNjHZCAIDAz0KMdkIAgN84Qox2QgCA845BjHZCAAD2G0GMdkIAAPQVSYx2QgAAKZNLjHZCAAApk0uMdkIAACmTS4x2QgAAKZNLjHZCAAApk0uMdkIAgGeTS4x2QgAAya5JjHZCAACaiU2MdkIAgJeFTIx2QgCAl4VMjHZCAICXhUyMdkIAgHVtSox2QgCAjGxNjHZCAADBRE2MdkIAgMX6U4x2QgAAHIxQjHZCAIAdlpKMdkIAAPRUfYx2QgAA9FR9jHZCAAD0VH2MdkIAALqsaYx2QgAA5Rs+jHZCAACRKT6MdkIAAJEpPox2QgAAkSk+jHZCAACRKT6MdkIAAExzPox2QgAAF2E/jHZCAIDw8TuMdkIAANwUNYx2QgCACsASjHZCAAC0LhaMdkIAgCJRD4x2QgCAveELjHZCAICO+AWMdkIAgAX6BYx2QgCABfoFjHZCAIAL+QWMdkIAgAX6BYx2QgCABfoFjHZCAICO+AWMdkIAgAv5BYx2QgCABfoFjHZCAIAF+gWMdkIAgI74BYx2QgCAjvgFjHZCAIAL+QWMdkIAgMl0CIx2QgAArwMFjHZCAICgJf6LdkIAAHfRAIx2QgCAr9IAjHZCAAB30QCMdkIAgK/SAIx2QgAAd9EAjHZCAIA+0ACMdkIAgD7QAIx2QgCAPtAAjHZCAIA+0ACMdkIAgD7QAIx2QgAAfdAAjHZCAAB30QCMdkIAAHfRAIx2QgAAd9EAjHZCAAB30QCMdkIAgAWVAYx2QgAAbrj6i3ZCAIDuPPiLdkIAgHE8+It2QgCA6D34i3ZCAIDoPfiLdkIAgOg9+It2QgCA6D34i3ZCAIDoPfiLdkIAgOg9+It2QgCA6D34i3ZCAIDoPfiLdkIAgOg9+It2QgCA6D34i3ZCAIDoPfiLdkIAgOI++It2QgCA4j74i3ZCAIDiPviLdkIAgOI++It2QgCAh9/4i3ZCAIDoPfiLdkIAgOg9+It2QgCAcTz4i3ZCAIDiPviLdkIAAA9I94t2QgCADdHbi3ZCAADnYdiLdkIAgCvG3It2QgCAK8bci3ZCAIArxtyLdkIAgCvG3It2QgCAK8bci3ZCAABqxtyLdkIAAGTH3It2QgAAZMfci3ZCAABkx9yLdkIAAGTH3It2QgAAZMfci3ZCAABkx9yLdkIAAGTH3It2QgAAnZ3Xi3ZCAACdndeLdkIAgFie14t2QgCAWJ7Xi3ZCAIBYnteLdkIAgFie14t2QgCAWJ7Xi3ZCAIBYnteLdkIAgFie14t2QgCAWJ7Xi3ZCAIBYnteLdkIAgFie14t2QgCAWJ7Xi3ZCAIDVnteLdkIAgNWe14t2QgAAnZ3Xi3ZCAIBYnteLdkIAgFie14t2QgCA253Xi3ZCAIBYnteLdkIAgFie14t2QgCAWJ7Xi3ZCAIBYnteLdkIAgAgLz4t2QgAAQQzPi3ZCAIAIC8+LdkIAAFkIz4t2QgAA0AnPi3ZCAADQCc+LdkIAANAJz4t2QgCADgrPi3ZCAADQCc+LdkIAANAJz4t2QgCACAvPi3ZCAIAIC8+LdkIAAEEMz4t2QgAA0AnPi3ZCAIAIC8+LdkIAANAJz4t2QgAA0AnPi3ZCAADQCc+LdkIAgAgLz4t2QgCACAvPi3ZCAIAIC8+LdkIAANAJz4t2QgCACAvPi3ZCAAD0yMOLdkIAAJ2Ax4t2QgCAx1rAi3ZCAIB6TMGLdkIAAK1OwYt2QgAArU7Bi3ZCAACtTsGLdkIAAK1OwYt2QgCA607Bi3ZCAACtTsGLdkIAAK1OwYt2QgAArU7Bi3ZCAACtTsGLdkIAAK1OwYt2QgCA607Bi3ZCAACtTsGLdkIAAK1OwYt2QgAArU7Bi3ZCAACtTsGLdkIAAK1OwYt2QgAAJFDBi3ZCAAAkUMGLdkIAACRQwYt2QgAAJFDBi3ZCAAAkUMGLdkIAACRQwYt2QgCAFQ22i3ZCAIAhoLKLdkIAgD+Vs4t2QgAAB5Szi3ZCAIBLk7OLdkIAAAeUs4t2QgAAB5Szi3ZCAAAHlLOLdkIAAAeUs4t2QgAAB5Szi3ZCAAAHlLOLdkIAAAeUs4t2QgCAP5Wzi3ZCAAAHlLOLdkIAAAeUs4t2QgAAB5Szi3ZCAIBema6LdkIAAMEQr4t2QgCA6QKri3ZCAACrAquLdkIAAKsCq4t2QgCA4wOri3ZCAIDjA6uLdkIAgOMDq4t2QgCA4wOri3ZCAIDjA6uLdkIAgOMDq4t2QgCA4wOri3ZCAIDjA6uLdkIAAKsCq4t2QgCA4wOri3ZCAIDjA6uLdkIAgOMDq4t2QgCA4wOri3ZCAIDjA6uLdkIAgOMDq4t2QgCA4wOri3ZCAIDjA6uLdkIAgOMDq4t2QgCA4wOri3ZCAIDjA6uLdkIAAM787It2QgCA4wOri3ZCAIDjA6uLdkIAgOMDq4t2QgCA4wOri3ZCAIDjA6uLdkIAgOMDq4t2QgCA4wOri3ZCAIDjA6uLdkIAgOMDq4t2QgCA4wOri3ZCAIDjA6uLdkIAgOMDq4t2QgCA4L+ri3ZCAADCeK+LdkIAgL0br4t2QgCAvRuvi3ZCAIC9G6+LdkIAgL0br4t2QgCAvRuvi3ZCAIC9G6+LdkIAgL0br4t2QgCAvRuvi3ZCAIC9G6+LdkIAAPwbr4t2QgCAvRuvi3ZCAIC9G6+LdkIAAPYcr4t2QgAA9hyvi3ZCAAD2HK+LdkIAAPYcr4t2QgAA9hyvi3ZCAAD2HK+LdkIAAPYcr4t2QgAA9hyvi3ZCAAD2HK+LdkIAAPYcr4t2QgCAvRuvi3ZCAIC9G6+LdkIAgL0br4t2QgCAvRuvi3ZCAAD2HK+LdkIAgL0br4t2QgAA9hyvi3ZCAIC9G6+LdkIAgFWE0Yt2QgCA9T/fi3ZCAIDRgOqLdkIAgNGA6ot2QgCA0YDqi3ZCAIDRgOqLdkIAgNGA6ot2QgCA0YDqi3ZCAIDRgOqLdkIAgNGA6ot2QgAAh4Lqi3ZCAACHguqLdkIAAIeC6ot2QgAAh4Lqi3ZCAACHguqLdkIAAIeC6ot2QgAAh4Lqi3ZCAACHguqLdkIAAIeC6ot2QgAAh4Lqi3ZCAACHguqLdkIAAIeC6ot2QgAAh4Lqi3ZCAIDvTxuMdkIAgEUMHYx2QgCAXZ0ZjHZCAABseyCMdkI=\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[301]},\"index\":[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300],\"y_index\":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]},\"selected\":{\"id\":\"3073\"},\"selection_policy\":{\"id\":\"3074\"}},\"id\":\"2996\",\"type\":\"ColumnDataSource\"},{\"attributes\":{},\"id\":\"3005\",\"type\":\"LinearScale\"},{\"attributes\":{\"overlay\":{\"id\":\"3055\"},\"x_range\":{\"id\":\"3001\"},\"y_range\":null},\"id\":\"3054\",\"type\":\"RangeTool\"},{\"attributes\":{\"days\":[1,8,15,22]},\"id\":\"3080\",\"type\":\"DaysTicker\"},{\"attributes\":{\"dimensions\":\"width\"},\"id\":\"3017\",\"type\":\"WheelZoomTool\"},{\"attributes\":{\"fill_alpha\":0.2,\"fill_color\":\"navy\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[2,2],\"line_width\":0.5},\"id\":\"3055\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"days\":[1,15]},\"id\":\"3081\",\"type\":\"DaysTicker\"},{\"attributes\":{\"below\":[{\"id\":\"3009\"}],\"center\":[{\"id\":\"3012\"},{\"id\":\"3016\"}],\"left\":[{\"id\":\"3013\"}],\"min_border_left\":50,\"plot_height\":200,\"plot_width\":900,\"renderers\":[{\"id\":\"3064\"}],\"title\":{\"id\":\"2999\"},\"toolbar\":{\"id\":\"3023\"},\"x_range\":{\"id\":\"3001\"},\"x_scale\":{\"id\":\"3005\"},\"y_range\":{\"id\":\"3003\"},\"y_scale\":{\"id\":\"3007\"}},\"id\":\"2998\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"days\":[\"%m-%d %H:%M\"],\"hours\":[\"%H:%M:%S\"],\"milliseconds\":[\"%H:%M:%S.%3N\"],\"minutes\":[\"%H:%M:%S\"],\"seconds\":[\"%H:%M:%S\"]},\"id\":\"3059\",\"type\":\"DatetimeTickFormatter\"},{\"attributes\":{\"months\":[0,1,2,3,4,5,6,7,8,9,10,11]},\"id\":\"3082\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"active_drag\":\"auto\",\"active_inspect\":\"auto\",\"active_multi\":null,\"active_scroll\":\"auto\",\"active_tap\":\"auto\",\"tools\":[{\"id\":\"2997\"},{\"id\":\"3017\"},{\"id\":\"3018\"},{\"id\":\"3019\"},{\"id\":\"3020\"},{\"id\":\"3021\"}]},\"id\":\"3023\",\"type\":\"Toolbar\"},{\"attributes\":{\"text\":\"Timeline: Related Alerts\"},\"id\":\"2999\",\"type\":\"Title\"},{\"attributes\":{\"months\":[0,6]},\"id\":\"3098\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"months\":[0,2,4,6,8,10]},\"id\":\"3083\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"axis\":{\"id\":\"3041\"},\"ticker\":null},\"id\":\"3044\",\"type\":\"Grid\"},{\"attributes\":{\"months\":[0,1,2,3,4,5,6,7,8,9,10,11]},\"id\":\"3095\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"end\":1549822799700.0,\"start\":1549274655300.0},\"id\":\"3001\",\"type\":\"Range1d\"},{\"attributes\":{\"months\":[0,4,8]},\"id\":\"3084\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"axis_label\":\"Event Time\",\"formatter\":{\"id\":\"3059\"},\"ticker\":{\"id\":\"3010\"}},\"id\":\"3009\",\"type\":\"DatetimeAxis\"},{\"attributes\":{\"days\":[1,8,15,22]},\"id\":\"3093\",\"type\":\"DaysTicker\"},{\"attributes\":{\"source\":{\"id\":\"2996\"}},\"id\":\"3065\",\"type\":\"CDSView\"},{\"attributes\":{\"months\":[0,6]},\"id\":\"3085\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"months\":[0,2,4,6,8,10]},\"id\":\"3096\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"num_minor_ticks\":5,\"tickers\":[{\"id\":\"3088\"},{\"id\":\"3089\"},{\"id\":\"3090\"},{\"id\":\"3091\"},{\"id\":\"3092\"},{\"id\":\"3093\"},{\"id\":\"3094\"},{\"id\":\"3095\"},{\"id\":\"3096\"},{\"id\":\"3097\"},{\"id\":\"3098\"},{\"id\":\"3099\"}]},\"id\":\"3042\",\"type\":\"DatetimeTicker\"},{\"attributes\":{},\"id\":\"3086\",\"type\":\"YearsTicker\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"navy\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"navy\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3063\",\"type\":\"Diamond\"},{\"attributes\":{},\"id\":\"3019\",\"type\":\"ResetTool\"},{\"attributes\":{\"base\":60,\"mantissas\":[1,2,5,10,15,20,30],\"max_interval\":1800000.0,\"min_interval\":1000.0,\"num_minor_ticks\":0},\"id\":\"3076\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"formatter\":{\"id\":\"3047\"},\"ticker\":{\"id\":\"3042\"}},\"id\":\"3041\",\"type\":\"DatetimeAxis\"},{\"attributes\":{\"mantissas\":[1,2,5],\"max_interval\":500.0,\"num_minor_ticks\":0},\"id\":\"3088\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"data_source\":{\"id\":\"2996\"},\"glyph\":{\"id\":\"3062\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"3063\"},\"selection_glyph\":null,\"view\":{\"id\":\"3065\"}},\"id\":\"3064\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"navy\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"navy\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"3062\",\"type\":\"Diamond\"},{\"attributes\":{\"start\":-1.0},\"id\":\"3003\",\"type\":\"Range1d\"},{\"attributes\":{},\"id\":\"3007\",\"type\":\"LinearScale\"},{\"attributes\":{\"base\":60,\"mantissas\":[1,2,5,10,15,20,30],\"max_interval\":1800000.0,\"min_interval\":1000.0,\"num_minor_ticks\":0},\"id\":\"3089\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"months\":[0,4,8]},\"id\":\"3097\",\"type\":\"MonthsTicker\"},{\"attributes\":{},\"id\":\"3070\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"base\":24,\"mantissas\":[1,2,4,6,8,12],\"max_interval\":43200000.0,\"min_interval\":3600000.0,\"num_minor_ticks\":0},\"id\":\"3090\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"num_minor_ticks\":10,\"tickers\":[{\"id\":\"3075\"},{\"id\":\"3076\"},{\"id\":\"3077\"},{\"id\":\"3078\"},{\"id\":\"3079\"},{\"id\":\"3080\"},{\"id\":\"3081\"},{\"id\":\"3082\"},{\"id\":\"3083\"},{\"id\":\"3084\"},{\"id\":\"3085\"},{\"id\":\"3086\"}]},\"id\":\"3010\",\"type\":\"DatetimeTicker\"},{\"attributes\":{},\"id\":\"3073\",\"type\":\"Selection\"},{\"attributes\":{\"below\":[{\"id\":\"3041\"},{\"id\":\"3046\"}],\"center\":[{\"id\":\"3044\"}],\"plot_height\":120,\"plot_width\":900,\"renderers\":[{\"id\":\"3052\"}],\"title\":{\"id\":\"3031\"},\"toolbar\":{\"id\":\"3045\"},\"toolbar_location\":null,\"x_range\":{\"id\":\"3033\"},\"x_scale\":{\"id\":\"3037\"},\"y_range\":{\"id\":\"3035\"},\"y_scale\":{\"id\":\"3039\"}},\"id\":\"3030\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"active_drag\":\"auto\",\"active_inspect\":\"auto\",\"active_multi\":{\"id\":\"3054\"},\"active_scroll\":\"auto\",\"active_tap\":\"auto\",\"tools\":[{\"id\":\"3054\"}]},\"id\":\"3045\",\"type\":\"Toolbar\"},{\"attributes\":{\"dimensions\":\"width\"},\"id\":\"3021\",\"type\":\"PanTool\"},{\"attributes\":{\"days\":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31]},\"id\":\"3091\",\"type\":\"DaysTicker\"},{\"attributes\":{\"days\":[1,15]},\"id\":\"3094\",\"type\":\"DaysTicker\"},{\"attributes\":{},\"id\":\"3035\",\"type\":\"DataRange1d\"},{\"attributes\":{},\"id\":\"3074\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"text\":\"Range Selector\"},\"id\":\"3031\",\"type\":\"Title\"},{\"attributes\":{\"days\":[1,4,7,10,13,16,19,22,25,28]},\"id\":\"3092\",\"type\":\"DaysTicker\"},{\"attributes\":{\"days\":[\"%m-%d %H:%M\"],\"hours\":[\"%H:%M:%S\"],\"milliseconds\":[\"%H:%M:%S.%3N\"],\"minutes\":[\"%H:%M:%S\"],\"seconds\":[\"%H:%M:%S\"]},\"id\":\"3047\",\"type\":\"DatetimeTickFormatter\"},{\"attributes\":{\"mantissas\":[1,2,5],\"max_interval\":500.0,\"num_minor_ticks\":0},\"id\":\"3075\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"axis\":{\"id\":\"3009\"},\"minor_grid_line_alpha\":0.3,\"minor_grid_line_color\":\"navy\",\"ticker\":null},\"id\":\"3012\",\"type\":\"Grid\"},{\"attributes\":{},\"id\":\"3039\",\"type\":\"LinearScale\"},{\"attributes\":{},\"id\":\"3099\",\"type\":\"YearsTicker\"},{\"attributes\":{},\"id\":\"3014\",\"type\":\"BasicTicker\"},{\"attributes\":{},\"id\":\"3020\",\"type\":\"SaveTool\"},{\"attributes\":{\"formatter\":{\"id\":\"3070\"},\"ticker\":{\"id\":\"3014\"},\"visible\":false},\"id\":\"3013\",\"type\":\"LinearAxis\"}],\"root_ids\":[\"3066\"]},\"title\":\"Bokeh Application\",\"version\":\"2.1.1\"}};\n",
       "  var render_items = [{\"docid\":\"10e43c03-8a8e-4028-90c9-c43046977411\",\"root_ids\":[\"3066\"],\"roots\":{\"3066\":\"eaf1ffc7-f731-41f6-8cb8-d2b443dd6820\"}}];\n",
       "  root.Bokeh.embed.embed_items_notebook(docs_json, render_items);\n",
       "\n",
       "  }\n",
       "  if (root.Bokeh !== undefined) {\n",
       "    embed_document(root);\n",
       "  } else {\n",
       "    var attempts = 0;\n",
       "    var timer = setInterval(function(root) {\n",
       "      if (root.Bokeh !== undefined) {\n",
       "        clearInterval(timer);\n",
       "        embed_document(root);\n",
       "      } else {\n",
       "        attempts++;\n",
       "        if (attempts > 100) {\n",
       "          clearInterval(timer);\n",
       "          console.log(\"Bokeh: ERROR: Unable to run BokehJS code because BokehJS library is missing\");\n",
       "        }\n",
       "      }\n",
       "    }, 10, root)\n",
       "  }\n",
       "})(window);"
      ],
      "application/vnd.bokehjs_exec.v0+json": ""
     },
     "metadata": {
      "application/vnd.bokehjs_exec.v0+json": {
       "id": "3066"
      }
     },
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<h4>description</h4>Host&nbsp;summary<br><h4>timespan</h4>[TimeSpan]<br>Time span for the queried results data.<br><msticpy.nbtools.nbwidgets.QueryTime&nbsp;object&nbsp;at&nbsp;0x00000223EB028CF8><br><h4>host_entity</h4>[msticpy.data.nbtools.entities.Host]<br>The host entity object contains data about the host such as name, environment, operating system version, IP addresses and Azure VM details. Depending on the type of host, not all of this data may be populated.<br><h3>host</h3>{&nbsp;'AdditionalData':&nbsp;{},<br>&nbsp;&nbsp;'AzureDetails':&nbsp;{&nbsp;'ResourceGroup':&nbsp;'ASIHUNTOMSWORKSPACERG',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'ResourceId':&nbsp;'/subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourceGroups/ASIHUNTOMSWORKSPACERG/providers/Microsoft.Compute/virtualMachines/MSTICAlertsWin1',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'ResourceProvider':&nbsp;'Microsoft.Compute',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'ResourceType':&nbsp;'virtualMachines',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'Solutions':&nbsp;'\"security\",&nbsp;\"changeTracking\",&nbsp;\"networkMonitoring\",&nbsp;\"serviceMap\",&nbsp;'<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'\"dnsAnalytics\",&nbsp;\"securityCenterFree\",&nbsp;\"securityInsights\",&nbsp;'<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'\"windowsEventForwarding\"',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'SubscriptionId':&nbsp;'40dcc8bf-0478-4f3b-b275-ed0a94f2c013'},<br>&nbsp;&nbsp;'Environment':&nbsp;'Azure',<br>&nbsp;&nbsp;'HostName':&nbsp;'MSTICAlertsWin1',<br>&nbsp;&nbsp;'IPAddress':&nbsp;{&nbsp;'AdditionalData':&nbsp;{},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'Address':&nbsp;'40.76.43.124',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'Location':&nbsp;{&nbsp;'AdditionalData':&nbsp;{},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'CountryName':&nbsp;'United&nbsp;States',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'Latitude':&nbsp;38.71,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'Longitude':&nbsp;-78.16,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'Type':&nbsp;'geolocation'},<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'Type':&nbsp;'ipaddress'},<br>&nbsp;&nbsp;'OSName':&nbsp;'',<br>&nbsp;&nbsp;'OSType':&nbsp;'Windows',<br>&nbsp;&nbsp;'OSVMajorVersion':&nbsp;'10',<br>&nbsp;&nbsp;'OSVMinorVersion':&nbsp;'0',<br>&nbsp;&nbsp;'OmsSolutions':&nbsp;[&nbsp;'\"security\"',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'\"changeTracking\"',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'\"networkMonitoring\"',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'\"serviceMap\"',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'\"dnsAnalytics\"',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'\"securityCenterFree\"',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'\"securityInsights\"',<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'\"windowsEventForwarding\"'],<br>&nbsp;&nbsp;'SourceComputerId':&nbsp;'263a788b-6526-4cdc-8ed9-d79402fe4aa0',<br>&nbsp;&nbsp;'Type':&nbsp;'host',<br>&nbsp;&nbsp;'VMUUID':&nbsp;'3b8d40a2-33fa-4230-9dc1-794aabdd225c',<br>&nbsp;&nbsp;'private_ips':&nbsp;[IpAddress(Type=ipaddress,&nbsp;Address=10.0.3.5)],<br>&nbsp;&nbsp;'public_ips':&nbsp;[&nbsp;IpAddress(Type=ipaddress,&nbsp;Address=40.76.43.124,&nbsp;Location={&nbsp;'AdditionalData':&nbsp;{},<br>&nbsp;&nbsp;'City':...)]}<br><h4>related_alerts</h4>[pd.DataFrame]<br>Pandas DataFrame of any alerts recorded for the host within the query time span.<br><div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>TenantId</th>\n",
       "      <th>TimeGenerated</th>\n",
       "      <th>AlertDisplayName</th>\n",
       "      <th>AlertName</th>\n",
       "      <th>Severity</th>\n",
       "      <th>Description</th>\n",
       "      <th>ProviderName</th>\n",
       "      <th>VendorName</th>\n",
       "      <th>VendorOriginalId</th>\n",
       "      <th>SystemAlertId</th>\n",
       "      <th>ResourceId</th>\n",
       "      <th>SourceComputerId</th>\n",
       "      <th>AlertType</th>\n",
       "      <th>ConfidenceLevel</th>\n",
       "      <th>ConfidenceScore</th>\n",
       "      <th>IsIncident</th>\n",
       "      <th>StartTimeUtc</th>\n",
       "      <th>EndTimeUtc</th>\n",
       "      <th>ProcessingEndTime</th>\n",
       "      <th>RemediationSteps</th>\n",
       "      <th>ExtendedProperties</th>\n",
       "      <th>Entities</th>\n",
       "      <th>SourceSystem</th>\n",
       "      <th>WorkspaceSubscriptionId</th>\n",
       "      <th>WorkspaceResourceGroup</th>\n",
       "      <th>ExtendedLinks</th>\n",
       "      <th>ProductName</th>\n",
       "      <th>ProductComponentName</th>\n",
       "      <th>AlertLink</th>\n",
       "      <th>Type</th>\n",
       "      <th>Computer</th>\n",
       "      <th>src_hostname</th>\n",
       "      <th>src_accountname</th>\n",
       "      <th>src_procname</th>\n",
       "      <th>host_match</th>\n",
       "      <th>acct_match</th>\n",
       "      <th>proc_match</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>52b1ab41-869e-4138-9e40-2a4457f09bf0</td>\n",
       "      <td>2019-02-10 05:38:41+00:00</td>\n",
       "      <td>Security incident with shared process detected</td>\n",
       "      <td>Security incident with shared process detected</td>\n",
       "      <td>High</td>\n",
       "      <td>The incident which started on 2019-02-09 23:26:48 UTC and recently detected on 2019-02-10 05:38:...</td>\n",
       "      <td>Detection</td>\n",
       "      <td>Microsoft</td>\n",
       "      <td>a346dd76-a51d-464e-afc5-c6e5c6a8fc6e</td>\n",
       "      <td>2518525459919272837_a346dd76-a51d-464e-afc5-c6e5c6a8fc6e</td>\n",
       "      <td>/subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourceGroups/ASIHuntOMSWorkspaceRG/provide...</td>\n",
       "      <td>263a788b-6526-4cdc-8ed9-d79402fe4aa0</td>\n",
       "      <td>KillChainFusionIncident</td>\n",
       "      <td>Unknown</td>\n",
       "      <td>NaN</td>\n",
       "      <td>True</td>\n",
       "      <td>2019-02-09 23:26:48+00:00</td>\n",
       "      <td>2019-02-09 23:26:48+00:00</td>\n",
       "      <td>2019-02-10 05:38:41+00:00</td>\n",
       "      <td>[\\r\\n  \"1. Escalate the alert to the information security team.\",\\r\\n  \"2. Review the remediatio...</td>\n",
       "      <td>{\\r\\n  \"isincident\": \"true\",\\r\\n  \"Detected Time (UTC)\": \"2019-02-10 05:38:41 UTC\",\\r\\n  \"Incide...</td>\n",
       "      <td>[\\r\\n  {\\r\\n    \"$id\": \"4\",\\r\\n    \"DisplayName\": \"Digital currency mining related behavior dete...</td>\n",
       "      <td>Detection</td>\n",
       "      <td>40dcc8bf-0478-4f3b-b275-ed0a94f2c013</td>\n",
       "      <td>asihuntomsworkspacerg</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>SecurityAlert</td>\n",
       "      <td>MSTICAlertsWin1</td>\n",
       "      <td>MSTICAlertsWin1</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>True</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>52b1ab41-869e-4138-9e40-2a4457f09bf0</td>\n",
       "      <td>2019-02-09 23:27:23+00:00</td>\n",
       "      <td>Digital currency mining related behavior detected</td>\n",
       "      <td>Digital currency mining related behavior detected</td>\n",
       "      <td>High</td>\n",
       "      <td>Analysis of host data on MSTICALERTSWIN1 detected the execution of a process or command normally...</td>\n",
       "      <td>Detection</td>\n",
       "      <td>Microsoft</td>\n",
       "      <td>b1d1c4df-4f84-455f-9280-35e3cfe8a313</td>\n",
       "      <td>2518525459919272837_b1d1c4df-4f84-455f-9280-35e3cfe8a313</td>\n",
       "      <td>/subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourceGroups/ASIHuntOMSWorkspaceRG/provide...</td>\n",
       "      <td>263a788b-6526-4cdc-8ed9-d79402fe4aa0</td>\n",
       "      <td>SCUBA_RULE_DigitalCurrencyMiningTool</td>\n",
       "      <td>Unknown</td>\n",
       "      <td>NaN</td>\n",
       "      <td>False</td>\n",
       "      <td>2019-02-09 23:26:48+00:00</td>\n",
       "      <td>2019-02-09 23:26:48+00:00</td>\n",
       "      <td>2019-02-09 23:27:24+00:00</td>\n",
       "      <td>[\\r\\n  \"1. Run Process Explorer and try to identify unknown running processes (see https://techn...</td>\n",
       "      <td>{\\r\\n  \"Compromised Host\": \"MSTICALERTSWIN1\",\\r\\n  \"User Name\": \"MSTICALERTSWIN1\\\\MSTICAdmin\",\\r...</td>\n",
       "      <td>[\\r\\n  {\\r\\n    \"$id\": \"4\",\\r\\n    \"DnsDomain\": \"\",\\r\\n    \"NTDomain\": \"\",\\r\\n    \"HostName\": \"M...</td>\n",
       "      <td>Detection</td>\n",
       "      <td>40dcc8bf-0478-4f3b-b275-ed0a94f2c013</td>\n",
       "      <td>asihuntomsworkspacerg</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>SecurityAlert</td>\n",
       "      <td>MSTICAlertsWin1</td>\n",
       "      <td>MSTICAlertsWin1</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>True</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>52b1ab41-869e-4138-9e40-2a4457f09bf0</td>\n",
       "      <td>2019-02-09 23:27:25+00:00</td>\n",
       "      <td>Suspiciously named process detected</td>\n",
       "      <td>Suspiciously named process detected</td>\n",
       "      <td>High</td>\n",
       "      <td>Analysis of host data on MSTICALERTSWIN1 detected a process whose name is very similar to but di...</td>\n",
       "      <td>Detection</td>\n",
       "      <td>Microsoft</td>\n",
       "      <td>d4e28a5d-6267-414c-8c1f-50d0e27fe442</td>\n",
       "      <td>2518525459919272837_d4e28a5d-6267-414c-8c1f-50d0e27fe442</td>\n",
       "      <td>/subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourceGroups/ASIHuntOMSWorkspaceRG/provide...</td>\n",
       "      <td>263a788b-6526-4cdc-8ed9-d79402fe4aa0</td>\n",
       "      <td>SCUBA_PROCESSNAMESIMILARITY</td>\n",
       "      <td>Unknown</td>\n",
       "      <td>NaN</td>\n",
       "      <td>False</td>\n",
       "      <td>2019-02-09 23:26:48+00:00</td>\n",
       "      <td>2019-02-09 23:26:48+00:00</td>\n",
       "      <td>2019-02-09 23:27:25+00:00</td>\n",
       "      <td>[\\r\\n  \"Review with MSTICAlertsWin1\\\\MSTICAdmin the suspicious process identified in this alert ...</td>\n",
       "      <td>{\\r\\n  \"Account Session Id\": \"0xab5a5ac\",\\r\\n  \"Compromised Host\": \"MSTICALERTSWIN1\",\\r\\n  \"Pare...</td>\n",
       "      <td>[\\r\\n  {\\r\\n    \"$id\": \"2\",\\r\\n    \"HostName\": \"msticalertswin1\",\\r\\n    \"AzureID\": \"/subscripti...</td>\n",
       "      <td>Detection</td>\n",
       "      <td>40dcc8bf-0478-4f3b-b275-ed0a94f2c013</td>\n",
       "      <td>asihuntomsworkspacerg</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>SecurityAlert</td>\n",
       "      <td>MSTICAlertsWin1</td>\n",
       "      <td>MSTICAlertsWin1</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>True</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>52b1ab41-869e-4138-9e40-2a4457f09bf0</td>\n",
       "      <td>2019-02-07 00:58:29+00:00</td>\n",
       "      <td>Sample Alert Rule</td>\n",
       "      <td>Sample Alert Rule</td>\n",
       "      <td>Medium</td>\n",
       "      <td></td>\n",
       "      <td>CustomAlertRule</td>\n",
       "      <td>Alert Rule</td>\n",
       "      <td>1ff13f6a-481e-4a7c-8ab1-654a054f647e</td>\n",
       "      <td>4b955429-bea1-4fe8-9dce-661f861975e0</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>CustomAlertRule_d45eb79f-18e2-4f9b-aeb2-f242a8007960</td>\n",
       "      <td>Unknown</td>\n",
       "      <td>NaN</td>\n",
       "      <td>False</td>\n",
       "      <td>2019-02-06 23:48:24+00:00</td>\n",
       "      <td>2019-02-07 00:48:24+00:00</td>\n",
       "      <td>2019-02-07 00:58:29+00:00</td>\n",
       "      <td></td>\n",
       "      <td>{\\r\\n  \"Alert Mode\": \"Aggregated\",\\r\\n  \"Search Query\": \"{\\\"detailBladeInputs\\\":{\\\"id\\\":\\\"/subsc...</td>\n",
       "      <td>[\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"HostName\": \"MSTICAlertsWin1\",\\r\\n    \"Type\": \"host\",\\r\\n    ...</td>\n",
       "      <td>Detection</td>\n",
       "      <td>40dcc8bf-0478-4f3b-b275-ed0a94f2c013</td>\n",
       "      <td>asihuntomsworkspacerg</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>SecurityAlert</td>\n",
       "      <td>MSTICAlertsWin1</td>\n",
       "      <td>MSTICAlertsWin1</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>True</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>52b1ab41-869e-4138-9e40-2a4457f09bf0</td>\n",
       "      <td>2019-02-07 00:06:32+00:00</td>\n",
       "      <td>Potential attempt to bypass AppLocker detected</td>\n",
       "      <td>Potential attempt to bypass AppLocker detected</td>\n",
       "      <td>High</td>\n",
       "      <td>Analysis of host data on MSTICALERTSWIN1 detected a potential attempt to bypass AppLocker restri...</td>\n",
       "      <td>Detection</td>\n",
       "      <td>Microsoft</td>\n",
       "      <td>46354390-3396-4e43-aad4-673568583988</td>\n",
       "      <td>2518528028434712203_46354390-3396-4e43-aad4-673568583988</td>\n",
       "      <td>/subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourceGroups/ASIHuntOMSWorkspaceRG/provide...</td>\n",
       "      <td>263a788b-6526-4cdc-8ed9-d79402fe4aa0</td>\n",
       "      <td>SCUBA_RULE_Applocker_Bypass</td>\n",
       "      <td>Unknown</td>\n",
       "      <td>NaN</td>\n",
       "      <td>False</td>\n",
       "      <td>2019-02-07 00:05:56+00:00</td>\n",
       "      <td>2019-02-07 00:05:56+00:00</td>\n",
       "      <td>2019-02-07 00:06:33+00:00</td>\n",
       "      <td>[\\r\\n  \"Review with WORKGROUP\\\\MSTICAlertsWin1$ the suspicious command line in this alert to see...</td>\n",
       "      <td>{\\r\\n  \"Compromised Host\": \"MSTICALERTSWIN1\",\\r\\n  \"User Name\": \"WORKGROUP\\\\MSTICAlertsWin1$\",\\r...</td>\n",
       "      <td>[\\r\\n  {\\r\\n    \"$id\": \"4\",\\r\\n    \"DnsDomain\": \"\",\\r\\n    \"NTDomain\": \"\",\\r\\n    \"HostName\": \"M...</td>\n",
       "      <td>Detection</td>\n",
       "      <td>40dcc8bf-0478-4f3b-b275-ed0a94f2c013</td>\n",
       "      <td>asihuntomsworkspacerg</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>SecurityAlert</td>\n",
       "      <td>MSTICAlertsWin1</td>\n",
       "      <td>MSTICAlertsWin1</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>True</td>\n",
       "      <td>False</td>\n",
       "      <td>False</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div><br><h4>alert_timeline</h4>Bokeh time plot of alerts recorded for host.<br><div style=\"display: table;\"><div style=\"display: table-row;\"><div style=\"display: table-cell;\"><b title=\"bokeh.models.layouts.Column\">Column</b>(</div><div style=\"display: table-cell;\">id&nbsp;=&nbsp;'3066', <span id=\"3514\" style=\"cursor: pointer;\">&hellip;)</span></div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">align&nbsp;=&nbsp;'start',</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">aspect_ratio&nbsp;=&nbsp;None,</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">background&nbsp;=&nbsp;None,</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">children&nbsp;=&nbsp;[Figure(id='2998', ...), Figure(id='3030', ...)],</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">css_classes&nbsp;=&nbsp;[],</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">disabled&nbsp;=&nbsp;False,</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">height&nbsp;=&nbsp;None,</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">height_policy&nbsp;=&nbsp;'auto',</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">js_event_callbacks&nbsp;=&nbsp;{},</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">js_property_callbacks&nbsp;=&nbsp;{},</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">margin&nbsp;=&nbsp;(0, 0, 0, 0),</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">max_height&nbsp;=&nbsp;None,</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">max_width&nbsp;=&nbsp;None,</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_height&nbsp;=&nbsp;None,</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">min_width&nbsp;=&nbsp;None,</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">name&nbsp;=&nbsp;None,</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">rows&nbsp;=&nbsp;'auto',</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">sizing_mode&nbsp;=&nbsp;None,</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">spacing&nbsp;=&nbsp;0,</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">subscribed_events&nbsp;=&nbsp;[],</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">tags&nbsp;=&nbsp;[],</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">visible&nbsp;=&nbsp;True,</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">width&nbsp;=&nbsp;None,</div></div><div class=\"3513\" style=\"display: none;\"><div style=\"display: table-cell;\"></div><div style=\"display: table-cell;\">width_policy&nbsp;=&nbsp;'auto')</div></div></div>\n",
       "<script>\n",
       "(function() {\n",
       "  var expanded = false;\n",
       "  var ellipsis = document.getElementById(\"3514\");\n",
       "  ellipsis.addEventListener(\"click\", function() {\n",
       "    var rows = document.getElementsByClassName(\"3513\");\n",
       "    for (var i = 0; i < rows.length; i++) {\n",
       "      var el = rows[i];\n",
       "      el.style.display = expanded ? \"none\" : \"table-row\";\n",
       "    }\n",
       "    ellipsis.innerHTML = expanded ? \"&hellip;)\" : \"&lsaquo;&lsaquo;&lsaquo;\";\n",
       "    expanded = !expanded;\n",
       "  });\n",
       "})();\n",
       "</script>\n",
       "<br><h4>related_bookmarks</h4>[pd.DataFrame]<br>Pandas DataFrame of any investigation bookmarks relating to the host.<br><div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>TenantId</th>\n",
       "      <th>TimeGenerated</th>\n",
       "      <th>BookmarkId</th>\n",
       "      <th>BookmarkName</th>\n",
       "      <th>BookmarkType</th>\n",
       "      <th>CreatedBy</th>\n",
       "      <th>UpdatedBy</th>\n",
       "      <th>CreatedTime</th>\n",
       "      <th>LastUpdatedTime</th>\n",
       "      <th>EventTime</th>\n",
       "      <th>QueryText</th>\n",
       "      <th>QueryResultRow</th>\n",
       "      <th>QueryStartTime</th>\n",
       "      <th>QueryEndTime</th>\n",
       "      <th>Notes</th>\n",
       "      <th>SoftDeleted</th>\n",
       "      <th>Tags</th>\n",
       "      <th>SourceSystem</th>\n",
       "      <th>Type</th>\n",
       "      <th>_ResourceId</th>\n",
       "      <th>Computer</th>\n",
       "      <th>Account</th>\n",
       "      <th>Entities</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "HostSummaryResult(description='Host summary', timespan=<msticpy.nbtools.nbwidgets.QueryTime object at 0x00000223EB028CF8>, _attribute_desc={'host_entity': ('msticpy.data.nbtools.entities.Host', 'The host entity object contains data about the host such as name, environment, operating system version, IP addresses and Azure VM details. Depending on the type of host, not all of this data may be populated.'), 'related_alerts': ('pd.DataFrame', 'Pandas DataFrame of any alerts recorded for the host within the query time span.'), 'alert_timeline': ('', 'Bokeh time plot of alerts recorded for host.'), 'related_bookmarks': ('pd.DataFrame', 'Pandas DataFrame of any investigation bookmarks relating to the host.'), 'timespan': ('TimeSpan', 'Time span for the queried results data.')}, host_entity=Host(Type=host, HostName=MSTICAlertsWin1, SourceComputerId=263a788b-6526-4cdc-8ed9-d7...), related_alerts=                                 TenantId             TimeGenerated  \\\n",
       "0    52b1ab41-869e-4138-9e40-2a4457f09bf0 2019-02-10 05:38:41+00:00   \n",
       "1    52b1ab41-869e-4138-9e40-2a4457f09bf0 2019-02-09 23:27:23+00:00   \n",
       "2    52b1ab41-869e-4138-9e40-2a4457f09bf0 2019-02-09 23:27:25+00:00   \n",
       "3    52b1ab41-869e-4138-9e40-2a4457f09bf0 2019-02-07 00:58:29+00:00   \n",
       "4    52b1ab41-869e-4138-9e40-2a4457f09bf0 2019-02-07 00:06:32+00:00   \n",
       "..                                    ...                       ...   \n",
       "296  52b1ab41-869e-4138-9e40-2a4457f09bf0 2019-02-05 17:15:18+00:00   \n",
       "297  52b1ab41-869e-4138-9e40-2a4457f09bf0 2019-02-06 07:28:11+00:00   \n",
       "298  52b1ab41-869e-4138-9e40-2a4457f09bf0 2019-02-06 07:58:31+00:00   \n",
       "299  52b1ab41-869e-4138-9e40-2a4457f09bf0 2019-02-06 06:58:31+00:00   \n",
       "300  52b1ab41-869e-4138-9e40-2a4457f09bf0 2019-02-06 08:58:32+00:00   \n",
       "\n",
       "                                      AlertDisplayName  \\\n",
       "0       Security incident with shared process detected   \n",
       "1    Digital currency mining related behavior detected   \n",
       "2                  Suspiciously named process detected   \n",
       "3                                    Sample Alert Rule   \n",
       "4       Potential attempt to bypass AppLocker detected   \n",
       "..                                                 ...   \n",
       "296                Suspicious SVCHOST process executed   \n",
       "297     Security incident with shared process detected   \n",
       "298                                  Sample Alert Rule   \n",
       "299                                  Sample Alert Rule   \n",
       "300                                  Sample Alert Rule   \n",
       "\n",
       "                                             AlertName Severity  \\\n",
       "0       Security incident with shared process detected     High   \n",
       "1    Digital currency mining related behavior detected     High   \n",
       "2                  Suspiciously named process detected     High   \n",
       "3                                    Sample Alert Rule   Medium   \n",
       "4       Potential attempt to bypass AppLocker detected     High   \n",
       "..                                                 ...      ...   \n",
       "296                Suspicious SVCHOST process executed     High   \n",
       "297     Security incident with shared process detected     High   \n",
       "298                                  Sample Alert Rule   Medium   \n",
       "299                                  Sample Alert Rule   Medium   \n",
       "300                                  Sample Alert Rule   Medium   \n",
       "\n",
       "                                                                                             Description  \\\n",
       "0    The incident which started on 2019-02-09 23:26:48 UTC and recently detected on 2019-02-10 05:38:...   \n",
       "1    Analysis of host data on MSTICALERTSWIN1 detected the execution of a process or command normally...   \n",
       "2    Analysis of host data on MSTICALERTSWIN1 detected a process whose name is very similar to but di...   \n",
       "3                                                                                                          \n",
       "4    Analysis of host data on MSTICALERTSWIN1 detected a potential attempt to bypass AppLocker restri...   \n",
       "..                                                                                                   ...   \n",
       "296  The system process SVCHOST was observed running in an abnormal context. Malware often use SVCHOS...   \n",
       "297  The incident which started on 2019-02-05 21:15:07 UTC and recently detected on 2019-02-06 07:28:...   \n",
       "298                                                                                                        \n",
       "299                                                                                                        \n",
       "300                                                                                                        \n",
       "\n",
       "        ProviderName  VendorName                      VendorOriginalId  \\\n",
       "0          Detection   Microsoft  a346dd76-a51d-464e-afc5-c6e5c6a8fc6e   \n",
       "1          Detection   Microsoft  b1d1c4df-4f84-455f-9280-35e3cfe8a313   \n",
       "2          Detection   Microsoft  d4e28a5d-6267-414c-8c1f-50d0e27fe442   \n",
       "3    CustomAlertRule  Alert Rule  1ff13f6a-481e-4a7c-8ab1-654a054f647e   \n",
       "4          Detection   Microsoft  46354390-3396-4e43-aad4-673568583988   \n",
       "..               ...         ...                                   ...   \n",
       "296        Detection   Microsoft  4c1af4f7-446a-472c-8010-f3db2cda7ee3   \n",
       "297        Detection   Microsoft  57ef2df6-4a85-4f1d-9c07-f4be5339a8b4   \n",
       "298  CustomAlertRule  Alert Rule  d64998d6-208c-452d-a4ea-fe6578f65eed   \n",
       "299  CustomAlertRule  Alert Rule  8a3cf5aa-af79-4d81-b3f4-2e986b668e2d   \n",
       "300  CustomAlertRule  Alert Rule  034b89c3-40b3-4ad3-bb5c-7fad41bdca14   \n",
       "\n",
       "                                                SystemAlertId  \\\n",
       "0    2518525459919272837_a346dd76-a51d-464e-afc5-c6e5c6a8fc6e   \n",
       "1    2518525459919272837_b1d1c4df-4f84-455f-9280-35e3cfe8a313   \n",
       "2    2518525459919272837_d4e28a5d-6267-414c-8c1f-50d0e27fe442   \n",
       "3                        4b955429-bea1-4fe8-9dce-661f861975e0   \n",
       "4    2518528028434712203_46354390-3396-4e43-aad4-673568583988   \n",
       "..                                                        ...   \n",
       "296  2518529138862581444_4c1af4f7-446a-472c-8010-f3db2cda7ee3   \n",
       "297  2518528994922874196_57ef2df6-4a85-4f1d-9c07-f4be5339a8b4   \n",
       "298                      5c09b025-d962-44a2-af0b-166bfb780105   \n",
       "299                      ef0e0458-935f-4dd3-bd7c-8062ade69b77   \n",
       "300                      1d10fc3e-e2f8-4827-82bc-1e4dcd4be886   \n",
       "\n",
       "                                                                                              ResourceId  \\\n",
       "0    /subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourceGroups/ASIHuntOMSWorkspaceRG/provide...   \n",
       "1    /subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourceGroups/ASIHuntOMSWorkspaceRG/provide...   \n",
       "2    /subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourceGroups/ASIHuntOMSWorkspaceRG/provide...   \n",
       "3                                                                                                          \n",
       "4    /subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourceGroups/ASIHuntOMSWorkspaceRG/provide...   \n",
       "..                                                                                                   ...   \n",
       "296  /subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourceGroups/ASIHuntOMSWorkspaceRG/provide...   \n",
       "297  /subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourceGroups/ASIHuntOMSWorkspaceRG/provide...   \n",
       "298                                                                                                        \n",
       "299                                                                                                        \n",
       "300                                                                                                        \n",
       "\n",
       "                         SourceComputerId  \\\n",
       "0    263a788b-6526-4cdc-8ed9-d79402fe4aa0   \n",
       "1    263a788b-6526-4cdc-8ed9-d79402fe4aa0   \n",
       "2    263a788b-6526-4cdc-8ed9-d79402fe4aa0   \n",
       "3                                           \n",
       "4    263a788b-6526-4cdc-8ed9-d79402fe4aa0   \n",
       "..                                    ...   \n",
       "296  263a788b-6526-4cdc-8ed9-d79402fe4aa0   \n",
       "297  263a788b-6526-4cdc-8ed9-d79402fe4aa0   \n",
       "298                                         \n",
       "299                                         \n",
       "300                                         \n",
       "\n",
       "                                                AlertType ConfidenceLevel  \\\n",
       "0                                 KillChainFusionIncident         Unknown   \n",
       "1                    SCUBA_RULE_DigitalCurrencyMiningTool         Unknown   \n",
       "2                             SCUBA_PROCESSNAMESIMILARITY         Unknown   \n",
       "3    CustomAlertRule_d45eb79f-18e2-4f9b-aeb2-f242a8007960         Unknown   \n",
       "4                             SCUBA_RULE_Applocker_Bypass         Unknown   \n",
       "..                                                    ...             ...   \n",
       "296                                     SuspiciousSVCHost         Unknown   \n",
       "297                               KillChainFusionIncident         Unknown   \n",
       "298  CustomAlertRule_d45eb79f-18e2-4f9b-aeb2-f242a8007960         Unknown   \n",
       "299  CustomAlertRule_d45eb79f-18e2-4f9b-aeb2-f242a8007960         Unknown   \n",
       "300  CustomAlertRule_d45eb79f-18e2-4f9b-aeb2-f242a8007960         Unknown   \n",
       "\n",
       "     ConfidenceScore  IsIncident              StartTimeUtc  \\\n",
       "0                NaN        True 2019-02-09 23:26:48+00:00   \n",
       "1                NaN       False 2019-02-09 23:26:48+00:00   \n",
       "2                NaN       False 2019-02-09 23:26:48+00:00   \n",
       "3                NaN       False 2019-02-06 23:48:24+00:00   \n",
       "4                NaN       False 2019-02-07 00:05:56+00:00   \n",
       "..               ...         ...                       ...   \n",
       "296              NaN       False 2019-02-05 17:15:13+00:00   \n",
       "297              NaN        True 2019-02-05 21:15:07+00:00   \n",
       "298              NaN       False 2019-02-06 06:48:24+00:00   \n",
       "299              NaN       False 2019-02-06 05:48:24+00:00   \n",
       "300              NaN       False 2019-02-06 07:48:24+00:00   \n",
       "\n",
       "                   EndTimeUtc         ProcessingEndTime  \\\n",
       "0   2019-02-09 23:26:48+00:00 2019-02-10 05:38:41+00:00   \n",
       "1   2019-02-09 23:26:48+00:00 2019-02-09 23:27:24+00:00   \n",
       "2   2019-02-09 23:26:48+00:00 2019-02-09 23:27:25+00:00   \n",
       "3   2019-02-07 00:48:24+00:00 2019-02-07 00:58:29+00:00   \n",
       "4   2019-02-07 00:05:56+00:00 2019-02-07 00:06:33+00:00   \n",
       "..                        ...                       ...   \n",
       "296 2019-02-05 17:15:13+00:00 2019-02-05 17:15:18+00:00   \n",
       "297 2019-02-05 23:45:01+00:00 2019-02-06 07:28:11+00:00   \n",
       "298 2019-02-06 07:48:24+00:00 2019-02-06 07:58:31+00:00   \n",
       "299 2019-02-06 06:48:24+00:00 2019-02-06 06:58:31+00:00   \n",
       "300 2019-02-06 08:48:24+00:00 2019-02-06 08:58:32+00:00   \n",
       "\n",
       "                                                                                        RemediationSteps  \\\n",
       "0    [\\r\\n  \"1. Escalate the alert to the information security team.\",\\r\\n  \"2. Review the remediatio...   \n",
       "1    [\\r\\n  \"1. Run Process Explorer and try to identify unknown running processes (see https://techn...   \n",
       "2    [\\r\\n  \"Review with MSTICAlertsWin1\\\\MSTICAdmin the suspicious process identified in this alert ...   \n",
       "3                                                                                                          \n",
       "4    [\\r\\n  \"Review with WORKGROUP\\\\MSTICAlertsWin1$ the suspicious command line in this alert to see...   \n",
       "..                                                                                                   ...   \n",
       "296  [\\r\\n  \"1. Run Process Explorer and try to identify unknown running processes (see https://techn...   \n",
       "297  [\\r\\n  \"1. Escalate the alert to the information security team.\",\\r\\n  \"2. Review the remediatio...   \n",
       "298                                                                                                        \n",
       "299                                                                                                        \n",
       "300                                                                                                        \n",
       "\n",
       "                                                                                      ExtendedProperties  \\\n",
       "0    {\\r\\n  \"isincident\": \"true\",\\r\\n  \"Detected Time (UTC)\": \"2019-02-10 05:38:41 UTC\",\\r\\n  \"Incide...   \n",
       "1    {\\r\\n  \"Compromised Host\": \"MSTICALERTSWIN1\",\\r\\n  \"User Name\": \"MSTICALERTSWIN1\\\\MSTICAdmin\",\\r...   \n",
       "2    {\\r\\n  \"Account Session Id\": \"0xab5a5ac\",\\r\\n  \"Compromised Host\": \"MSTICALERTSWIN1\",\\r\\n  \"Pare...   \n",
       "3    {\\r\\n  \"Alert Mode\": \"Aggregated\",\\r\\n  \"Search Query\": \"{\\\"detailBladeInputs\\\":{\\\"id\\\":\\\"/subsc...   \n",
       "4    {\\r\\n  \"Compromised Host\": \"MSTICALERTSWIN1\",\\r\\n  \"User Name\": \"WORKGROUP\\\\MSTICAlertsWin1$\",\\r...   \n",
       "..                                                                                                   ...   \n",
       "296  {\\r\\n  \"domain name\": \"MSTICAlertsWin1\",\\r\\n  \"user name\": \"MSTICALERTSWIN1\\\\MSTICAdmin\",\\r\\n  \"...   \n",
       "297  {\\r\\n  \"isincident\": \"true\",\\r\\n  \"Detected Time (UTC)\": \"2019-02-06 07:28:11 UTC\",\\r\\n  \"Incide...   \n",
       "298  {\\r\\n  \"Alert Mode\": \"Aggregated\",\\r\\n  \"Search Query\": \"{\\\"detailBladeInputs\\\":{\\\"id\\\":\\\"/subsc...   \n",
       "299  {\\r\\n  \"Alert Mode\": \"Aggregated\",\\r\\n  \"Search Query\": \"{\\\"detailBladeInputs\\\":{\\\"id\\\":\\\"/subsc...   \n",
       "300  {\\r\\n  \"Alert Mode\": \"Aggregated\",\\r\\n  \"Search Query\": \"{\\\"detailBladeInputs\\\":{\\\"id\\\":\\\"/subsc...   \n",
       "\n",
       "                                                                                                Entities  \\\n",
       "0    [\\r\\n  {\\r\\n    \"$id\": \"4\",\\r\\n    \"DisplayName\": \"Digital currency mining related behavior dete...   \n",
       "1    [\\r\\n  {\\r\\n    \"$id\": \"4\",\\r\\n    \"DnsDomain\": \"\",\\r\\n    \"NTDomain\": \"\",\\r\\n    \"HostName\": \"M...   \n",
       "2    [\\r\\n  {\\r\\n    \"$id\": \"2\",\\r\\n    \"HostName\": \"msticalertswin1\",\\r\\n    \"AzureID\": \"/subscripti...   \n",
       "3    [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"HostName\": \"MSTICAlertsWin1\",\\r\\n    \"Type\": \"host\",\\r\\n    ...   \n",
       "4    [\\r\\n  {\\r\\n    \"$id\": \"4\",\\r\\n    \"DnsDomain\": \"\",\\r\\n    \"NTDomain\": \"\",\\r\\n    \"HostName\": \"M...   \n",
       "..                                                                                                   ...   \n",
       "296  [\\r\\n  {\\r\\n    \"$id\": \"4\",\\r\\n    \"DnsDomain\": \"\",\\r\\n    \"NTDomain\": \"\",\\r\\n    \"HostName\": \"M...   \n",
       "297  [\\r\\n  {\\r\\n    \"$id\": \"4\",\\r\\n    \"DisplayName\": \"Suspiciously named process detected\",\\r\\n    ...   \n",
       "298  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"HostName\": \"Test4VM\",\\r\\n    \"Type\": \"host\",\\r\\n    \"Count\":...   \n",
       "299  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"HostName\": \"MSTICAlertsWin1\",\\r\\n    \"Type\": \"host\",\\r\\n    ...   \n",
       "300  [\\r\\n  {\\r\\n    \"$id\": \"3\",\\r\\n    \"HostName\": \"Test4VM\",\\r\\n    \"Type\": \"host\",\\r\\n    \"Count\":...   \n",
       "\n",
       "    SourceSystem               WorkspaceSubscriptionId WorkspaceResourceGroup  \\\n",
       "0      Detection  40dcc8bf-0478-4f3b-b275-ed0a94f2c013  asihuntomsworkspacerg   \n",
       "1      Detection  40dcc8bf-0478-4f3b-b275-ed0a94f2c013  asihuntomsworkspacerg   \n",
       "2      Detection  40dcc8bf-0478-4f3b-b275-ed0a94f2c013  asihuntomsworkspacerg   \n",
       "3      Detection  40dcc8bf-0478-4f3b-b275-ed0a94f2c013  asihuntomsworkspacerg   \n",
       "4      Detection  40dcc8bf-0478-4f3b-b275-ed0a94f2c013  asihuntomsworkspacerg   \n",
       "..           ...                                   ...                    ...   \n",
       "296    Detection  40dcc8bf-0478-4f3b-b275-ed0a94f2c013  asihuntomsworkspacerg   \n",
       "297    Detection  40dcc8bf-0478-4f3b-b275-ed0a94f2c013  asihuntomsworkspacerg   \n",
       "298    Detection  40dcc8bf-0478-4f3b-b275-ed0a94f2c013  asihuntomsworkspacerg   \n",
       "299    Detection  40dcc8bf-0478-4f3b-b275-ed0a94f2c013  asihuntomsworkspacerg   \n",
       "300    Detection  40dcc8bf-0478-4f3b-b275-ed0a94f2c013  asihuntomsworkspacerg   \n",
       "\n",
       "    ExtendedLinks ProductName ProductComponentName AlertLink           Type  \\\n",
       "0                                                             SecurityAlert   \n",
       "1                                                             SecurityAlert   \n",
       "2                                                             SecurityAlert   \n",
       "3                                                             SecurityAlert   \n",
       "4                                                             SecurityAlert   \n",
       "..            ...         ...                  ...       ...            ...   \n",
       "296                                                           SecurityAlert   \n",
       "297                                                           SecurityAlert   \n",
       "298                                                           SecurityAlert   \n",
       "299                                                           SecurityAlert   \n",
       "300                                                           SecurityAlert   \n",
       "\n",
       "            Computer     src_hostname src_accountname src_procname  \\\n",
       "0    MSTICAlertsWin1  MSTICAlertsWin1                                \n",
       "1    MSTICAlertsWin1  MSTICAlertsWin1                                \n",
       "2    MSTICAlertsWin1  MSTICAlertsWin1                                \n",
       "3    MSTICAlertsWin1  MSTICAlertsWin1                                \n",
       "4    MSTICAlertsWin1  MSTICAlertsWin1                                \n",
       "..               ...              ...             ...          ...   \n",
       "296  MSTICAlertsWin1  MSTICAlertsWin1                                \n",
       "297  MSTICAlertsWin1  MSTICAlertsWin1                                \n",
       "298  MSTICAlertsWin1  MSTICAlertsWin1                                \n",
       "299  MSTICAlertsWin1  MSTICAlertsWin1                                \n",
       "300  MSTICAlertsWin1  MSTICAlertsWin1                                \n",
       "\n",
       "     host_match  acct_match  proc_match  \n",
       "0          True       False       False  \n",
       "1          True       False       False  \n",
       "2          True       False       False  \n",
       "3          True       False       False  \n",
       "4          True       False       False  \n",
       "..          ...         ...         ...  \n",
       "296        True       False       False  \n",
       "297        True       False       False  \n",
       "298        True       False       False  \n",
       "299        True       False       False  \n",
       "300        True       False       False  \n",
       "\n",
       "[301 rows x 37 columns], alert_timeline=Column(id='3066', ...), related_bookmarks=Empty DataFrame\n",
       "Columns: [TenantId, TimeGenerated, BookmarkId, BookmarkName, BookmarkType, CreatedBy, UpdatedBy, CreatedTime, LastUpdatedTime, EventTime, QueryText, QueryResultRow, QueryStartTime, QueryEndTime, Notes, SoftDeleted, Tags, SourceSystem, Type, _ResourceId, Computer, Account, Entities]\n",
       "Index: [])"
      ]
     },
     "execution_count": 32,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "host_sum_rslt"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "---\n",
    "## Simple Notebooklet browser"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "application/vnd.jupyter.widget-view+json": {
       "model_id": "f59bbc4d857f4f999fc7ab3159bda87e",
       "version_major": 2,
       "version_minor": 0
      },
      "text/plain": [
       "VBox(children=(HBox(children=(VBox(children=(Select(options=(('AccountSummary', <class 'msticnb.nb.azsent.acco…"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/plain": [
       "<msticnb.nb_browser.NBBrowser at 0x223ea1280f0>"
      ]
     },
     "execution_count": 18,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "nb.browse()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<h1>Host Security Events Summary</h1>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "This shows a summary of security events for the host. These are grouped by EventID and Account.<br>Data and plots are stored in the result class returned by this function."
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Getting data from SecurityEvent...\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<h2>Summary of Security Events on host</h2>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "This is a summary of Security events for the host (excluding process creation and account logon - 4688, 4624, 4625).<br>Yellow highlights indicate account with highest event count for an EventID."
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<style  type=\"text/css\" >\n",
       "    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row0_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row0_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row0_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row0_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row0_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row0_col5 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row0_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row0_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row0_col8 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row0_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row0_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row1_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row1_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row1_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row1_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row1_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row1_col5 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row1_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row1_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row1_col8 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row1_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row1_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row2_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row2_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row2_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row2_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row2_col4 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row2_col5 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row2_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row2_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row2_col8 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row2_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row2_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row3_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row3_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row3_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row3_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row3_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row3_col5 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row3_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row3_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row3_col8 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row3_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row3_col10 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row4_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row4_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row4_col2 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row4_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row4_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row4_col5 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row4_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row4_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row4_col8 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row4_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row4_col10 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row5_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row5_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row5_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row5_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row5_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row5_col5 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row5_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row5_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row5_col8 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row5_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row5_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row6_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row6_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row6_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row6_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row6_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row6_col5 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row6_col6 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row6_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row6_col8 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row6_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row6_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row7_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row7_col1 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row7_col2 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row7_col3 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row7_col4 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row7_col5 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row7_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row7_col7 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row7_col8 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row7_col9 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row7_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row8_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row8_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row8_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row8_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row8_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row8_col5 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row8_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row8_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row8_col8 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row8_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row8_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row9_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row9_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row9_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row9_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row9_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row9_col5 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row9_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row9_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row9_col8 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row9_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row9_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row10_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row10_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row10_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row10_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row10_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row10_col5 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row10_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row10_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row10_col8 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row10_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row10_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row11_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row11_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row11_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row11_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row11_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row11_col5 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row11_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row11_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row11_col8 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row11_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row11_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row12_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row12_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row12_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row12_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row12_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row12_col5 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row12_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row12_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row12_col8 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row12_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row12_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row13_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row13_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row13_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row13_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row13_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row13_col5 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row13_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row13_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row13_col8 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row13_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row13_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row14_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row14_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row14_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row14_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row14_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row14_col5 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row14_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row14_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row14_col8 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row14_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row14_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row15_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row15_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row15_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row15_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row15_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row15_col5 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row15_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row15_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row15_col8 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row15_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row15_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row16_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row16_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row16_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row16_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row16_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row16_col5 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row16_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row16_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row16_col8 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row16_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row16_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row17_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row17_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row17_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row17_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row17_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row17_col5 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row17_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row17_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row17_col8 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row17_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row17_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row18_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row18_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row18_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row18_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row18_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row18_col5 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row18_col6 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row18_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row18_col8 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row18_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row18_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row19_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row19_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row19_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row19_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row19_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row19_col5 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row19_col6 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row19_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row19_col8 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row19_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row19_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row20_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row20_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row20_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row20_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row20_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row20_col5 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row20_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row20_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row20_col8 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row20_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row20_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row21_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row21_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row21_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row21_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row21_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row21_col5 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row21_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row21_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row21_col8 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row21_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row21_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row22_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row22_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row22_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row22_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row22_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row22_col5 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row22_col6 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row22_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row22_col8 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row22_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row22_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row23_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row23_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row23_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row23_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row23_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row23_col5 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row23_col6 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row23_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row23_col8 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row23_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row23_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row24_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row24_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row24_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row24_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row24_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row24_col5 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row24_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row24_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row24_col8 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row24_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row24_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row25_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row25_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row25_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row25_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row25_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row25_col5 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row25_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row25_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row25_col8 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row25_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row25_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row26_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row26_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row26_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row26_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row26_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row26_col5 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row26_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row26_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row26_col8 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row26_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row26_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row27_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row27_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row27_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row27_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row27_col4 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row27_col5 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row27_col6 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row27_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row27_col8 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row27_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row27_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row28_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row28_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row28_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row28_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row28_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row28_col5 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row28_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row28_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row28_col8 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row28_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row28_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row29_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row29_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row29_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row29_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row29_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row29_col5 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row29_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row29_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row29_col8 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row29_col9 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row29_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row30_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row30_col1 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row30_col2 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row30_col3 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row30_col4 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row30_col5 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row30_col6 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row30_col7 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row30_col8 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row30_col9 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            : ;\n",
       "        }    #T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row30_col10 {\n",
       "            color:  white;\n",
       "            : ;\n",
       "            : ;\n",
       "        }</style><table id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7\" ><thead>    <tr>        <th class=\"col_heading level0 col0\" >Activity</th>        <th class=\"col_heading level0 col1\" >DWM-1</th>        <th class=\"col_heading level0 col2\" >DWM-2</th>        <th class=\"col_heading level0 col3\" >IUSR</th>        <th class=\"col_heading level0 col4\" >LOCAL SERVICE</th>        <th class=\"col_heading level0 col5\" >MSTICAdmin</th>        <th class=\"col_heading level0 col6\" >MSTICAlertsWin1$</th>        <th class=\"col_heading level0 col7\" >NETWORK SERVICE</th>        <th class=\"col_heading level0 col8\" >No Account</th>        <th class=\"col_heading level0 col9\" >SYSTEM</th>        <th class=\"col_heading level0 col10\" >ian</th>    </tr></thead><tbody>\n",
       "                <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row0_col0\" class=\"data row0 col0\" >1100 - The event logging service has shut down.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row0_col1\" class=\"data row0 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row0_col2\" class=\"data row0 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row0_col3\" class=\"data row0 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row0_col4\" class=\"data row0 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row0_col5\" class=\"data row0 col5\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row0_col6\" class=\"data row0 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row0_col7\" class=\"data row0 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row0_col8\" class=\"data row0 col8\" >1.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row0_col9\" class=\"data row0 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row0_col10\" class=\"data row0 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row1_col0\" class=\"data row1 col0\" >4608 - Windows is starting up.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row1_col1\" class=\"data row1 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row1_col2\" class=\"data row1 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row1_col3\" class=\"data row1 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row1_col4\" class=\"data row1 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row1_col5\" class=\"data row1 col5\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row1_col6\" class=\"data row1 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row1_col7\" class=\"data row1 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row1_col8\" class=\"data row1 col8\" >1.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row1_col9\" class=\"data row1 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row1_col10\" class=\"data row1 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row2_col0\" class=\"data row2 col0\" >4616 - The system time was changed.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row2_col1\" class=\"data row2 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row2_col2\" class=\"data row2 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row2_col3\" class=\"data row2 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row2_col4\" class=\"data row2 col4\" >2.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row2_col5\" class=\"data row2 col5\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row2_col6\" class=\"data row2 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row2_col7\" class=\"data row2 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row2_col8\" class=\"data row2 col8\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row2_col9\" class=\"data row2 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row2_col10\" class=\"data row2 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row3_col0\" class=\"data row3 col0\" >4625 - An account failed to log on.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row3_col1\" class=\"data row3 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row3_col2\" class=\"data row3 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row3_col3\" class=\"data row3 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row3_col4\" class=\"data row3 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row3_col5\" class=\"data row3 col5\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row3_col6\" class=\"data row3 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row3_col7\" class=\"data row3 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row3_col8\" class=\"data row3 col8\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row3_col9\" class=\"data row3 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row3_col10\" class=\"data row3 col10\" >2.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row4_col0\" class=\"data row4 col0\" >4634 - An account was logged off.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row4_col1\" class=\"data row4 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row4_col2\" class=\"data row4 col2\" >4.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row4_col3\" class=\"data row4 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row4_col4\" class=\"data row4 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row4_col5\" class=\"data row4 col5\" >12.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row4_col6\" class=\"data row4 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row4_col7\" class=\"data row4 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row4_col8\" class=\"data row4 col8\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row4_col9\" class=\"data row4 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row4_col10\" class=\"data row4 col10\" >2.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row5_col0\" class=\"data row5 col0\" >4647 - User initiated logoff.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row5_col1\" class=\"data row5 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row5_col2\" class=\"data row5 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row5_col3\" class=\"data row5 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row5_col4\" class=\"data row5 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row5_col5\" class=\"data row5 col5\" >2.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row5_col6\" class=\"data row5 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row5_col7\" class=\"data row5 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row5_col8\" class=\"data row5 col8\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row5_col9\" class=\"data row5 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row5_col10\" class=\"data row5 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row6_col0\" class=\"data row6 col0\" >4648 - A logon was attempted using explicit credentials.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row6_col1\" class=\"data row6 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row6_col2\" class=\"data row6 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row6_col3\" class=\"data row6 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row6_col4\" class=\"data row6 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row6_col5\" class=\"data row6 col5\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row6_col6\" class=\"data row6 col6\" >10.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row6_col7\" class=\"data row6 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row6_col8\" class=\"data row6 col8\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row6_col9\" class=\"data row6 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row6_col10\" class=\"data row6 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row7_col0\" class=\"data row7 col0\" >4672 - Special privileges assigned to new logon.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row7_col1\" class=\"data row7 col1\" >2.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row7_col2\" class=\"data row7 col2\" >2.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row7_col3\" class=\"data row7 col3\" >1.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row7_col4\" class=\"data row7 col4\" >1.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row7_col5\" class=\"data row7 col5\" >14.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row7_col6\" class=\"data row7 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row7_col7\" class=\"data row7 col7\" >1.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row7_col8\" class=\"data row7 col8\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row7_col9\" class=\"data row7 col9\" >60.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row7_col10\" class=\"data row7 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row8_col0\" class=\"data row8 col0\" >4720 - A user account was created.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row8_col1\" class=\"data row8 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row8_col2\" class=\"data row8 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row8_col3\" class=\"data row8 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row8_col4\" class=\"data row8 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row8_col5\" class=\"data row8 col5\" >2.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row8_col6\" class=\"data row8 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row8_col7\" class=\"data row8 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row8_col8\" class=\"data row8 col8\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row8_col9\" class=\"data row8 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row8_col10\" class=\"data row8 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row9_col0\" class=\"data row9 col0\" >4722 - A user account was enabled.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row9_col1\" class=\"data row9 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row9_col2\" class=\"data row9 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row9_col3\" class=\"data row9 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row9_col4\" class=\"data row9 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row9_col5\" class=\"data row9 col5\" >2.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row9_col6\" class=\"data row9 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row9_col7\" class=\"data row9 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row9_col8\" class=\"data row9 col8\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row9_col9\" class=\"data row9 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row9_col10\" class=\"data row9 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row10_col0\" class=\"data row10 col0\" >4724 - An attempt was made to reset an account's password.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row10_col1\" class=\"data row10 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row10_col2\" class=\"data row10 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row10_col3\" class=\"data row10 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row10_col4\" class=\"data row10 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row10_col5\" class=\"data row10 col5\" >4.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row10_col6\" class=\"data row10 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row10_col7\" class=\"data row10 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row10_col8\" class=\"data row10 col8\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row10_col9\" class=\"data row10 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row10_col10\" class=\"data row10 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row11_col0\" class=\"data row11 col0\" >4726 - A user account was deleted.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row11_col1\" class=\"data row11 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row11_col2\" class=\"data row11 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row11_col3\" class=\"data row11 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row11_col4\" class=\"data row11 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row11_col5\" class=\"data row11 col5\" >2.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row11_col6\" class=\"data row11 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row11_col7\" class=\"data row11 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row11_col8\" class=\"data row11 col8\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row11_col9\" class=\"data row11 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row11_col10\" class=\"data row11 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row12_col0\" class=\"data row12 col0\" >4728 - A member was added to a security-enabled global group.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row12_col1\" class=\"data row12 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row12_col2\" class=\"data row12 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row12_col3\" class=\"data row12 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row12_col4\" class=\"data row12 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row12_col5\" class=\"data row12 col5\" >2.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row12_col6\" class=\"data row12 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row12_col7\" class=\"data row12 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row12_col8\" class=\"data row12 col8\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row12_col9\" class=\"data row12 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row12_col10\" class=\"data row12 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row13_col0\" class=\"data row13 col0\" >4729 - A member was removed from a security-enabled global group.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row13_col1\" class=\"data row13 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row13_col2\" class=\"data row13 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row13_col3\" class=\"data row13 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row13_col4\" class=\"data row13 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row13_col5\" class=\"data row13 col5\" >2.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row13_col6\" class=\"data row13 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row13_col7\" class=\"data row13 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row13_col8\" class=\"data row13 col8\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row13_col9\" class=\"data row13 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row13_col10\" class=\"data row13 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row14_col0\" class=\"data row14 col0\" >4732 - A member was added to a security-enabled local group.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row14_col1\" class=\"data row14 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row14_col2\" class=\"data row14 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row14_col3\" class=\"data row14 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row14_col4\" class=\"data row14 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row14_col5\" class=\"data row14 col5\" >4.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row14_col6\" class=\"data row14 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row14_col7\" class=\"data row14 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row14_col8\" class=\"data row14 col8\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row14_col9\" class=\"data row14 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row14_col10\" class=\"data row14 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row15_col0\" class=\"data row15 col0\" >4733 - A member was removed from a security-enabled local group.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row15_col1\" class=\"data row15 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row15_col2\" class=\"data row15 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row15_col3\" class=\"data row15 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row15_col4\" class=\"data row15 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row15_col5\" class=\"data row15 col5\" >3.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row15_col6\" class=\"data row15 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row15_col7\" class=\"data row15 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row15_col8\" class=\"data row15 col8\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row15_col9\" class=\"data row15 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row15_col10\" class=\"data row15 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row16_col0\" class=\"data row16 col0\" >4738 - A user account was changed.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row16_col1\" class=\"data row16 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row16_col2\" class=\"data row16 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row16_col3\" class=\"data row16 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row16_col4\" class=\"data row16 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row16_col5\" class=\"data row16 col5\" >5.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row16_col6\" class=\"data row16 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row16_col7\" class=\"data row16 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row16_col8\" class=\"data row16 col8\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row16_col9\" class=\"data row16 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row16_col10\" class=\"data row16 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row17_col0\" class=\"data row17 col0\" >4776 - The domain controller attempted to validate the credentials for an account.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row17_col1\" class=\"data row17 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row17_col2\" class=\"data row17 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row17_col3\" class=\"data row17 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row17_col4\" class=\"data row17 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row17_col5\" class=\"data row17 col5\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row17_col6\" class=\"data row17 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row17_col7\" class=\"data row17 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row17_col8\" class=\"data row17 col8\" >18.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row17_col9\" class=\"data row17 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row17_col10\" class=\"data row17 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row18_col0\" class=\"data row18 col0\" >4798 - A user's local group membership was enumerated.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row18_col1\" class=\"data row18 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row18_col2\" class=\"data row18 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row18_col3\" class=\"data row18 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row18_col4\" class=\"data row18 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row18_col5\" class=\"data row18 col5\" >14.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row18_col6\" class=\"data row18 col6\" >652.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row18_col7\" class=\"data row18 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row18_col8\" class=\"data row18 col8\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row18_col9\" class=\"data row18 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row18_col10\" class=\"data row18 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row19_col0\" class=\"data row19 col0\" >4799 - A security-enabled local group membership was enumerated</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row19_col1\" class=\"data row19 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row19_col2\" class=\"data row19 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row19_col3\" class=\"data row19 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row19_col4\" class=\"data row19 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row19_col5\" class=\"data row19 col5\" >4.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row19_col6\" class=\"data row19 col6\" >236.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row19_col7\" class=\"data row19 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row19_col8\" class=\"data row19 col8\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row19_col9\" class=\"data row19 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row19_col10\" class=\"data row19 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row20_col0\" class=\"data row20 col0\" >4826 - Boot Configuration Data loaded.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row20_col1\" class=\"data row20 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row20_col2\" class=\"data row20 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row20_col3\" class=\"data row20 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row20_col4\" class=\"data row20 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row20_col5\" class=\"data row20 col5\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row20_col6\" class=\"data row20 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row20_col7\" class=\"data row20 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row20_col8\" class=\"data row20 col8\" >1.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row20_col9\" class=\"data row20 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row20_col10\" class=\"data row20 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row21_col0\" class=\"data row21 col0\" >4902 - The Per-user audit policy table was created.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row21_col1\" class=\"data row21 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row21_col2\" class=\"data row21 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row21_col3\" class=\"data row21 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row21_col4\" class=\"data row21 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row21_col5\" class=\"data row21 col5\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row21_col6\" class=\"data row21 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row21_col7\" class=\"data row21 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row21_col8\" class=\"data row21 col8\" >1.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row21_col9\" class=\"data row21 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row21_col10\" class=\"data row21 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row22_col0\" class=\"data row22 col0\" >4904 - An attempt was made to register a security event source.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row22_col1\" class=\"data row22 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row22_col2\" class=\"data row22 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row22_col3\" class=\"data row22 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row22_col4\" class=\"data row22 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row22_col5\" class=\"data row22 col5\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row22_col6\" class=\"data row22 col6\" >1.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row22_col7\" class=\"data row22 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row22_col8\" class=\"data row22 col8\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row22_col9\" class=\"data row22 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row22_col10\" class=\"data row22 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row23_col0\" class=\"data row23 col0\" >4907 - Auditing settings on object were changed.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row23_col1\" class=\"data row23 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row23_col2\" class=\"data row23 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row23_col3\" class=\"data row23 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row23_col4\" class=\"data row23 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row23_col5\" class=\"data row23 col5\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row23_col6\" class=\"data row23 col6\" >198.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row23_col7\" class=\"data row23 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row23_col8\" class=\"data row23 col8\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row23_col9\" class=\"data row23 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row23_col10\" class=\"data row23 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row24_col0\" class=\"data row24 col0\" >5024 - The Windows Firewall Service has started successfully.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row24_col1\" class=\"data row24 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row24_col2\" class=\"data row24 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row24_col3\" class=\"data row24 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row24_col4\" class=\"data row24 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row24_col5\" class=\"data row24 col5\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row24_col6\" class=\"data row24 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row24_col7\" class=\"data row24 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row24_col8\" class=\"data row24 col8\" >1.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row24_col9\" class=\"data row24 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row24_col10\" class=\"data row24 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row25_col0\" class=\"data row25 col0\" >5033 - The Windows Firewall Driver has started successfully.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row25_col1\" class=\"data row25 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row25_col2\" class=\"data row25 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row25_col3\" class=\"data row25 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row25_col4\" class=\"data row25 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row25_col5\" class=\"data row25 col5\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row25_col6\" class=\"data row25 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row25_col7\" class=\"data row25 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row25_col8\" class=\"data row25 col8\" >1.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row25_col9\" class=\"data row25 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row25_col10\" class=\"data row25 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row26_col0\" class=\"data row26 col0\" >5058 - Key file operation.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row26_col1\" class=\"data row26 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row26_col2\" class=\"data row26 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row26_col3\" class=\"data row26 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row26_col4\" class=\"data row26 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row26_col5\" class=\"data row26 col5\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row26_col6\" class=\"data row26 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row26_col7\" class=\"data row26 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row26_col8\" class=\"data row26 col8\" >159.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row26_col9\" class=\"data row26 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row26_col10\" class=\"data row26 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row27_col0\" class=\"data row27 col0\" >5059 - Key migration operation.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row27_col1\" class=\"data row27 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row27_col2\" class=\"data row27 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row27_col3\" class=\"data row27 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row27_col4\" class=\"data row27 col4\" >1.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row27_col5\" class=\"data row27 col5\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row27_col6\" class=\"data row27 col6\" >206.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row27_col7\" class=\"data row27 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row27_col8\" class=\"data row27 col8\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row27_col9\" class=\"data row27 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row27_col10\" class=\"data row27 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row28_col0\" class=\"data row28 col0\" >5061 - Cryptographic operation.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row28_col1\" class=\"data row28 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row28_col2\" class=\"data row28 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row28_col3\" class=\"data row28 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row28_col4\" class=\"data row28 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row28_col5\" class=\"data row28 col5\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row28_col6\" class=\"data row28 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row28_col7\" class=\"data row28 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row28_col8\" class=\"data row28 col8\" >159.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row28_col9\" class=\"data row28 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row28_col10\" class=\"data row28 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row29_col0\" class=\"data row29 col0\" >8001</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row29_col1\" class=\"data row29 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row29_col2\" class=\"data row29 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row29_col3\" class=\"data row29 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row29_col4\" class=\"data row29 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row29_col5\" class=\"data row29 col5\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row29_col6\" class=\"data row29 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row29_col7\" class=\"data row29 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row29_col8\" class=\"data row29 col8\" >1.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row29_col9\" class=\"data row29 col9\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row29_col10\" class=\"data row29 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row30_col0\" class=\"data row30 col0\" >8002 - A process was allowed to run.</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row30_col1\" class=\"data row30 col1\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row30_col2\" class=\"data row30 col2\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row30_col3\" class=\"data row30 col3\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row30_col4\" class=\"data row30 col4\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row30_col5\" class=\"data row30 col5\" >192.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row30_col6\" class=\"data row30 col6\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row30_col7\" class=\"data row30 col7\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row30_col8\" class=\"data row30 col8\" >0.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row30_col9\" class=\"data row30 col9\" >12.000000</td>\n",
       "                        <td id=\"T_4faa284a_dc3c_11ea_b8ea_0002723f5ca7row30_col10\" class=\"data row30 col10\" >0.000000</td>\n",
       "            </tr>\n",
       "    </tbody></table>"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x223ea3a6828>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<h2>Summary of Account Management Events on host</h2>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "This shows the subset of events related to account management, for example, creation/deletion of accounts, changes to group membership, etc.<br>Yellow highlights indicate account with highest event count."
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<style  type=\"text/css\" >\n",
       "    #T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row0_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row0_col1 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row1_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row1_col1 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row2_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row2_col1 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row3_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row3_col1 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row4_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row4_col1 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row5_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row5_col1 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row6_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row6_col1 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row7_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row7_col1 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }    #T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row8_col0 {\n",
       "            : ;\n",
       "            : ;\n",
       "            width:  400px;\n",
       "            text-align:  left;\n",
       "        }    #T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row8_col1 {\n",
       "            : ;\n",
       "            background-color:  lightblue;\n",
       "            background-color:  yellow;\n",
       "        }</style><table id=\"T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7\" ><thead>    <tr>        <th class=\"col_heading level0 col0\" >Activity</th>        <th class=\"col_heading level0 col1\" >MSTICAdmin</th>    </tr></thead><tbody>\n",
       "                <tr>\n",
       "                                <td id=\"T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row0_col0\" class=\"data row0 col0\" >4720 - A user account was created.</td>\n",
       "                        <td id=\"T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row0_col1\" class=\"data row0 col1\" >2</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row1_col0\" class=\"data row1 col0\" >4722 - A user account was enabled.</td>\n",
       "                        <td id=\"T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row1_col1\" class=\"data row1 col1\" >2</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row2_col0\" class=\"data row2 col0\" >4724 - An attempt was made to reset an account's password.</td>\n",
       "                        <td id=\"T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row2_col1\" class=\"data row2 col1\" >4</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row3_col0\" class=\"data row3 col0\" >4726 - A user account was deleted.</td>\n",
       "                        <td id=\"T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row3_col1\" class=\"data row3 col1\" >2</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row4_col0\" class=\"data row4 col0\" >4728 - A member was added to a security-enabled global group.</td>\n",
       "                        <td id=\"T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row4_col1\" class=\"data row4 col1\" >2</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row5_col0\" class=\"data row5 col0\" >4729 - A member was removed from a security-enabled global group.</td>\n",
       "                        <td id=\"T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row5_col1\" class=\"data row5 col1\" >2</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row6_col0\" class=\"data row6 col0\" >4732 - A member was added to a security-enabled local group.</td>\n",
       "                        <td id=\"T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row6_col1\" class=\"data row6 col1\" >4</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row7_col0\" class=\"data row7 col0\" >4733 - A member was removed from a security-enabled local group.</td>\n",
       "                        <td id=\"T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row7_col1\" class=\"data row7 col1\" >3</td>\n",
       "            </tr>\n",
       "            <tr>\n",
       "                                <td id=\"T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row8_col0\" class=\"data row8 col0\" >4738 - A user account was changed.</td>\n",
       "                        <td id=\"T_4fb80ae6_dc3c_11ea_bbd0_0002723f5ca7row8_col1\" class=\"data row8 col1\" >5</td>\n",
       "            </tr>\n",
       "    </tbody></table>"
      ],
      "text/plain": [
       "<pandas.io.formats.style.Styler at 0x223ea9a4e48>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<h2>Timeline of Account Management Events on host</h2>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "    <div class=\"bk-root\">\n",
       "        <a href=\"https://bokeh.org\" target=\"_blank\" class=\"bk-logo bk-logo-small bk-logo-notebook\"></a>\n",
       "        <span id=\"1521\">Loading BokehJS ...</span>\n",
       "    </div>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "\n",
       "(function(root) {\n",
       "  function now() {\n",
       "    return new Date();\n",
       "  }\n",
       "\n",
       "  var force = true;\n",
       "\n",
       "  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n",
       "    root._bokeh_onload_callbacks = [];\n",
       "    root._bokeh_is_loading = undefined;\n",
       "  }\n",
       "\n",
       "  var JS_MIME_TYPE = 'application/javascript';\n",
       "  var HTML_MIME_TYPE = 'text/html';\n",
       "  var EXEC_MIME_TYPE = 'application/vnd.bokehjs_exec.v0+json';\n",
       "  var CLASS_NAME = 'output_bokeh rendered_html';\n",
       "\n",
       "  /**\n",
       "   * Render data to the DOM node\n",
       "   */\n",
       "  function render(props, node) {\n",
       "    var script = document.createElement(\"script\");\n",
       "    node.appendChild(script);\n",
       "  }\n",
       "\n",
       "  /**\n",
       "   * Handle when an output is cleared or removed\n",
       "   */\n",
       "  function handleClearOutput(event, handle) {\n",
       "    var cell = handle.cell;\n",
       "\n",
       "    var id = cell.output_area._bokeh_element_id;\n",
       "    var server_id = cell.output_area._bokeh_server_id;\n",
       "    // Clean up Bokeh references\n",
       "    if (id != null && id in Bokeh.index) {\n",
       "      Bokeh.index[id].model.document.clear();\n",
       "      delete Bokeh.index[id];\n",
       "    }\n",
       "\n",
       "    if (server_id !== undefined) {\n",
       "      // Clean up Bokeh references\n",
       "      var cmd = \"from bokeh.io.state import curstate; print(curstate().uuid_to_server['\" + server_id + \"'].get_sessions()[0].document.roots[0]._id)\";\n",
       "      cell.notebook.kernel.execute(cmd, {\n",
       "        iopub: {\n",
       "          output: function(msg) {\n",
       "            var id = msg.content.text.trim();\n",
       "            if (id in Bokeh.index) {\n",
       "              Bokeh.index[id].model.document.clear();\n",
       "              delete Bokeh.index[id];\n",
       "            }\n",
       "          }\n",
       "        }\n",
       "      });\n",
       "      // Destroy server and session\n",
       "      var cmd = \"import bokeh.io.notebook as ion; ion.destroy_server('\" + server_id + \"')\";\n",
       "      cell.notebook.kernel.execute(cmd);\n",
       "    }\n",
       "  }\n",
       "\n",
       "  /**\n",
       "   * Handle when a new output is added\n",
       "   */\n",
       "  function handleAddOutput(event, handle) {\n",
       "    var output_area = handle.output_area;\n",
       "    var output = handle.output;\n",
       "\n",
       "    // limit handleAddOutput to display_data with EXEC_MIME_TYPE content only\n",
       "    if ((output.output_type != \"display_data\") || (!output.data.hasOwnProperty(EXEC_MIME_TYPE))) {\n",
       "      return\n",
       "    }\n",
       "\n",
       "    var toinsert = output_area.element.find(\".\" + CLASS_NAME.split(' ')[0]);\n",
       "\n",
       "    if (output.metadata[EXEC_MIME_TYPE][\"id\"] !== undefined) {\n",
       "      toinsert[toinsert.length - 1].firstChild.textContent = output.data[JS_MIME_TYPE];\n",
       "      // store reference to embed id on output_area\n",
       "      output_area._bokeh_element_id = output.metadata[EXEC_MIME_TYPE][\"id\"];\n",
       "    }\n",
       "    if (output.metadata[EXEC_MIME_TYPE][\"server_id\"] !== undefined) {\n",
       "      var bk_div = document.createElement(\"div\");\n",
       "      bk_div.innerHTML = output.data[HTML_MIME_TYPE];\n",
       "      var script_attrs = bk_div.children[0].attributes;\n",
       "      for (var i = 0; i < script_attrs.length; i++) {\n",
       "        toinsert[toinsert.length - 1].firstChild.setAttribute(script_attrs[i].name, script_attrs[i].value);\n",
       "        toinsert[toinsert.length - 1].firstChild.textContent = bk_div.children[0].textContent\n",
       "      }\n",
       "      // store reference to server id on output_area\n",
       "      output_area._bokeh_server_id = output.metadata[EXEC_MIME_TYPE][\"server_id\"];\n",
       "    }\n",
       "  }\n",
       "\n",
       "  function register_renderer(events, OutputArea) {\n",
       "\n",
       "    function append_mime(data, metadata, element) {\n",
       "      // create a DOM node to render to\n",
       "      var toinsert = this.create_output_subarea(\n",
       "        metadata,\n",
       "        CLASS_NAME,\n",
       "        EXEC_MIME_TYPE\n",
       "      );\n",
       "      this.keyboard_manager.register_events(toinsert);\n",
       "      // Render to node\n",
       "      var props = {data: data, metadata: metadata[EXEC_MIME_TYPE]};\n",
       "      render(props, toinsert[toinsert.length - 1]);\n",
       "      element.append(toinsert);\n",
       "      return toinsert\n",
       "    }\n",
       "\n",
       "    /* Handle when an output is cleared or removed */\n",
       "    events.on('clear_output.CodeCell', handleClearOutput);\n",
       "    events.on('delete.Cell', handleClearOutput);\n",
       "\n",
       "    /* Handle when a new output is added */\n",
       "    events.on('output_added.OutputArea', handleAddOutput);\n",
       "\n",
       "    /**\n",
       "     * Register the mime type and append_mime function with output_area\n",
       "     */\n",
       "    OutputArea.prototype.register_mime_type(EXEC_MIME_TYPE, append_mime, {\n",
       "      /* Is output safe? */\n",
       "      safe: true,\n",
       "      /* Index of renderer in `output_area.display_order` */\n",
       "      index: 0\n",
       "    });\n",
       "  }\n",
       "\n",
       "  // register the mime type if in Jupyter Notebook environment and previously unregistered\n",
       "  if (root.Jupyter !== undefined) {\n",
       "    var events = require('base/js/events');\n",
       "    var OutputArea = require('notebook/js/outputarea').OutputArea;\n",
       "\n",
       "    if (OutputArea.prototype.mime_types().indexOf(EXEC_MIME_TYPE) == -1) {\n",
       "      register_renderer(events, OutputArea);\n",
       "    }\n",
       "  }\n",
       "\n",
       "  \n",
       "  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n",
       "    root._bokeh_timeout = Date.now() + 5000;\n",
       "    root._bokeh_failed_load = false;\n",
       "  }\n",
       "\n",
       "  var NB_LOAD_WARNING = {'data': {'text/html':\n",
       "     \"<div style='background-color: #fdd'>\\n\"+\n",
       "     \"<p>\\n\"+\n",
       "     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n",
       "     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n",
       "     \"</p>\\n\"+\n",
       "     \"<ul>\\n\"+\n",
       "     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n",
       "     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n",
       "     \"</ul>\\n\"+\n",
       "     \"<code>\\n\"+\n",
       "     \"from bokeh.resources import INLINE\\n\"+\n",
       "     \"output_notebook(resources=INLINE)\\n\"+\n",
       "     \"</code>\\n\"+\n",
       "     \"</div>\"}};\n",
       "\n",
       "  function display_loaded() {\n",
       "    var el = document.getElementById(\"1521\");\n",
       "    if (el != null) {\n",
       "      el.textContent = \"BokehJS is loading...\";\n",
       "    }\n",
       "    if (root.Bokeh !== undefined) {\n",
       "      if (el != null) {\n",
       "        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n",
       "      }\n",
       "    } else if (Date.now() < root._bokeh_timeout) {\n",
       "      setTimeout(display_loaded, 100)\n",
       "    }\n",
       "  }\n",
       "\n",
       "\n",
       "  function run_callbacks() {\n",
       "    try {\n",
       "      root._bokeh_onload_callbacks.forEach(function(callback) {\n",
       "        if (callback != null)\n",
       "          callback();\n",
       "      });\n",
       "    } finally {\n",
       "      delete root._bokeh_onload_callbacks\n",
       "    }\n",
       "    console.debug(\"Bokeh: all callbacks have finished\");\n",
       "  }\n",
       "\n",
       "  function load_libs(css_urls, js_urls, callback) {\n",
       "    if (css_urls == null) css_urls = [];\n",
       "    if (js_urls == null) js_urls = [];\n",
       "\n",
       "    root._bokeh_onload_callbacks.push(callback);\n",
       "    if (root._bokeh_is_loading > 0) {\n",
       "      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n",
       "      return null;\n",
       "    }\n",
       "    if (js_urls == null || js_urls.length === 0) {\n",
       "      run_callbacks();\n",
       "      return null;\n",
       "    }\n",
       "    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n",
       "    root._bokeh_is_loading = css_urls.length + js_urls.length;\n",
       "\n",
       "    function on_load() {\n",
       "      root._bokeh_is_loading--;\n",
       "      if (root._bokeh_is_loading === 0) {\n",
       "        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n",
       "        run_callbacks()\n",
       "      }\n",
       "    }\n",
       "\n",
       "    function on_error() {\n",
       "      console.error(\"failed to load \" + url);\n",
       "    }\n",
       "\n",
       "    for (var i = 0; i < css_urls.length; i++) {\n",
       "      var url = css_urls[i];\n",
       "      const element = document.createElement(\"link\");\n",
       "      element.onload = on_load;\n",
       "      element.onerror = on_error;\n",
       "      element.rel = \"stylesheet\";\n",
       "      element.type = \"text/css\";\n",
       "      element.href = url;\n",
       "      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n",
       "      document.body.appendChild(element);\n",
       "    }\n",
       "\n",
       "    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.1.1.min.js\": \"kLr4fYcqcSpbuI95brIH3vnnYCquzzSxHPU6XGQCIkQRGJwhg0StNbj1eegrHs12\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.1.1.min.js\": \"xIGPmVtaOm+z0BqfSOMn4lOR6ciex448GIKG4eE61LsAvmGj48XcMQZtKcE/UXZe\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.1.1.min.js\": \"Dc9u1wF/0zApGIWoBbH77iWEHtdmkuYWG839Uzmv8y8yBLXebjO9ZnERsde5Ln/P\", \"https://cdn.bokeh.org/bokeh/release/bokeh-gl-2.1.1.min.js\": \"cT9JaBz7GiRXdENrJLZNSC6eMNF3nh3fa5fTF51Svp+ukxPdwcU5kGXGPBgDCa2j\"};\n",
       "\n",
       "    for (var i = 0; i < js_urls.length; i++) {\n",
       "      var url = js_urls[i];\n",
       "      var element = document.createElement('script');\n",
       "      element.onload = on_load;\n",
       "      element.onerror = on_error;\n",
       "      element.async = false;\n",
       "      element.src = url;\n",
       "      if (url in hashes) {\n",
       "        element.crossOrigin = \"anonymous\";\n",
       "        element.integrity = \"sha384-\" + hashes[url];\n",
       "      }\n",
       "      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n",
       "      document.head.appendChild(element);\n",
       "    }\n",
       "  };\n",
       "\n",
       "  function inject_raw_css(css) {\n",
       "    const element = document.createElement(\"style\");\n",
       "    element.appendChild(document.createTextNode(css));\n",
       "    document.body.appendChild(element);\n",
       "  }\n",
       "\n",
       "  \n",
       "  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.1.1.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.1.1.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.1.1.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-gl-2.1.1.min.js\"];\n",
       "  var css_urls = [];\n",
       "  \n",
       "\n",
       "  var inline_js = [\n",
       "    function(Bokeh) {\n",
       "      Bokeh.set_log_level(\"info\");\n",
       "    },\n",
       "    function(Bokeh) {\n",
       "    \n",
       "    \n",
       "    }\n",
       "  ];\n",
       "\n",
       "  function run_inline_js() {\n",
       "    \n",
       "    if (root.Bokeh !== undefined || force === true) {\n",
       "      \n",
       "    for (var i = 0; i < inline_js.length; i++) {\n",
       "      inline_js[i].call(root, root.Bokeh);\n",
       "    }\n",
       "    if (force === true) {\n",
       "        display_loaded();\n",
       "      }} else if (Date.now() < root._bokeh_timeout) {\n",
       "      setTimeout(run_inline_js, 100);\n",
       "    } else if (!root._bokeh_failed_load) {\n",
       "      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n",
       "      root._bokeh_failed_load = true;\n",
       "    } else if (force !== true) {\n",
       "      var cell = $(document.getElementById(\"1521\")).parents('.cell').data().cell;\n",
       "      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n",
       "    }\n",
       "\n",
       "  }\n",
       "\n",
       "  if (root._bokeh_is_loading === 0) {\n",
       "    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n",
       "    run_inline_js();\n",
       "  } else {\n",
       "    load_libs(css_urls, js_urls, function() {\n",
       "      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n",
       "      run_inline_js();\n",
       "    });\n",
       "  }\n",
       "}(window));"
      ],
      "application/vnd.bokehjs_load.v0+json": "\n(function(root) {\n  function now() {\n    return new Date();\n  }\n\n  var force = true;\n\n  if (typeof root._bokeh_onload_callbacks === \"undefined\" || force === true) {\n    root._bokeh_onload_callbacks = [];\n    root._bokeh_is_loading = undefined;\n  }\n\n  \n\n  \n  if (typeof (root._bokeh_timeout) === \"undefined\" || force === true) {\n    root._bokeh_timeout = Date.now() + 5000;\n    root._bokeh_failed_load = false;\n  }\n\n  var NB_LOAD_WARNING = {'data': {'text/html':\n     \"<div style='background-color: #fdd'>\\n\"+\n     \"<p>\\n\"+\n     \"BokehJS does not appear to have successfully loaded. If loading BokehJS from CDN, this \\n\"+\n     \"may be due to a slow or bad network connection. Possible fixes:\\n\"+\n     \"</p>\\n\"+\n     \"<ul>\\n\"+\n     \"<li>re-rerun `output_notebook()` to attempt to load from CDN again, or</li>\\n\"+\n     \"<li>use INLINE resources instead, as so:</li>\\n\"+\n     \"</ul>\\n\"+\n     \"<code>\\n\"+\n     \"from bokeh.resources import INLINE\\n\"+\n     \"output_notebook(resources=INLINE)\\n\"+\n     \"</code>\\n\"+\n     \"</div>\"}};\n\n  function display_loaded() {\n    var el = document.getElementById(\"1521\");\n    if (el != null) {\n      el.textContent = \"BokehJS is loading...\";\n    }\n    if (root.Bokeh !== undefined) {\n      if (el != null) {\n        el.textContent = \"BokehJS \" + root.Bokeh.version + \" successfully loaded.\";\n      }\n    } else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(display_loaded, 100)\n    }\n  }\n\n\n  function run_callbacks() {\n    try {\n      root._bokeh_onload_callbacks.forEach(function(callback) {\n        if (callback != null)\n          callback();\n      });\n    } finally {\n      delete root._bokeh_onload_callbacks\n    }\n    console.debug(\"Bokeh: all callbacks have finished\");\n  }\n\n  function load_libs(css_urls, js_urls, callback) {\n    if (css_urls == null) css_urls = [];\n    if (js_urls == null) js_urls = [];\n\n    root._bokeh_onload_callbacks.push(callback);\n    if (root._bokeh_is_loading > 0) {\n      console.debug(\"Bokeh: BokehJS is being loaded, scheduling callback at\", now());\n      return null;\n    }\n    if (js_urls == null || js_urls.length === 0) {\n      run_callbacks();\n      return null;\n    }\n    console.debug(\"Bokeh: BokehJS not loaded, scheduling load and callback at\", now());\n    root._bokeh_is_loading = css_urls.length + js_urls.length;\n\n    function on_load() {\n      root._bokeh_is_loading--;\n      if (root._bokeh_is_loading === 0) {\n        console.debug(\"Bokeh: all BokehJS libraries/stylesheets loaded\");\n        run_callbacks()\n      }\n    }\n\n    function on_error() {\n      console.error(\"failed to load \" + url);\n    }\n\n    for (var i = 0; i < css_urls.length; i++) {\n      var url = css_urls[i];\n      const element = document.createElement(\"link\");\n      element.onload = on_load;\n      element.onerror = on_error;\n      element.rel = \"stylesheet\";\n      element.type = \"text/css\";\n      element.href = url;\n      console.debug(\"Bokeh: injecting link tag for BokehJS stylesheet: \", url);\n      document.body.appendChild(element);\n    }\n\n    const hashes = {\"https://cdn.bokeh.org/bokeh/release/bokeh-2.1.1.min.js\": \"kLr4fYcqcSpbuI95brIH3vnnYCquzzSxHPU6XGQCIkQRGJwhg0StNbj1eegrHs12\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.1.1.min.js\": \"xIGPmVtaOm+z0BqfSOMn4lOR6ciex448GIKG4eE61LsAvmGj48XcMQZtKcE/UXZe\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.1.1.min.js\": \"Dc9u1wF/0zApGIWoBbH77iWEHtdmkuYWG839Uzmv8y8yBLXebjO9ZnERsde5Ln/P\", \"https://cdn.bokeh.org/bokeh/release/bokeh-gl-2.1.1.min.js\": \"cT9JaBz7GiRXdENrJLZNSC6eMNF3nh3fa5fTF51Svp+ukxPdwcU5kGXGPBgDCa2j\"};\n\n    for (var i = 0; i < js_urls.length; i++) {\n      var url = js_urls[i];\n      var element = document.createElement('script');\n      element.onload = on_load;\n      element.onerror = on_error;\n      element.async = false;\n      element.src = url;\n      if (url in hashes) {\n        element.crossOrigin = \"anonymous\";\n        element.integrity = \"sha384-\" + hashes[url];\n      }\n      console.debug(\"Bokeh: injecting script tag for BokehJS library: \", url);\n      document.head.appendChild(element);\n    }\n  };\n\n  function inject_raw_css(css) {\n    const element = document.createElement(\"style\");\n    element.appendChild(document.createTextNode(css));\n    document.body.appendChild(element);\n  }\n\n  \n  var js_urls = [\"https://cdn.bokeh.org/bokeh/release/bokeh-2.1.1.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-widgets-2.1.1.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-tables-2.1.1.min.js\", \"https://cdn.bokeh.org/bokeh/release/bokeh-gl-2.1.1.min.js\"];\n  var css_urls = [];\n  \n\n  var inline_js = [\n    function(Bokeh) {\n      Bokeh.set_log_level(\"info\");\n    },\n    function(Bokeh) {\n    \n    \n    }\n  ];\n\n  function run_inline_js() {\n    \n    if (root.Bokeh !== undefined || force === true) {\n      \n    for (var i = 0; i < inline_js.length; i++) {\n      inline_js[i].call(root, root.Bokeh);\n    }\n    if (force === true) {\n        display_loaded();\n      }} else if (Date.now() < root._bokeh_timeout) {\n      setTimeout(run_inline_js, 100);\n    } else if (!root._bokeh_failed_load) {\n      console.log(\"Bokeh: BokehJS failed to load within specified timeout.\");\n      root._bokeh_failed_load = true;\n    } else if (force !== true) {\n      var cell = $(document.getElementById(\"1521\")).parents('.cell').data().cell;\n      cell.output_area.append_execute_result(NB_LOAD_WARNING)\n    }\n\n  }\n\n  if (root._bokeh_is_loading === 0) {\n    console.debug(\"Bokeh: BokehJS loaded, going straight to plotting\");\n    run_inline_js();\n  } else {\n    load_libs(css_urls, js_urls, function() {\n      console.debug(\"Bokeh: BokehJS plotting callback run at\", now());\n      run_inline_js();\n    });\n  }\n}(window));"
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "\n",
       "  <div class=\"bk-root\" id=\"5d3e7f08-b42e-4a73-b6a6-28cc61c0415c\" data-root-id=\"1690\"></div>\n"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "application/javascript": [
       "(function(root) {\n",
       "  function embed_document(root) {\n",
       "    \n",
       "  var docs_json = {\"6564e921-882d-4a4b-9e46-f3d336697def\":{\"roots\":{\"references\":[{\"attributes\":{\"children\":[{\"id\":\"1532\"},{\"id\":\"1564\"}]},\"id\":\"1690\",\"type\":\"Column\"},{\"attributes\":{\"formatter\":{\"id\":\"1581\"},\"ticker\":{\"id\":\"1576\"}},\"id\":\"1575\",\"type\":\"DatetimeAxis\"},{\"attributes\":{\"num_minor_ticks\":5,\"tickers\":[{\"id\":\"1728\"},{\"id\":\"1729\"},{\"id\":\"1730\"},{\"id\":\"1731\"},{\"id\":\"1732\"},{\"id\":\"1733\"},{\"id\":\"1734\"},{\"id\":\"1735\"},{\"id\":\"1736\"},{\"id\":\"1737\"},{\"id\":\"1738\"},{\"id\":\"1739\"}]},\"id\":\"1576\",\"type\":\"DatetimeTicker\"},{\"attributes\":{\"base\":60,\"mantissas\":[1,2,5,10,15,20,30],\"max_interval\":1800000.0,\"min_interval\":1000.0,\"num_minor_ticks\":0},\"id\":\"1716\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"axis\":{\"id\":\"1575\"},\"ticker\":null},\"id\":\"1578\",\"type\":\"Grid\"},{\"attributes\":{\"base\":24,\"mantissas\":[1,2,4,6,8,12],\"max_interval\":43200000.0,\"min_interval\":3600000.0,\"num_minor_ticks\":0},\"id\":\"1717\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"days\":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31]},\"id\":\"1718\",\"type\":\"DaysTicker\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#440154\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#440154\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1636\",\"type\":\"Diamond\"},{\"attributes\":{\"active_drag\":\"auto\",\"active_inspect\":\"auto\",\"active_multi\":{\"id\":\"1628\"},\"active_scroll\":\"auto\",\"active_tap\":\"auto\",\"tools\":[{\"id\":\"1628\"}]},\"id\":\"1579\",\"type\":\"Toolbar\"},{\"attributes\":{\"days\":[1,4,7,10,13,16,19,22,25,28]},\"id\":\"1719\",\"type\":\"DaysTicker\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#440154\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#440154\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1637\",\"type\":\"Diamond\"},{\"attributes\":{\"days\":[1,8,15,22]},\"id\":\"1720\",\"type\":\"DaysTicker\"},{\"attributes\":{\"data_source\":{\"id\":\"1522\"},\"glyph\":{\"id\":\"1636\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"1637\"},\"selection_glyph\":null,\"view\":{\"id\":\"1639\"}},\"id\":\"1638\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"days\":[1,15]},\"id\":\"1721\",\"type\":\"DaysTicker\"},{\"attributes\":{\"months\":[0,1,2,3,4,5,6,7,8,9,10,11]},\"id\":\"1722\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"months\":[0,2,4,6,8,10]},\"id\":\"1723\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"months\":[0,4,8]},\"id\":\"1724\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"days\":[\"%m-%d %H:%M\"],\"hours\":[\"%H:%M:%S\"],\"milliseconds\":[\"%H:%M:%S.%3N\"],\"minutes\":[\"%H:%M:%S\"],\"seconds\":[\"%H:%M:%S\"]},\"id\":\"1581\",\"type\":\"DatetimeTickFormatter\"},{\"attributes\":{\"months\":[0,6]},\"id\":\"1725\",\"type\":\"MonthsTicker\"},{\"attributes\":{},\"id\":\"1703\",\"type\":\"Selection\"},{\"attributes\":{},\"id\":\"1726\",\"type\":\"YearsTicker\"},{\"attributes\":{\"fill_color\":{\"value\":\"#440154\"},\"line_color\":{\"value\":\"#440154\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1584\",\"type\":\"Circle\"},{\"attributes\":{\"mantissas\":[1,2,5],\"max_interval\":500.0,\"num_minor_ticks\":0},\"id\":\"1728\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#440154\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#440154\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1585\",\"type\":\"Circle\"},{\"attributes\":{\"data_source\":{\"id\":\"1522\"},\"glyph\":{\"id\":\"1584\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"1585\"},\"selection_glyph\":null,\"view\":{\"id\":\"1587\"}},\"id\":\"1586\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"end\":1550252881564.5,\"start\":1549830379991.5},\"id\":\"1567\",\"type\":\"Range1d\"},{\"attributes\":{\"data\":{\"Account\":[\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\"],\"Activity\":[\"4738 - A user account was changed.\",\"4738 - A user account was changed.\",\"4738 - A user account was changed.\",\"4738 - A user account was changed.\",\"4738 - A user account was changed.\"],\"TimeGenerated\":{\"__ndarray__\":\"AHCE67+NdkIAsIrrv412QgDwlOu/jXZCAOCY67+NdkIA0Jvrv412Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[5]},\"index\":[50,54,61,65,68],\"y_index\":[8,8,8,8,8]},\"selected\":{\"id\":\"1713\"},\"selection_policy\":{\"id\":\"1714\"}},\"id\":\"1530\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"base\":60,\"mantissas\":[1,2,5,10,15,20,30],\"max_interval\":1800000.0,\"min_interval\":1000.0,\"num_minor_ticks\":0},\"id\":\"1729\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{},\"id\":\"1569\",\"type\":\"DataRange1d\"},{\"attributes\":{\"source\":{\"id\":\"1522\"}},\"id\":\"1587\",\"type\":\"CDSView\"},{\"attributes\":{\"base\":24,\"mantissas\":[1,2,4,6,8,12],\"max_interval\":43200000.0,\"min_interval\":3600000.0,\"num_minor_ticks\":0},\"id\":\"1730\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"days\":[\"%m-%d %H:%M\"],\"hours\":[\"%H:%M:%S\"],\"milliseconds\":[\"%H:%M:%S.%3N\"],\"minutes\":[\"%H:%M:%S\"],\"seconds\":[\"%H:%M:%S\"]},\"id\":\"1633\",\"type\":\"DatetimeTickFormatter\"},{\"attributes\":{\"days\":[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31]},\"id\":\"1731\",\"type\":\"DaysTicker\"},{\"attributes\":{\"days\":[1,4,7,10,13,16,19,22,25,28]},\"id\":\"1732\",\"type\":\"DaysTicker\"},{\"attributes\":{\"fill_color\":{\"value\":\"#472777\"},\"line_color\":{\"value\":\"#472777\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1589\",\"type\":\"Circle\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#472777\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#472777\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1590\",\"type\":\"Circle\"},{\"attributes\":{\"days\":[1,8,15,22]},\"id\":\"1733\",\"type\":\"DaysTicker\"},{\"attributes\":{\"data_source\":{\"id\":\"1523\"},\"glyph\":{\"id\":\"1589\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"1590\"},\"selection_glyph\":null,\"view\":{\"id\":\"1592\"}},\"id\":\"1591\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#472777\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#472777\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1641\",\"type\":\"Diamond\"},{\"attributes\":{\"days\":[1,15]},\"id\":\"1734\",\"type\":\"DaysTicker\"},{\"attributes\":{\"source\":{\"id\":\"1523\"}},\"id\":\"1592\",\"type\":\"CDSView\"},{\"attributes\":{\"months\":[0,1,2,3,4,5,6,7,8,9,10,11]},\"id\":\"1735\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"fill_alpha\":0.2,\"fill_color\":\"navy\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[2,2],\"line_width\":0.5},\"id\":\"1629\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"months\":[0,2,4,6,8,10]},\"id\":\"1736\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"months\":[0,4,8]},\"id\":\"1737\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"num_minor_ticks\":10,\"tickers\":[{\"id\":\"1715\"},{\"id\":\"1716\"},{\"id\":\"1717\"},{\"id\":\"1718\"},{\"id\":\"1719\"},{\"id\":\"1720\"},{\"id\":\"1721\"},{\"id\":\"1722\"},{\"id\":\"1723\"},{\"id\":\"1724\"},{\"id\":\"1725\"},{\"id\":\"1726\"}]},\"id\":\"1544\",\"type\":\"DatetimeTicker\"},{\"attributes\":{\"fill_color\":{\"value\":\"#3E4989\"},\"line_color\":{\"value\":\"#3E4989\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1594\",\"type\":\"Circle\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#3E4989\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#3E4989\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1595\",\"type\":\"Circle\"},{\"attributes\":{\"months\":[0,6]},\"id\":\"1738\",\"type\":\"MonthsTicker\"},{\"attributes\":{\"data_source\":{\"id\":\"1524\"},\"glyph\":{\"id\":\"1594\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"1595\"},\"selection_glyph\":null,\"view\":{\"id\":\"1597\"}},\"id\":\"1596\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"1739\",\"type\":\"YearsTicker\"},{\"attributes\":{},\"id\":\"1539\",\"type\":\"LinearScale\"},{\"attributes\":{\"source\":{\"id\":\"1524\"}},\"id\":\"1597\",\"type\":\"CDSView\"},{\"attributes\":{\"axis_label\":\"Event Time\",\"formatter\":{\"id\":\"1633\"},\"ticker\":{\"id\":\"1544\"}},\"id\":\"1543\",\"type\":\"DatetimeAxis\"},{\"attributes\":{\"data\":{\"Account\":[\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\"],\"Activity\":[\"4733 - A member was removed from a security-\\nenabled local group.\",\"4733 - A member was removed from a security-\\nenabled local group.\",\"4733 - A member was removed from a security-\\nenabled local group.\"],\"TimeGenerated\":{\"__ndarray__\":\"ACAJBMCNdkIAQAwEwI12QgAgDgTAjXZC\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[3]},\"index\":[116,118,122],\"y_index\":[7,7,7]},\"selected\":{\"id\":\"1711\"},\"selection_policy\":{\"id\":\"1712\"}},\"id\":\"1529\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"overlay\":{\"id\":\"1629\"},\"x_range\":{\"id\":\"1535\"},\"y_range\":null},\"id\":\"1628\",\"type\":\"RangeTool\"},{\"attributes\":{\"axis\":{\"id\":\"1543\"},\"minor_grid_line_alpha\":0.3,\"minor_grid_line_color\":\"navy\",\"ticker\":null},\"id\":\"1546\",\"type\":\"Grid\"},{\"attributes\":{},\"id\":\"1541\",\"type\":\"LinearScale\"},{\"attributes\":{\"end\":8.11111111111111,\"start\":-0.1111111111111111},\"id\":\"1537\",\"type\":\"Range1d\"},{\"attributes\":{\"fill_color\":{\"value\":\"#30678D\"},\"line_color\":{\"value\":\"#30678D\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1599\",\"type\":\"Circle\"},{\"attributes\":{\"callback\":null,\"formatters\":{\"@TimeGenerated\":\"datetime\"},\"tooltips\":[[\"Account\",\"@Account\"],[\"Activity\",\"@Activity\"],[\"TimeGenerated\",\"@TimeGenerated{%F %T.%3N}\"]]},\"id\":\"1531\",\"type\":\"HoverTool\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#30678D\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#30678D\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1600\",\"type\":\"Circle\"},{\"attributes\":{\"data_source\":{\"id\":\"1525\"},\"glyph\":{\"id\":\"1599\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"1600\"},\"selection_glyph\":null,\"view\":{\"id\":\"1602\"}},\"id\":\"1601\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"mantissas\":[1,2,5],\"max_interval\":500.0,\"num_minor_ticks\":0},\"id\":\"1715\",\"type\":\"AdaptiveTicker\"},{\"attributes\":{\"below\":[{\"id\":\"1543\"}],\"center\":[{\"id\":\"1546\"},{\"id\":\"1550\"}],\"left\":[{\"id\":\"1547\"}],\"min_border_left\":50,\"plot_height\":360,\"plot_width\":900,\"renderers\":[{\"id\":\"1638\"},{\"id\":\"1643\"},{\"id\":\"1648\"},{\"id\":\"1653\"},{\"id\":\"1658\"},{\"id\":\"1663\"},{\"id\":\"1668\"},{\"id\":\"1673\"},{\"id\":\"1678\"}],\"right\":[{\"id\":\"1680\"}],\"title\":{\"id\":\"1533\"},\"toolbar\":{\"id\":\"1557\"},\"x_range\":{\"id\":\"1535\"},\"x_scale\":{\"id\":\"1539\"},\"y_range\":{\"id\":\"1537\"},\"y_scale\":{\"id\":\"1541\"}},\"id\":\"1532\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"source\":{\"id\":\"1525\"}},\"id\":\"1602\",\"type\":\"CDSView\"},{\"attributes\":{\"source\":{\"id\":\"1530\"}},\"id\":\"1627\",\"type\":\"CDSView\"},{\"attributes\":{\"text\":\"Event Timeline\"},\"id\":\"1533\",\"type\":\"Title\"},{\"attributes\":{\"fill_color\":{\"value\":\"#25828E\"},\"line_color\":{\"value\":\"#25828E\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1604\",\"type\":\"Circle\"},{\"attributes\":{\"bottom_units\":\"screen\",\"fill_alpha\":0.5,\"fill_color\":\"lightgrey\",\"left_units\":\"screen\",\"level\":\"overlay\",\"line_alpha\":1.0,\"line_color\":\"black\",\"line_dash\":[4,4],\"line_width\":2,\"right_units\":\"screen\",\"top_units\":\"screen\"},\"id\":\"1556\",\"type\":\"BoxAnnotation\"},{\"attributes\":{\"end\":1550236631504.0,\"start\":1549846630052.0},\"id\":\"1535\",\"type\":\"Range1d\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#25828E\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#25828E\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1605\",\"type\":\"Circle\"},{\"attributes\":{\"data_source\":{\"id\":\"1526\"},\"glyph\":{\"id\":\"1604\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"1605\"},\"selection_glyph\":null,\"view\":{\"id\":\"1607\"}},\"id\":\"1606\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#472777\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#472777\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1642\",\"type\":\"Diamond\"},{\"attributes\":{},\"id\":\"1571\",\"type\":\"LinearScale\"},{\"attributes\":{\"data\":{\"Account\":[\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\"],\"Activity\":[\"4732 - A member was added to a security-enabled\\nlocal group.\",\"4732 - A member was added to a security-enabled\\nlocal group.\",\"4732 - A member was added to a security-enabled\\nlocal group.\",\"4732 - A member was added to a security-enabled\\nlocal group.\"],\"TimeGenerated\":{\"__ndarray__\":\"AGCH67+NdkIAsI/rv412QgAwluu/jXZCAHCD3fWOdkI=\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[4]},\"index\":[52,57,63,910],\"y_index\":[6,6,6,6]},\"selected\":{\"id\":\"1709\"},\"selection_policy\":{\"id\":\"1710\"}},\"id\":\"1528\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"source\":{\"id\":\"1526\"}},\"id\":\"1607\",\"type\":\"CDSView\"},{\"attributes\":{},\"id\":\"1573\",\"type\":\"LinearScale\"},{\"attributes\":{\"data_source\":{\"id\":\"1530\"},\"glyph\":{\"id\":\"1624\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"1625\"},\"selection_glyph\":null,\"view\":{\"id\":\"1627\"}},\"id\":\"1626\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"source\":{\"id\":\"1528\"}},\"id\":\"1669\",\"type\":\"CDSView\"},{\"attributes\":{\"fill_color\":{\"value\":\"#1E9C89\"},\"line_color\":{\"value\":\"#1E9C89\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1609\",\"type\":\"Circle\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#1E9C89\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#1E9C89\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1610\",\"type\":\"Circle\"},{\"attributes\":{},\"id\":\"1702\",\"type\":\"UnionRenderers\"},{\"attributes\":{},\"id\":\"1705\",\"type\":\"Selection\"},{\"attributes\":{\"data_source\":{\"id\":\"1527\"},\"glyph\":{\"id\":\"1609\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"1610\"},\"selection_glyph\":null,\"view\":{\"id\":\"1612\"}},\"id\":\"1611\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"text\":\"Range Selector\"},\"id\":\"1565\",\"type\":\"Title\"},{\"attributes\":{\"formatter\":{\"id\":\"1694\"},\"ticker\":{\"id\":\"1548\"},\"visible\":false},\"id\":\"1547\",\"type\":\"LinearAxis\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#35B778\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#35B778\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1667\",\"type\":\"Diamond\"},{\"attributes\":{},\"id\":\"1553\",\"type\":\"ResetTool\"},{\"attributes\":{\"data_source\":{\"id\":\"1528\"},\"glyph\":{\"id\":\"1666\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"1667\"},\"selection_glyph\":null,\"view\":{\"id\":\"1669\"}},\"id\":\"1668\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"source\":{\"id\":\"1527\"}},\"id\":\"1612\",\"type\":\"CDSView\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#35B778\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#35B778\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1666\",\"type\":\"Diamond\"},{\"attributes\":{\"source\":{\"id\":\"1524\"}},\"id\":\"1649\",\"type\":\"CDSView\"},{\"attributes\":{\"dimensions\":\"width\"},\"id\":\"1555\",\"type\":\"PanTool\"},{\"attributes\":{\"active_drag\":\"auto\",\"active_inspect\":\"auto\",\"active_multi\":null,\"active_scroll\":\"auto\",\"active_tap\":\"auto\",\"tools\":[{\"id\":\"1531\"},{\"id\":\"1551\"},{\"id\":\"1552\"},{\"id\":\"1553\"},{\"id\":\"1554\"},{\"id\":\"1555\"}]},\"id\":\"1557\",\"type\":\"Toolbar\"},{\"attributes\":{\"source\":{\"id\":\"1529\"}},\"id\":\"1674\",\"type\":\"CDSView\"},{\"attributes\":{\"fill_color\":{\"value\":\"#35B778\"},\"line_color\":{\"value\":\"#35B778\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1614\",\"type\":\"Circle\"},{\"attributes\":{\"data_source\":{\"id\":\"1523\"},\"glyph\":{\"id\":\"1641\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"1642\"},\"selection_glyph\":null,\"view\":{\"id\":\"1644\"}},\"id\":\"1643\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#35B778\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#35B778\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1615\",\"type\":\"Circle\"},{\"attributes\":{},\"id\":\"1704\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"data_source\":{\"id\":\"1528\"},\"glyph\":{\"id\":\"1614\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"1615\"},\"selection_glyph\":null,\"view\":{\"id\":\"1617\"}},\"id\":\"1616\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#6BCD59\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#6BCD59\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1672\",\"type\":\"Diamond\"},{\"attributes\":{\"data_source\":{\"id\":\"1529\"},\"glyph\":{\"id\":\"1671\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"1672\"},\"selection_glyph\":null,\"view\":{\"id\":\"1674\"}},\"id\":\"1673\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"data\":{\"Account\":[\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\"],\"Activity\":[\"4722 - A user account was enabled.\",\"4722 - A user account was enabled.\"],\"TimeGenerated\":{\"__ndarray__\":\"AHCE67+NdkIA8JTrv412Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[2]},\"index\":[49,60],\"y_index\":[1,1]},\"selected\":{\"id\":\"1699\"},\"selection_policy\":{\"id\":\"1700\"}},\"id\":\"1523\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"source\":{\"id\":\"1528\"}},\"id\":\"1617\",\"type\":\"CDSView\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#6BCD59\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#6BCD59\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1671\",\"type\":\"Diamond\"},{\"attributes\":{\"source\":{\"id\":\"1530\"}},\"id\":\"1679\",\"type\":\"CDSView\"},{\"attributes\":{\"fill_color\":{\"value\":\"#6BCD59\"},\"line_color\":{\"value\":\"#6BCD59\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1619\",\"type\":\"Circle\"},{\"attributes\":{\"click_policy\":\"hide\",\"items\":[{\"id\":\"1681\"},{\"id\":\"1682\"},{\"id\":\"1683\"},{\"id\":\"1684\"},{\"id\":\"1685\"},{\"id\":\"1686\"},{\"id\":\"1687\"},{\"id\":\"1688\"},{\"id\":\"1689\"}],\"label_text_font_size\":\"8pt\",\"location\":\"center\"},\"id\":\"1680\",\"type\":\"Legend\"},{\"attributes\":{\"source\":{\"id\":\"1522\"}},\"id\":\"1639\",\"type\":\"CDSView\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#6BCD59\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#6BCD59\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1620\",\"type\":\"Circle\"},{\"attributes\":{\"data_source\":{\"id\":\"1529\"},\"glyph\":{\"id\":\"1619\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"1620\"},\"selection_glyph\":null,\"view\":{\"id\":\"1622\"}},\"id\":\"1621\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"data\":{\"Account\":[\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\"],\"Activity\":[\"4724 - An attempt was made to reset an account's\\npassword.\",\"4724 - An attempt was made to reset an account's\\npassword.\",\"4724 - An attempt was made to reset an account's\\npassword.\",\"4724 - An attempt was made to reset an account's\\npassword.\"],\"TimeGenerated\":{\"__ndarray__\":\"AHCE67+NdkIAsIrrv412QgDwlOu/jXZCAOCY67+NdkI=\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[4]},\"index\":[51,55,62,66],\"y_index\":[2,2,2,2]},\"selected\":{\"id\":\"1701\"},\"selection_policy\":{\"id\":\"1702\"}},\"id\":\"1524\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#B2DD2C\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#B2DD2C\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1677\",\"type\":\"Diamond\"},{\"attributes\":{\"data_source\":{\"id\":\"1530\"},\"glyph\":{\"id\":\"1676\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"1677\"},\"selection_glyph\":null,\"view\":{\"id\":\"1679\"}},\"id\":\"1678\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"source\":{\"id\":\"1529\"}},\"id\":\"1622\",\"type\":\"CDSView\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#B2DD2C\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#B2DD2C\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1676\",\"type\":\"Diamond\"},{\"attributes\":{\"overlay\":{\"id\":\"1556\"}},\"id\":\"1552\",\"type\":\"BoxZoomTool\"},{\"attributes\":{},\"id\":\"1701\",\"type\":\"Selection\"},{\"attributes\":{\"below\":[{\"id\":\"1575\"},{\"id\":\"1580\"}],\"center\":[{\"id\":\"1578\"}],\"plot_height\":120,\"plot_width\":900,\"renderers\":[{\"id\":\"1586\"},{\"id\":\"1591\"},{\"id\":\"1596\"},{\"id\":\"1601\"},{\"id\":\"1606\"},{\"id\":\"1611\"},{\"id\":\"1616\"},{\"id\":\"1621\"},{\"id\":\"1626\"}],\"title\":{\"id\":\"1565\"},\"toolbar\":{\"id\":\"1579\"},\"toolbar_location\":null,\"x_range\":{\"id\":\"1567\"},\"x_scale\":{\"id\":\"1571\"},\"y_range\":{\"id\":\"1569\"},\"y_scale\":{\"id\":\"1573\"}},\"id\":\"1564\",\"subtype\":\"Figure\",\"type\":\"Plot\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#3E4989\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#3E4989\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1647\",\"type\":\"Diamond\"},{\"attributes\":{\"data\":{\"Account\":[\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\"],\"Activity\":[\"4728 - A member was added to a security-enabled\\nglobal group.\",\"4728 - A member was added to a security-enabled\\nglobal group.\"],\"TimeGenerated\":{\"__ndarray__\":\"ANCD67+NdkIA8JTrv412Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[2]},\"index\":[47,58],\"y_index\":[4,4]},\"selected\":{\"id\":\"1705\"},\"selection_policy\":{\"id\":\"1706\"}},\"id\":\"1526\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"dimensions\":\"width\"},\"id\":\"1551\",\"type\":\"WheelZoomTool\"},{\"attributes\":{\"fill_color\":{\"value\":\"#B2DD2C\"},\"line_color\":{\"value\":\"#B2DD2C\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1624\",\"type\":\"Circle\"},{\"attributes\":{\"label\":{\"value\":\"4720\"},\"renderers\":[{\"id\":\"1638\"}]},\"id\":\"1681\",\"type\":\"LegendItem\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#B2DD2C\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#B2DD2C\"},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1625\",\"type\":\"Circle\"},{\"attributes\":{\"source\":{\"id\":\"1523\"}},\"id\":\"1644\",\"type\":\"CDSView\"},{\"attributes\":{\"align\":\"right\",\"text\":\"Drag the middle or edges of the selection box to change the range in the main chart\",\"text_font_size\":{\"value\":\"10px\"}},\"id\":\"1580\",\"type\":\"Title\"},{\"attributes\":{\"label\":{\"value\":\"4722\"},\"renderers\":[{\"id\":\"1643\"}]},\"id\":\"1682\",\"type\":\"LegendItem\"},{\"attributes\":{},\"id\":\"1700\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"data\":{\"Account\":[\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\"],\"Activity\":[\"4726 - A user account was deleted.\",\"4726 - A user account was deleted.\"],\"TimeGenerated\":{\"__ndarray__\":\"AEAMBMCNdkIAIA4EwI12Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[2]},\"index\":[120,124],\"y_index\":[3,3]},\"selected\":{\"id\":\"1703\"},\"selection_policy\":{\"id\":\"1704\"}},\"id\":\"1525\",\"type\":\"ColumnDataSource\"},{\"attributes\":{\"label\":{\"value\":\"4724\"},\"renderers\":[{\"id\":\"1648\"}]},\"id\":\"1683\",\"type\":\"LegendItem\"},{\"attributes\":{\"data_source\":{\"id\":\"1524\"},\"glyph\":{\"id\":\"1646\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"1647\"},\"selection_glyph\":null,\"view\":{\"id\":\"1649\"}},\"id\":\"1648\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"label\":{\"value\":\"4726\"},\"renderers\":[{\"id\":\"1653\"}]},\"id\":\"1684\",\"type\":\"LegendItem\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#3E4989\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#3E4989\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1646\",\"type\":\"Diamond\"},{\"attributes\":{\"label\":{\"value\":\"4728\"},\"renderers\":[{\"id\":\"1658\"}]},\"id\":\"1685\",\"type\":\"LegendItem\"},{\"attributes\":{},\"id\":\"1554\",\"type\":\"SaveTool\"},{\"attributes\":{\"label\":{\"value\":\"4729\"},\"renderers\":[{\"id\":\"1663\"}]},\"id\":\"1686\",\"type\":\"LegendItem\"},{\"attributes\":{\"source\":{\"id\":\"1525\"}},\"id\":\"1654\",\"type\":\"CDSView\"},{\"attributes\":{\"label\":{\"value\":\"4732\"},\"renderers\":[{\"id\":\"1668\"}]},\"id\":\"1687\",\"type\":\"LegendItem\"},{\"attributes\":{},\"id\":\"1699\",\"type\":\"Selection\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#30678D\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#30678D\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1652\",\"type\":\"Diamond\"},{\"attributes\":{\"label\":{\"value\":\"4733\"},\"renderers\":[{\"id\":\"1673\"}]},\"id\":\"1688\",\"type\":\"LegendItem\"},{\"attributes\":{\"data_source\":{\"id\":\"1525\"},\"glyph\":{\"id\":\"1651\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"1652\"},\"selection_glyph\":null,\"view\":{\"id\":\"1654\"}},\"id\":\"1653\",\"type\":\"GlyphRenderer\"},{\"attributes\":{\"label\":{\"value\":\"4738\"},\"renderers\":[{\"id\":\"1678\"}]},\"id\":\"1689\",\"type\":\"LegendItem\"},{\"attributes\":{\"axis\":{\"id\":\"1547\"},\"dimension\":1,\"grid_line_color\":null,\"ticker\":null},\"id\":\"1550\",\"type\":\"Grid\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#30678D\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#30678D\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1651\",\"type\":\"Diamond\"},{\"attributes\":{},\"id\":\"1694\",\"type\":\"BasicTickFormatter\"},{\"attributes\":{\"data\":{\"Account\":[\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\"],\"Activity\":[\"4729 - A member was removed from a security-\\nenabled global group.\",\"4729 - A member was removed from a security-\\nenabled global group.\"],\"TimeGenerated\":{\"__ndarray__\":\"AEAMBMCNdkIAIA4EwI12Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[2]},\"index\":[119,123],\"y_index\":[5,5]},\"selected\":{\"id\":\"1707\"},\"selection_policy\":{\"id\":\"1708\"}},\"id\":\"1527\",\"type\":\"ColumnDataSource\"},{\"attributes\":{},\"id\":\"1706\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"source\":{\"id\":\"1526\"}},\"id\":\"1659\",\"type\":\"CDSView\"},{\"attributes\":{},\"id\":\"1707\",\"type\":\"Selection\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#25828E\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#25828E\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1657\",\"type\":\"Diamond\"},{\"attributes\":{},\"id\":\"1708\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"data_source\":{\"id\":\"1526\"},\"glyph\":{\"id\":\"1656\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"1657\"},\"selection_glyph\":null,\"view\":{\"id\":\"1659\"}},\"id\":\"1658\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"1709\",\"type\":\"Selection\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#25828E\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#25828E\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1656\",\"type\":\"Diamond\"},{\"attributes\":{},\"id\":\"1698\",\"type\":\"UnionRenderers\"},{\"attributes\":{},\"id\":\"1710\",\"type\":\"UnionRenderers\"},{\"attributes\":{},\"id\":\"1711\",\"type\":\"Selection\"},{\"attributes\":{\"source\":{\"id\":\"1527\"}},\"id\":\"1664\",\"type\":\"CDSView\"},{\"attributes\":{},\"id\":\"1548\",\"type\":\"BasicTicker\"},{\"attributes\":{},\"id\":\"1697\",\"type\":\"Selection\"},{\"attributes\":{},\"id\":\"1712\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.1},\"fill_color\":{\"value\":\"#1E9C89\"},\"line_alpha\":{\"value\":0.1},\"line_color\":{\"value\":\"#1E9C89\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1662\",\"type\":\"Diamond\"},{\"attributes\":{},\"id\":\"1713\",\"type\":\"Selection\"},{\"attributes\":{\"data_source\":{\"id\":\"1527\"},\"glyph\":{\"id\":\"1661\"},\"hover_glyph\":null,\"muted_glyph\":null,\"nonselection_glyph\":{\"id\":\"1662\"},\"selection_glyph\":null,\"view\":{\"id\":\"1664\"}},\"id\":\"1663\",\"type\":\"GlyphRenderer\"},{\"attributes\":{},\"id\":\"1714\",\"type\":\"UnionRenderers\"},{\"attributes\":{\"fill_alpha\":{\"value\":0.5},\"fill_color\":{\"value\":\"#1E9C89\"},\"line_alpha\":{\"value\":0.5},\"line_color\":{\"value\":\"#1E9C89\"},\"size\":{\"units\":\"screen\",\"value\":10},\"x\":{\"field\":\"TimeGenerated\"},\"y\":{\"field\":\"y_index\"}},\"id\":\"1661\",\"type\":\"Diamond\"},{\"attributes\":{\"data\":{\"Account\":[\"MSTICAlertsWin1\\\\MSTICAdmin\",\"MSTICAlertsWin1\\\\MSTICAdmin\"],\"Activity\":[\"4720 - A user account was created.\",\"4720 - A user account was created.\"],\"TimeGenerated\":{\"__ndarray__\":\"ANCD67+NdkIA8JTrv412Qg==\",\"dtype\":\"float64\",\"order\":\"little\",\"shape\":[2]},\"index\":[48,59],\"y_index\":[0,0]},\"selected\":{\"id\":\"1697\"},\"selection_policy\":{\"id\":\"1698\"}},\"id\":\"1522\",\"type\":\"ColumnDataSource\"}],\"root_ids\":[\"1690\"]},\"title\":\"Bokeh Application\",\"version\":\"2.1.1\"}};\n",
       "  var render_items = [{\"docid\":\"6564e921-882d-4a4b-9e46-f3d336697def\",\"root_ids\":[\"1690\"],\"roots\":{\"1690\":\"5d3e7f08-b42e-4a73-b6a6-28cc61c0415c\"}}];\n",
       "  root.Bokeh.embed.embed_items_notebook(docs_json, render_items);\n",
       "\n",
       "  }\n",
       "  if (root.Bokeh !== undefined) {\n",
       "    embed_document(root);\n",
       "  } else {\n",
       "    var attempts = 0;\n",
       "    var timer = setInterval(function(root) {\n",
       "      if (root.Bokeh !== undefined) {\n",
       "        clearInterval(timer);\n",
       "        embed_document(root);\n",
       "      } else {\n",
       "        attempts++;\n",
       "        if (attempts > 100) {\n",
       "          clearInterval(timer);\n",
       "          console.log(\"Bokeh: ERROR: Unable to run BokehJS code because BokehJS library is missing\");\n",
       "        }\n",
       "      }\n",
       "    }, 10, root)\n",
       "  }\n",
       "})(window);"
      ],
      "application/vnd.bokehjs_exec.v0+json": ""
     },
     "metadata": {
      "application/vnd.bokehjs_exec.v0+json": {
       "id": "1690"
      }
     },
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<p style=''>To unpack eventdata from selected events use expand_events()</p>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "win_host_events = nb.nblts.azsent.host.WinHostEvents()\n",
    "timespan = TimeSpan(start=\"2020-05-07 00:10\")\n",
    "win_host_events_rslt = win_host_events.run(value=\"MSTICAlertsWin1\", timespan=timespan)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Additional operations apart from `run()`\n",
    "We can use expand events to unpack the `EventData` column for selected EventIDs"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>TenantId</th>\n",
       "      <th>TimeGenerated</th>\n",
       "      <th>SourceSystem</th>\n",
       "      <th>Account</th>\n",
       "      <th>AccountType</th>\n",
       "      <th>Computer</th>\n",
       "      <th>EventSourceName</th>\n",
       "      <th>Channel</th>\n",
       "      <th>Task</th>\n",
       "      <th>Level</th>\n",
       "      <th>EventData</th>\n",
       "      <th>EventID</th>\n",
       "      <th>Activity</th>\n",
       "      <th>PartitionKey</th>\n",
       "      <th>RowKey</th>\n",
       "      <th>StorageAccount</th>\n",
       "      <th>AzureDeploymentID</th>\n",
       "      <th>AzureTableName</th>\n",
       "      <th>AccessList</th>\n",
       "      <th>AccessMask</th>\n",
       "      <th>AccessReason</th>\n",
       "      <th>AccountDomain</th>\n",
       "      <th>AccountExpires</th>\n",
       "      <th>AccountName</th>\n",
       "      <th>AccountSessionIdentifier</th>\n",
       "      <th>...</th>\n",
       "      <th>TargetUserSid</th>\n",
       "      <th>TemplateContent</th>\n",
       "      <th>TemplateDSObjectFQDN</th>\n",
       "      <th>TemplateInternalName</th>\n",
       "      <th>TemplateOID</th>\n",
       "      <th>TemplateSchemaVersion</th>\n",
       "      <th>TemplateVersion</th>\n",
       "      <th>TokenElevationType</th>\n",
       "      <th>TransmittedServices</th>\n",
       "      <th>UserAccountControl</th>\n",
       "      <th>UserParameters</th>\n",
       "      <th>UserPrincipalName</th>\n",
       "      <th>UserWorkstations</th>\n",
       "      <th>VirtualAccount</th>\n",
       "      <th>VendorIds</th>\n",
       "      <th>Workstation</th>\n",
       "      <th>WorkstationName</th>\n",
       "      <th>SourceComputerId</th>\n",
       "      <th>EventOriginId</th>\n",
       "      <th>MG</th>\n",
       "      <th>TimeCollected</th>\n",
       "      <th>ManagementGroupName</th>\n",
       "      <th>Type</th>\n",
       "      <th>_ResourceId</th>\n",
       "      <th>EventProperties</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>47</th>\n",
       "      <td>52b1ab41-869e-4138-9e40-2a4457f09bf0</td>\n",
       "      <td>2019-02-11 09:58:50.173</td>\n",
       "      <td>OpsManager</td>\n",
       "      <td>MSTICAlertsWin1\\MSTICAdmin</td>\n",
       "      <td>User</td>\n",
       "      <td>MSTICAlertsWin1</td>\n",
       "      <td>Microsoft-Windows-Security-Auditing</td>\n",
       "      <td>Security</td>\n",
       "      <td>13826</td>\n",
       "      <td>8</td>\n",
       "      <td>&lt;EventData xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"&gt;\\r\\n  &lt;Data Name=\"Membe...</td>\n",
       "      <td>4728</td>\n",
       "      <td>4728 - A member was added to a security-enabled global group.</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>263a788b-6526-4cdc-8ed9-d79402fe4aa0</td>\n",
       "      <td>27df6071-1e81-4e24-934c-dc96667b83ab</td>\n",
       "      <td>00000000-0000-0000-0000-000000000001</td>\n",
       "      <td>2019-02-11 09:58:51.400</td>\n",
       "      <td>AOI-52b1ab41-869e-4138-9e40-2a4457f09bf0</td>\n",
       "      <td>SecurityEvent</td>\n",
       "      <td>/subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourcegroups/asihuntomsworkspacerg/provide...</td>\n",
       "      <td>{'MemberName': '-', 'MemberSid': 'S-1-5-21-996632719-2361334927-4038480536-1118', 'TargetUserNam...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>48</th>\n",
       "      <td>52b1ab41-869e-4138-9e40-2a4457f09bf0</td>\n",
       "      <td>2019-02-11 09:58:50.173</td>\n",
       "      <td>OpsManager</td>\n",
       "      <td>MSTICAlertsWin1\\MSTICAdmin</td>\n",
       "      <td>User</td>\n",
       "      <td>MSTICAlertsWin1</td>\n",
       "      <td>Microsoft-Windows-Security-Auditing</td>\n",
       "      <td>Security</td>\n",
       "      <td>13824</td>\n",
       "      <td>8</td>\n",
       "      <td>&lt;EventData xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"&gt;\\r\\n  &lt;Data Name=\"Targe...</td>\n",
       "      <td>4720</td>\n",
       "      <td>4720 - A user account was created.</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>%%1794</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>\\t\\t%%2080 \\t\\t%%2082 \\t\\t%%2084</td>\n",
       "      <td>%%1793</td>\n",
       "      <td>-</td>\n",
       "      <td>%%1793</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>263a788b-6526-4cdc-8ed9-d79402fe4aa0</td>\n",
       "      <td>2c09036a-5ca7-4115-9ddf-e9eb49c14247</td>\n",
       "      <td>00000000-0000-0000-0000-000000000001</td>\n",
       "      <td>2019-02-11 09:58:51.400</td>\n",
       "      <td>AOI-52b1ab41-869e-4138-9e40-2a4457f09bf0</td>\n",
       "      <td>SecurityEvent</td>\n",
       "      <td>/subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourcegroups/asihuntomsworkspacerg/provide...</td>\n",
       "      <td>{'TargetUserName': 'abai$', 'TargetDomainName': 'MSTICAlertsWin1', 'TargetSid': 'S-1-5-21-996632...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>49</th>\n",
       "      <td>52b1ab41-869e-4138-9e40-2a4457f09bf0</td>\n",
       "      <td>2019-02-11 09:58:50.183</td>\n",
       "      <td>OpsManager</td>\n",
       "      <td>MSTICAlertsWin1\\MSTICAdmin</td>\n",
       "      <td>User</td>\n",
       "      <td>MSTICAlertsWin1</td>\n",
       "      <td>Microsoft-Windows-Security-Auditing</td>\n",
       "      <td>Security</td>\n",
       "      <td>13824</td>\n",
       "      <td>8</td>\n",
       "      <td>&lt;EventData xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"&gt;\\r\\n  &lt;Data Name=\"Targe...</td>\n",
       "      <td>4722</td>\n",
       "      <td>4722 - A user account was enabled.</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>263a788b-6526-4cdc-8ed9-d79402fe4aa0</td>\n",
       "      <td>fefd6761-e431-4cfa-9cd2-c5700f6186df</td>\n",
       "      <td>00000000-0000-0000-0000-000000000001</td>\n",
       "      <td>2019-02-11 09:58:51.400</td>\n",
       "      <td>AOI-52b1ab41-869e-4138-9e40-2a4457f09bf0</td>\n",
       "      <td>SecurityEvent</td>\n",
       "      <td>/subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourcegroups/asihuntomsworkspacerg/provide...</td>\n",
       "      <td>{'TargetUserName': 'abai$', 'TargetDomainName': 'MSTICAlertsWin1', 'TargetSid': 'S-1-5-21-996632...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>50</th>\n",
       "      <td>52b1ab41-869e-4138-9e40-2a4457f09bf0</td>\n",
       "      <td>2019-02-11 09:58:50.183</td>\n",
       "      <td>OpsManager</td>\n",
       "      <td>MSTICAlertsWin1\\MSTICAdmin</td>\n",
       "      <td>User</td>\n",
       "      <td>MSTICAlertsWin1</td>\n",
       "      <td>Microsoft-Windows-Security-Auditing</td>\n",
       "      <td>Security</td>\n",
       "      <td>13824</td>\n",
       "      <td>8</td>\n",
       "      <td>&lt;EventData xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"&gt;\\r\\n  &lt;Data Name=\"Dummy...</td>\n",
       "      <td>4738</td>\n",
       "      <td>4738 - A user account was changed.</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>%%1794</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>\\t\\t%%2048 \\t\\t%%2050</td>\n",
       "      <td>-</td>\n",
       "      <td>-</td>\n",
       "      <td>%%1793</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>263a788b-6526-4cdc-8ed9-d79402fe4aa0</td>\n",
       "      <td>1d3997a3-9ede-4f9b-877a-eaabc63a3c1e</td>\n",
       "      <td>00000000-0000-0000-0000-000000000001</td>\n",
       "      <td>2019-02-11 09:58:51.400</td>\n",
       "      <td>AOI-52b1ab41-869e-4138-9e40-2a4457f09bf0</td>\n",
       "      <td>SecurityEvent</td>\n",
       "      <td>/subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourcegroups/asihuntomsworkspacerg/provide...</td>\n",
       "      <td>{'Dummy': '-', 'TargetUserName': 'abai$', 'TargetDomainName': 'MSTICAlertsWin1', 'TargetSid': 'S...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>51</th>\n",
       "      <td>52b1ab41-869e-4138-9e40-2a4457f09bf0</td>\n",
       "      <td>2019-02-11 09:58:50.183</td>\n",
       "      <td>OpsManager</td>\n",
       "      <td>MSTICAlertsWin1\\MSTICAdmin</td>\n",
       "      <td>User</td>\n",
       "      <td>MSTICAlertsWin1</td>\n",
       "      <td>Microsoft-Windows-Security-Auditing</td>\n",
       "      <td>Security</td>\n",
       "      <td>13824</td>\n",
       "      <td>8</td>\n",
       "      <td>&lt;EventData xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"&gt;\\r\\n  &lt;Data Name=\"Targe...</td>\n",
       "      <td>4724</td>\n",
       "      <td>4724 - An attempt was made to reset an account's password.</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>...</td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td></td>\n",
       "      <td>263a788b-6526-4cdc-8ed9-d79402fe4aa0</td>\n",
       "      <td>66e7e96a-d33d-4eb7-bc89-f4e654d74009</td>\n",
       "      <td>00000000-0000-0000-0000-000000000001</td>\n",
       "      <td>2019-02-11 09:58:51.400</td>\n",
       "      <td>AOI-52b1ab41-869e-4138-9e40-2a4457f09bf0</td>\n",
       "      <td>SecurityEvent</td>\n",
       "      <td>/subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourcegroups/asihuntomsworkspacerg/provide...</td>\n",
       "      <td>{'TargetUserName': 'abai$', 'TargetDomainName': 'MSTICAlertsWin1', 'TargetSid': 'S-1-5-21-996632...</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 226 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "                                TenantId           TimeGenerated SourceSystem  \\\n",
       "47  52b1ab41-869e-4138-9e40-2a4457f09bf0 2019-02-11 09:58:50.173   OpsManager   \n",
       "48  52b1ab41-869e-4138-9e40-2a4457f09bf0 2019-02-11 09:58:50.173   OpsManager   \n",
       "49  52b1ab41-869e-4138-9e40-2a4457f09bf0 2019-02-11 09:58:50.183   OpsManager   \n",
       "50  52b1ab41-869e-4138-9e40-2a4457f09bf0 2019-02-11 09:58:50.183   OpsManager   \n",
       "51  52b1ab41-869e-4138-9e40-2a4457f09bf0 2019-02-11 09:58:50.183   OpsManager   \n",
       "\n",
       "                       Account AccountType         Computer  \\\n",
       "47  MSTICAlertsWin1\\MSTICAdmin        User  MSTICAlertsWin1   \n",
       "48  MSTICAlertsWin1\\MSTICAdmin        User  MSTICAlertsWin1   \n",
       "49  MSTICAlertsWin1\\MSTICAdmin        User  MSTICAlertsWin1   \n",
       "50  MSTICAlertsWin1\\MSTICAdmin        User  MSTICAlertsWin1   \n",
       "51  MSTICAlertsWin1\\MSTICAdmin        User  MSTICAlertsWin1   \n",
       "\n",
       "                        EventSourceName   Channel   Task Level  \\\n",
       "47  Microsoft-Windows-Security-Auditing  Security  13826     8   \n",
       "48  Microsoft-Windows-Security-Auditing  Security  13824     8   \n",
       "49  Microsoft-Windows-Security-Auditing  Security  13824     8   \n",
       "50  Microsoft-Windows-Security-Auditing  Security  13824     8   \n",
       "51  Microsoft-Windows-Security-Auditing  Security  13824     8   \n",
       "\n",
       "                                                                                              EventData  \\\n",
       "47  <EventData xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\">\\r\\n  <Data Name=\"Membe...   \n",
       "48  <EventData xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\">\\r\\n  <Data Name=\"Targe...   \n",
       "49  <EventData xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\">\\r\\n  <Data Name=\"Targe...   \n",
       "50  <EventData xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\">\\r\\n  <Data Name=\"Dummy...   \n",
       "51  <EventData xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\">\\r\\n  <Data Name=\"Targe...   \n",
       "\n",
       "    EventID                                                       Activity  \\\n",
       "47     4728  4728 - A member was added to a security-enabled global group.   \n",
       "48     4720                             4720 - A user account was created.   \n",
       "49     4722                             4722 - A user account was enabled.   \n",
       "50     4738                             4738 - A user account was changed.   \n",
       "51     4724     4724 - An attempt was made to reset an account's password.   \n",
       "\n",
       "   PartitionKey RowKey StorageAccount AzureDeploymentID AzureTableName  \\\n",
       "47                                                                       \n",
       "48                                                                       \n",
       "49                                                                       \n",
       "50                                                                       \n",
       "51                                                                       \n",
       "\n",
       "   AccessList AccessMask AccessReason AccountDomain AccountExpires  \\\n",
       "47                                                                   \n",
       "48                                                          %%1794   \n",
       "49                                                                   \n",
       "50                                                          %%1794   \n",
       "51                                                                   \n",
       "\n",
       "   AccountName AccountSessionIdentifier  ... TargetUserSid TemplateContent  \\\n",
       "47                                       ...                                 \n",
       "48                                       ...                                 \n",
       "49                                       ...                                 \n",
       "50                                       ...                                 \n",
       "51                                       ...                                 \n",
       "\n",
       "   TemplateDSObjectFQDN TemplateInternalName TemplateOID  \\\n",
       "47                                                         \n",
       "48                                                         \n",
       "49                                                         \n",
       "50                                                         \n",
       "51                                                         \n",
       "\n",
       "    TemplateSchemaVersion  TemplateVersion TokenElevationType  \\\n",
       "47                                                              \n",
       "48                                                              \n",
       "49                                                              \n",
       "50                                                              \n",
       "51                                                              \n",
       "\n",
       "   TransmittedServices                 UserAccountControl  UserParameters  \\\n",
       "47                                                                          \n",
       "48                       \\t\\t%%2080 \\t\\t%%2082 \\t\\t%%2084          %%1793   \n",
       "49                                                                          \n",
       "50                                  \\t\\t%%2048 \\t\\t%%2050               -   \n",
       "51                                                                          \n",
       "\n",
       "   UserPrincipalName UserWorkstations VirtualAccount VendorIds Workstation  \\\n",
       "47                                                                           \n",
       "48                 -           %%1793                                        \n",
       "49                                                                           \n",
       "50                 -           %%1793                                        \n",
       "51                                                                           \n",
       "\n",
       "   WorkstationName                      SourceComputerId  \\\n",
       "47                  263a788b-6526-4cdc-8ed9-d79402fe4aa0   \n",
       "48                  263a788b-6526-4cdc-8ed9-d79402fe4aa0   \n",
       "49                  263a788b-6526-4cdc-8ed9-d79402fe4aa0   \n",
       "50                  263a788b-6526-4cdc-8ed9-d79402fe4aa0   \n",
       "51                  263a788b-6526-4cdc-8ed9-d79402fe4aa0   \n",
       "\n",
       "                           EventOriginId  \\\n",
       "47  27df6071-1e81-4e24-934c-dc96667b83ab   \n",
       "48  2c09036a-5ca7-4115-9ddf-e9eb49c14247   \n",
       "49  fefd6761-e431-4cfa-9cd2-c5700f6186df   \n",
       "50  1d3997a3-9ede-4f9b-877a-eaabc63a3c1e   \n",
       "51  66e7e96a-d33d-4eb7-bc89-f4e654d74009   \n",
       "\n",
       "                                      MG           TimeCollected  \\\n",
       "47  00000000-0000-0000-0000-000000000001 2019-02-11 09:58:51.400   \n",
       "48  00000000-0000-0000-0000-000000000001 2019-02-11 09:58:51.400   \n",
       "49  00000000-0000-0000-0000-000000000001 2019-02-11 09:58:51.400   \n",
       "50  00000000-0000-0000-0000-000000000001 2019-02-11 09:58:51.400   \n",
       "51  00000000-0000-0000-0000-000000000001 2019-02-11 09:58:51.400   \n",
       "\n",
       "                         ManagementGroupName           Type  \\\n",
       "47  AOI-52b1ab41-869e-4138-9e40-2a4457f09bf0  SecurityEvent   \n",
       "48  AOI-52b1ab41-869e-4138-9e40-2a4457f09bf0  SecurityEvent   \n",
       "49  AOI-52b1ab41-869e-4138-9e40-2a4457f09bf0  SecurityEvent   \n",
       "50  AOI-52b1ab41-869e-4138-9e40-2a4457f09bf0  SecurityEvent   \n",
       "51  AOI-52b1ab41-869e-4138-9e40-2a4457f09bf0  SecurityEvent   \n",
       "\n",
       "                                                                                            _ResourceId  \\\n",
       "47  /subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourcegroups/asihuntomsworkspacerg/provide...   \n",
       "48  /subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourcegroups/asihuntomsworkspacerg/provide...   \n",
       "49  /subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourcegroups/asihuntomsworkspacerg/provide...   \n",
       "50  /subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourcegroups/asihuntomsworkspacerg/provide...   \n",
       "51  /subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourcegroups/asihuntomsworkspacerg/provide...   \n",
       "\n",
       "                                                                                        EventProperties  \n",
       "47  {'MemberName': '-', 'MemberSid': 'S-1-5-21-996632719-2361334927-4038480536-1118', 'TargetUserNam...  \n",
       "48  {'TargetUserName': 'abai$', 'TargetDomainName': 'MSTICAlertsWin1', 'TargetSid': 'S-1-5-21-996632...  \n",
       "49  {'TargetUserName': 'abai$', 'TargetDomainName': 'MSTICAlertsWin1', 'TargetSid': 'S-1-5-21-996632...  \n",
       "50  {'Dummy': '-', 'TargetUserName': 'abai$', 'TargetDomainName': 'MSTICAlertsWin1', 'TargetSid': 'S...  \n",
       "51  {'TargetUserName': 'abai$', 'TargetDomainName': 'MSTICAlertsWin1', 'TargetSid': 'S-1-5-21-996632...  \n",
       "\n",
       "[5 rows x 226 columns]"
      ]
     },
     "execution_count": 20,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "win_host_events_rslt.account_events.head(5)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<h3>Parsing eventdata into columns</h3>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "This may take some time to complete for large numbers of events.<br>Since event types have different schema, some of the columns will not be populated for certain Event IDs and will show as `NaN`."
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<p style=''>Parsing event data...</p>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>TenantId</th>\n",
       "      <th>TimeGenerated</th>\n",
       "      <th>SourceSystem</th>\n",
       "      <th>Account</th>\n",
       "      <th>AccountType</th>\n",
       "      <th>Computer</th>\n",
       "      <th>EventSourceName</th>\n",
       "      <th>Channel</th>\n",
       "      <th>Task</th>\n",
       "      <th>Level</th>\n",
       "      <th>EventData</th>\n",
       "      <th>EventID</th>\n",
       "      <th>Activity</th>\n",
       "      <th>MemberName</th>\n",
       "      <th>MemberSid</th>\n",
       "      <th>PrivilegeList</th>\n",
       "      <th>SubjectAccount</th>\n",
       "      <th>SubjectDomainName</th>\n",
       "      <th>SubjectLogonId</th>\n",
       "      <th>SubjectUserName</th>\n",
       "      <th>SubjectUserSid</th>\n",
       "      <th>TargetAccount</th>\n",
       "      <th>TargetDomainName</th>\n",
       "      <th>TargetSid</th>\n",
       "      <th>TargetUserName</th>\n",
       "      <th>SourceComputerId</th>\n",
       "      <th>EventOriginId</th>\n",
       "      <th>MG</th>\n",
       "      <th>TimeCollected</th>\n",
       "      <th>ManagementGroupName</th>\n",
       "      <th>Type</th>\n",
       "      <th>_ResourceId</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>47</th>\n",
       "      <td>52b1ab41-869e-4138-9e40-2a4457f09bf0</td>\n",
       "      <td>2019-02-11 09:58:50.173</td>\n",
       "      <td>OpsManager</td>\n",
       "      <td>MSTICAlertsWin1\\MSTICAdmin</td>\n",
       "      <td>User</td>\n",
       "      <td>MSTICAlertsWin1</td>\n",
       "      <td>Microsoft-Windows-Security-Auditing</td>\n",
       "      <td>Security</td>\n",
       "      <td>13826</td>\n",
       "      <td>8</td>\n",
       "      <td>&lt;EventData xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"&gt;\\r\\n  &lt;Data Name=\"Membe...</td>\n",
       "      <td>4728</td>\n",
       "      <td>4728 - A member was added to a security-enabled global group.</td>\n",
       "      <td>-</td>\n",
       "      <td>S-1-5-21-996632719-2361334927-4038480536-1118</td>\n",
       "      <td>-</td>\n",
       "      <td>MSTICAlertsWin1\\MSTICAdmin</td>\n",
       "      <td>MSTICAlertsWin1</td>\n",
       "      <td>0xbd57571</td>\n",
       "      <td>MSTICAdmin</td>\n",
       "      <td>S-1-5-21-996632719-2361334927-4038480536-500</td>\n",
       "      <td>MSTICAlertsWin1\\None</td>\n",
       "      <td>MSTICAlertsWin1</td>\n",
       "      <td>S-1-5-21-996632719-2361334927-4038480536-513</td>\n",
       "      <td>None</td>\n",
       "      <td>263a788b-6526-4cdc-8ed9-d79402fe4aa0</td>\n",
       "      <td>27df6071-1e81-4e24-934c-dc96667b83ab</td>\n",
       "      <td>00000000-0000-0000-0000-000000000001</td>\n",
       "      <td>2019-02-11 09:58:51.400</td>\n",
       "      <td>AOI-52b1ab41-869e-4138-9e40-2a4457f09bf0</td>\n",
       "      <td>SecurityEvent</td>\n",
       "      <td>/subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourcegroups/asihuntomsworkspacerg/provide...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>58</th>\n",
       "      <td>52b1ab41-869e-4138-9e40-2a4457f09bf0</td>\n",
       "      <td>2019-02-11 09:58:50.447</td>\n",
       "      <td>OpsManager</td>\n",
       "      <td>MSTICAlertsWin1\\MSTICAdmin</td>\n",
       "      <td>User</td>\n",
       "      <td>MSTICAlertsWin1</td>\n",
       "      <td>Microsoft-Windows-Security-Auditing</td>\n",
       "      <td>Security</td>\n",
       "      <td>13826</td>\n",
       "      <td>8</td>\n",
       "      <td>&lt;EventData xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"&gt;\\r\\n  &lt;Data Name=\"Membe...</td>\n",
       "      <td>4728</td>\n",
       "      <td>4728 - A member was added to a security-enabled global group.</td>\n",
       "      <td>-</td>\n",
       "      <td>S-1-5-21-996632719-2361334927-4038480536-1119</td>\n",
       "      <td>-</td>\n",
       "      <td>MSTICAlertsWin1\\MSTICAdmin</td>\n",
       "      <td>MSTICAlertsWin1</td>\n",
       "      <td>0xbd57571</td>\n",
       "      <td>MSTICAdmin</td>\n",
       "      <td>S-1-5-21-996632719-2361334927-4038480536-500</td>\n",
       "      <td>MSTICAlertsWin1\\None</td>\n",
       "      <td>MSTICAlertsWin1</td>\n",
       "      <td>S-1-5-21-996632719-2361334927-4038480536-513</td>\n",
       "      <td>None</td>\n",
       "      <td>263a788b-6526-4cdc-8ed9-d79402fe4aa0</td>\n",
       "      <td>73b0fe4e-9886-43ab-afa6-b43eb7434402</td>\n",
       "      <td>00000000-0000-0000-0000-000000000001</td>\n",
       "      <td>2019-02-11 09:58:51.400</td>\n",
       "      <td>AOI-52b1ab41-869e-4138-9e40-2a4457f09bf0</td>\n",
       "      <td>SecurityEvent</td>\n",
       "      <td>/subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourcegroups/asihuntomsworkspacerg/provide...</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                                TenantId           TimeGenerated SourceSystem  \\\n",
       "47  52b1ab41-869e-4138-9e40-2a4457f09bf0 2019-02-11 09:58:50.173   OpsManager   \n",
       "58  52b1ab41-869e-4138-9e40-2a4457f09bf0 2019-02-11 09:58:50.447   OpsManager   \n",
       "\n",
       "                       Account AccountType         Computer  \\\n",
       "47  MSTICAlertsWin1\\MSTICAdmin        User  MSTICAlertsWin1   \n",
       "58  MSTICAlertsWin1\\MSTICAdmin        User  MSTICAlertsWin1   \n",
       "\n",
       "                        EventSourceName   Channel   Task Level  \\\n",
       "47  Microsoft-Windows-Security-Auditing  Security  13826     8   \n",
       "58  Microsoft-Windows-Security-Auditing  Security  13826     8   \n",
       "\n",
       "                                                                                              EventData  \\\n",
       "47  <EventData xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\">\\r\\n  <Data Name=\"Membe...   \n",
       "58  <EventData xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\">\\r\\n  <Data Name=\"Membe...   \n",
       "\n",
       "    EventID                                                       Activity  \\\n",
       "47     4728  4728 - A member was added to a security-enabled global group.   \n",
       "58     4728  4728 - A member was added to a security-enabled global group.   \n",
       "\n",
       "   MemberName                                      MemberSid PrivilegeList  \\\n",
       "47          -  S-1-5-21-996632719-2361334927-4038480536-1118             -   \n",
       "58          -  S-1-5-21-996632719-2361334927-4038480536-1119             -   \n",
       "\n",
       "                SubjectAccount SubjectDomainName SubjectLogonId  \\\n",
       "47  MSTICAlertsWin1\\MSTICAdmin   MSTICAlertsWin1      0xbd57571   \n",
       "58  MSTICAlertsWin1\\MSTICAdmin   MSTICAlertsWin1      0xbd57571   \n",
       "\n",
       "   SubjectUserName                                SubjectUserSid  \\\n",
       "47      MSTICAdmin  S-1-5-21-996632719-2361334927-4038480536-500   \n",
       "58      MSTICAdmin  S-1-5-21-996632719-2361334927-4038480536-500   \n",
       "\n",
       "           TargetAccount TargetDomainName  \\\n",
       "47  MSTICAlertsWin1\\None  MSTICAlertsWin1   \n",
       "58  MSTICAlertsWin1\\None  MSTICAlertsWin1   \n",
       "\n",
       "                                       TargetSid TargetUserName  \\\n",
       "47  S-1-5-21-996632719-2361334927-4038480536-513           None   \n",
       "58  S-1-5-21-996632719-2361334927-4038480536-513           None   \n",
       "\n",
       "                        SourceComputerId  \\\n",
       "47  263a788b-6526-4cdc-8ed9-d79402fe4aa0   \n",
       "58  263a788b-6526-4cdc-8ed9-d79402fe4aa0   \n",
       "\n",
       "                           EventOriginId  \\\n",
       "47  27df6071-1e81-4e24-934c-dc96667b83ab   \n",
       "58  73b0fe4e-9886-43ab-afa6-b43eb7434402   \n",
       "\n",
       "                                      MG           TimeCollected  \\\n",
       "47  00000000-0000-0000-0000-000000000001 2019-02-11 09:58:51.400   \n",
       "58  00000000-0000-0000-0000-000000000001 2019-02-11 09:58:51.400   \n",
       "\n",
       "                         ManagementGroupName           Type  \\\n",
       "47  AOI-52b1ab41-869e-4138-9e40-2a4457f09bf0  SecurityEvent   \n",
       "58  AOI-52b1ab41-869e-4138-9e40-2a4457f09bf0  SecurityEvent   \n",
       "\n",
       "                                                                                            _ResourceId  \n",
       "47  /subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourcegroups/asihuntomsworkspacerg/provide...  \n",
       "58  /subscriptions/40dcc8bf-0478-4f3b-b275-ed0a94f2c013/resourcegroups/asihuntomsworkspacerg/provide...  "
      ]
     },
     "execution_count": 21,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "win_host_events.expand_events(event_ids=4728).head(5)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "---\n",
    "# Anatomy of a Notebooklet\n",
    "\n",
    "# Three sections:\n",
    "- Results class - what is it going to return\n",
    "- Notebooklet class - `run()` defines what the notebooklet does\n",
    "- Code - series of functions that do the actual work\n",
    "\n",
    "Run the following cell to import the code."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "nb.nblts.template.TemplateNB.import_cell()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "---\n",
    "# More Info\n",
    "\n",
    "## msticpy\n",
    "- Documentation - https://msticpy.readthedocs.io\n",
    "- GitHub - https://github.com/microsoft/msticpy\n",
    "- PyPI - https://pypi.org/project/msticpy/\n",
    "\n",
    "## msticnb - Notebooklets\n",
    "- GitHub - https://github.com/microsoft/msticnb\n",
    "\n",
    "## Notebooks\n",
    "- Azure-Sentinel-Notebooks - https://github.com/Azure/Azure-Sentinel-Notebooks\n",
    "- Binder-able demo - https://github.com/Azure/Azure-Sentinel-Notebooks/tree/master/nbdemo"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python (condadev)",
   "language": "python",
   "name": "condadev"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.6.10"
  },
  "widgets": {
   "application/vnd.jupyter.widget-state+json": {
    "state": {
     "0324f5cb01fb493bbbef3c6b22141087": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "VBoxModel",
      "state": {
       "children": [
        "IPY_MODEL_2f69c0635b464dbcb868f821aa5cebe6",
        "IPY_MODEL_b50be47e69e84afbb9c4689f5bba4225"
       ],
       "layout": "IPY_MODEL_bda072a27c4d488099422fa887b5b03c"
      }
     },
     "03aae567808841ba988057550bc32085": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "80%"
      }
     },
     "0437dcda62674f63b23312227ece8a91": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "080aeeb063ce4dafbb1acc0ffedd74bf": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": "initial"
      }
     },
     "0ac0eba6188d4e0c997bc7ca88a302bd": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": "initial"
      }
     },
     "0d9aac064a2d4a319bb973cb2ef4f24e": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": "initial"
      }
     },
     "10eea0e2e8a244bf9c6c9419a4e654dd": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "VBoxModel",
      "state": {
       "children": [
        "IPY_MODEL_89dd79c579a54fe4a1d5eb47570aed48",
        "IPY_MODEL_a25453c687ca4158bb82e7659373ad5c",
        "IPY_MODEL_ecdc32f70c2948e29c88d64fb7e429e3"
       ],
       "layout": "IPY_MODEL_e2a80820cb6a4ad2b390faca85e4935b"
      }
     },
     "155411598df948309114d6be3b95bba3": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "HBoxModel",
      "state": {
       "children": [
        "IPY_MODEL_448d82352dcc46d5a1729e8a749807f4",
        "IPY_MODEL_5b6ed96ff20f408899d72874386f1525"
       ],
       "layout": "IPY_MODEL_41d364084c5c4deab99cf4807cc4b0a1"
      }
     },
     "19ca7b6a4f7b4587a32b236dbaeb313b": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "HTMLModel",
      "state": {
       "layout": "IPY_MODEL_2f4d0269866b4e668fffe9c84c6a4996",
       "style": "IPY_MODEL_fa4edae945364a65a4935eb520685c88",
       "value": "<h4>Set query time boundaries</h4>"
      }
     },
     "21be0b6704b84b3ebcdd54e115293ced": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": ""
      }
     },
     "2ae21918228f4ef5a0a2a8133f4f1743": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "SliderStyleModel",
      "state": {
       "description_width": "initial"
      }
     },
     "2f4d0269866b4e668fffe9c84c6a4996": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "2f69c0635b464dbcb868f821aa5cebe6": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "SelectModel",
      "state": {
       "_options_labels": [
        "AccountSummary",
        "EnrichAlerts",
        "HostLogonsSummary",
        "HostSummary",
        "WinHostEvents",
        "NetworkFlowSummary",
        "TemplateNB"
       ],
       "index": 5,
       "layout": "IPY_MODEL_8d9c49c7d59948baadd9827581aa1dbf",
       "style": "IPY_MODEL_21be0b6704b84b3ebcdd54e115293ced"
      }
     },
     "3208d92410d34e9ebed656201a26a6ac": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "34d280e2f5d044dd8683d24cf5b634ef": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "ButtonStyleModel",
      "state": {}
     },
     "35ba343350f54394877aeb76ab21f495": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": ""
      }
     },
     "38c3500044ef4020887d4a490076e5f0": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "50%"
      }
     },
     "3918f49c8b334943964320d019ee36ec": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": ""
      }
     },
     "3ef3e93f494745a198f27a79390b9c53": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "TextModel",
      "state": {
       "description": "Time (24hr)",
       "layout": "IPY_MODEL_0437dcda62674f63b23312227ece8a91",
       "style": "IPY_MODEL_3918f49c8b334943964320d019ee36ec",
       "value": "00:00:00"
      }
     },
     "3f26503797fa469f87b5f11974f48cef": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "HTMLModel",
      "state": {
       "layout": "IPY_MODEL_fc5f422f4ae44202809300b5aef4a761",
       "style": "IPY_MODEL_d45cf48ff33d44bb9026c14d4ad0479f",
       "value": "<h1>NetworkFlowSummary.run()</h1><pre><code>    Return host summary data.\n\n    Parameters\n    ----------\n    value : str\n        Host entity, hostname or host IP Address\n    data : Optional[pd.DataFrame], optional\n        Not used, by default None\n    timespan : TimeSpan\n        Timespan over which operations such as queries will be\n        performed, by default None.\n        This can be a TimeStamp object or another object that\n        has valid `start`, `end`, or `period` attributes.\n    options : Optional[Iterable[str]], optional\n        List of options to use, by default None\n        A value of None means use default options.\n        Options prefixed with \"+\" will be added to the default options.\n        To see the list of available options type `help(cls)` where\n        \"cls\" is the notebooklet class or an instance of this class.\n\n    Other Parameters\n    ----------------\n    start : Union[datetime, datelike-string]\n        Alternative to specifying timespan parameter.\n    end : Union[datetime, datelike-string]\n        Alternative to specifying timespan parameter.\n\n    Returns\n    -------\n    HostNetworkResult\n        Result object with attributes for each result type.\n\n    Raises\n    ------\n    MsticnbMissingParameterError\n        If required parameters are missing\n</code></pre>"
      }
     },
     "40a7efb5c8c74d8a88c40ffe5d39bf91": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "41d364084c5c4deab99cf4807cc4b0a1": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "448d82352dcc46d5a1729e8a749807f4": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DatePickerModel",
      "state": {
       "description": "Origin Date",
       "disabled": false,
       "layout": "IPY_MODEL_7d9f316021ed4f399b08e18ecdad33b8",
       "style": "IPY_MODEL_a577ffbfa39f4e6080443277d1ce8fe9",
       "value": {
        "date": 10,
        "month": 1,
        "year": 2019
       }
      }
     },
     "459079c8617f42e7aba2bfcbeeb1c3cb": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "4c0653240a404210a778b760080041a9": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "HTMLModel",
      "state": {
       "layout": "IPY_MODEL_459079c8617f42e7aba2bfcbeeb1c3cb",
       "style": "IPY_MODEL_8bd97f7450b84901a5743f6feb648364",
       "value": "<h4>Set query time boundaries</h4>"
      }
     },
     "4ffd3fff39964ee99edf19d92e0f2d8d": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": ""
      }
     },
     "525c58f2ced54803989fc196fc95393e": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "80%"
      }
     },
     "589d9298e2d24d6ca2a2c25afee00595": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "HTMLModel",
      "state": {
       "layout": "IPY_MODEL_fc5f422f4ae44202809300b5aef4a761",
       "style": "IPY_MODEL_d13f1d4a92c5402ba69db7b7f74234be",
       "value": "<pre><code>\n    from msticnb.common import TimeSpan\n    # Note you can populate TimeSpan with msticpy nbwidgets.QueryTime()\n    # qt = QueryTime(autodisplay=True)\n    # %% New cell\n    # notebooklet.run(value=\"158.23.4.19\", timespan=TimeSpan(qt))\n\n    network_flow_summary = nb.nblts.azsent.network.NetworkFlowSummary()\n    timespan = TimeSpan(start=\"2020-08-11 17:36\")\n    network_flow_summary_rslt = network_flow_summary.run(value=\"my_host\", timespan=timespan)\n\n    </code></pre>"
      }
     },
     "5b6ed96ff20f408899d72874386f1525": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "TextModel",
      "state": {
       "description": "Time (24hr)",
       "layout": "IPY_MODEL_d66e9579979641a8a436a0eff5a2f2f3",
       "style": "IPY_MODEL_35ba343350f54394877aeb76ab21f495",
       "value": "00:00:00"
      }
     },
     "5e827b3df0a444c7a69207ce532309ec": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "HTMLModel",
      "state": {
       "layout": "IPY_MODEL_6a37474aca4a4471a9127d56ba21d037",
       "style": "IPY_MODEL_deb2e57255264b5591eb172b2080ec7f",
       "value": "<h4>Set query time boundaries</h4>"
      }
     },
     "603de6e9c9024f4787ab3422b24ae185": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "50%"
      }
     },
     "60a2cd7ea94d470ba09c174a0be601a5": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": "initial"
      }
     },
     "61e88f1f4cce4ea7b7e22155c03fca25": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DatePickerModel",
      "state": {
       "description": "Origin Date",
       "disabled": false,
       "layout": "IPY_MODEL_a144f13f57ad436b9ed6674edb9c4f73",
       "style": "IPY_MODEL_7af9507406894234a6fae5f74fb59d81",
       "value": {
        "date": 10,
        "month": 1,
        "year": 2019
       }
      }
     },
     "625310aebbe24142b3e2ba10e0c4e176": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "IntRangeSliderModel",
      "state": {
       "_model_name": "IntRangeSliderModel",
       "_view_name": "IntRangeSliderView",
       "description": "Time Range (day):",
       "layout": "IPY_MODEL_03aae567808841ba988057550bc32085",
       "max": 7,
       "min": -20,
       "style": "IPY_MODEL_a3803c76f9de4567a9c4a226bb9719cc",
       "value": [
        -10,
        1
       ]
      }
     },
     "696f516bdd4e445ea28ed10da4001daf": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": ""
      }
     },
     "69e826c983184a099e2b1d68e8fd454e": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": "initial"
      }
     },
     "6a37474aca4a4471a9127d56ba21d037": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "6f832de9237c40acaa4d51bc2d17893e": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "50%"
      }
     },
     "74d86bb16e364ecaad127170d9df0e4d": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "767b958d0f924a568c9d4c01a937f051": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "80%"
      }
     },
     "76bbef7126114766ba1f33dbcf8b8c30": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DatePickerModel",
      "state": {
       "description": "Origin Date",
       "disabled": false,
       "layout": "IPY_MODEL_e5b8bed440414bd2838ad2b46c552d9f",
       "style": "IPY_MODEL_4ffd3fff39964ee99edf19d92e0f2d8d",
       "value": {
        "date": 10,
        "month": 1,
        "year": 2019
       }
      }
     },
     "7af9507406894234a6fae5f74fb59d81": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": ""
      }
     },
     "7d9f316021ed4f399b08e18ecdad33b8": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "7ed8329615be42b798b990ae8fcc5a5e": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "TextModel",
      "state": {
       "description": "Query start time (UTC):",
       "layout": "IPY_MODEL_6f832de9237c40acaa4d51bc2d17893e",
       "style": "IPY_MODEL_0d9aac064a2d4a319bb973cb2ef4f24e",
       "value": "2019-01-31 00:00:00"
      }
     },
     "81fe09b8676241028af1216129f848ed": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "HTMLModel",
      "state": {
       "layout": "IPY_MODEL_fc5f422f4ae44202809300b5aef4a761",
       "style": "IPY_MODEL_696f516bdd4e445ea28ed10da4001daf",
       "value": "<h1>Notebooklet Class - NetworkFlowSummary</h1>\n<p>Network Flow Summary Notebooklet class.</p>\n<p>Queries network data and plots time lines for network</p>\n<p>traffic to/from a host or IP address.</p>\n<ul>\n<li>\n<p>Plot flows events by protocol and direction</p>\n</li>\n<li>\n<p>Plot flow count by protocol</p>\n</li>\n<li>\n<p>Display flow summary table</p>\n</li>\n<li>\n<p>Display flow summary by ASN</p>\n</li>\n<li>\n<p>Display results on map</p>\n</li>\n</ul>\n<p><strong>Methods\n</strong></p>\n<ul>\n<li>\n<p>run: main method for notebooklet.</p>\n</li>\n<li>\n<p>select_asns: Open an interactive dialog to choose which ASNs to</p>\n</li>\n</ul>\n<p>investigate further.</p>\n<ul>\n<li>lookup_ti_for_asn_ips: For selected ASNs, lookup Threat Intelligence</li>\n</ul>\n<p>data for the IPs belonging to those ASNs.</p>\n<ul>\n<li>show_selected_asn_map: Show IP address locations for selected IP</li>\n</ul>\n<p>(including any threats highlighted)</p>\n<p><strong>Default Options\n</strong></p>\n<ul>\n<li>\n<p>plot_flows: Create plots of flows by protocol and direction.</p>\n</li>\n<li>\n<p>plot_flow_values: Plot flow county by protocol.</p>\n</li>\n<li>\n<p>flow_summary: Create a summarization of all flows and all flows grouped by ASN.</p>\n</li>\n</ul>\n<p><strong>Other Options\n</strong></p>\n<ul>\n<li>\n<p>resolve_host: Try to resolve the host name before other operations.</p>\n</li>\n<li>\n<p>geo_map: Plot a map of all IP address locations in communication with the host (see the method below for plotting selected IPs only).</p>\n</li>\n</ul>\n<hr />\n<h1>Display Sections</h1>\n<h2>Host Network Summary</h2>\n<p>This shows a summary of network flows for this endpoint.\nData and plots are stored in the result class returned by this function.</p>\n<h3>Map of geographic location of selected IPs communicating with host</h3>\n<p>Numbered circles indicate multiple items - click to expand these.\nHovering over a location shows brief details, clicking on an IP location shows more detail.\nLocation marker key - Blue = outbound - Purple = inbound - Green = Host - Red = Threats</p>\n<h3>Map of geographic location of all IPs communicating with host</h3>\n<p>Numbered circles indicate multiple items - click to expand these.\nHovering over a location shows brief details, clicking on an IP location shows more detail.\nLocation marker key - Blue = outbound - Purple = inbound - Green = Host</p>\n<h3>Flow Index.</h3>\n<p>List of flows grouped by source, dest, protocol and direction.</p>\n<h3>Flow Summary with ASN details.</h3>\n<p>Gets the ASN details from WhoIs.\nThe data shows flows grouped by source and destination ASNs. All protocol types and all source IP addresses are grouped into lists for each ASN.</p>\n<h3>TI Lookup for IP Addresses in selected ASNs.</h3>\n<p>The remote IPs from each selected ASN are are searched for your selected Threat Intelligence providers. Check the results to see if there are indications of malicious activity associated with these IPs.</p>\n<h3>Timeline of network flows quantity.</h3>\n<p>Each protocol is plotted as a separate colored series. The vertical axis indicates the number for flows recorded for that time slot.</p>\n<h3>Timeline of network flows by direction.</h3>\n<p>I = inbound, O = outbound.</p>\n<h3>Timeline of network flows by protocol type.</h3>\n<h3>Select the ASNs to process.</h3>\n<p>Choose any unusual looking ASNs that you want to examine.\nThe remote IPs from each selected ASN will be sent to your selected Threat Intelligence providers to check if there are indications of malicious activity associated with these IPs.\nBy default, the most infrequently accessed ASNs are selected.</p>\n<hr />\n<h1>Results Class</h1>\n<h2>NetworkFlowResult</h2>\n<p>Network Flow Details Results.</p>\n<h2>Attributes</h2>\n<ul>\n<li>\n<p>host_entity : msticpy.data.nbtools.entities.Host<br>\nThe host entity object contains data about the host\nsuch as name, environment, operating system version,\nIP addresses and Azure VM details. Depending on the\ntype of host, not all of this data may be populated.</p>\n</li>\n<li>\n<p>network_flows : pd.DataFrame<br>\nThe raw network flows recorded for this host.</p>\n</li>\n<li>\n<p>plot_flows_by_protocol : Figure<br>\nBokeh timeline plot of flow events by protocol.</p>\n</li>\n<li>\n<p>plot_flows_by_direction : Figure<br>\nBokeh timeline plot of flow events by direction (in/out).</p>\n</li>\n<li>\n<p>plot_flow_values : Figure<br>\nBokeh values plot of flow events by protocol.</p>\n</li>\n<li>\n<p>flow_index : pd.DataFrame<br>\nSummarized DataFrame of flows</p>\n</li>\n<li>\n<p>flow_index_data : pd.DataFrame<br>\nRaw summary data of flows.</p>\n</li>\n<li>\n<p>flow_summary : pd.DataFrame<br>\nSummarized flows grouped by ASN</p>\n</li>\n<li>\n<p>ti_results : pd.DataFrame<br>\nThreat Intelligence results for selected IP Addreses.</p>\n</li>\n<li>\n<p>geo_map : foliummap.FoliumMap<br>\nFolium map showing locations of all IP Addresses.</p>\n</li>\n<li>\n<p>geo_map_selected : foliummap.FoliumMap<br>\nFolium map showing locations of selected IP Addresses.</p>\n</li>\n</ul>\n<hr />\n<h1>Methods</h1>\n<h2>Instance Methods</h2>\n<h3>__init__</h3>\n<p>__init__(self, data_providers:Union[&lt;msticnb.data_providers.SingletonDecorator object at 0x00000223E99C63C8&gt;, NoneType]=None, **kwargs)<br>\nIntialize a new instance of the notebooklet class.</p>\n<h3>lookup_ti_for_asn_ips</h3>\n<p>lookup_ti_for_asn_ips(self)<br>\nLookup Threat Intel data for IPs of selected ASNs.</p>\n<h3>run</h3>\n<p>run(self, value:Any=None, data:Union[pandas.core.frame.DataFrame, NoneType]=None, timespan:Union[msticnb.common.TimeSpan, NoneType]=None, options:Union[Iterable[str], NoneType]=None, **kwargs) -&gt; msticnb.nb.azsent.network.network_flow_summary.NetworkFlowResult<br>\nReturn host summary data.</p>\n<h3>select_asns</h3>\n<p>select_asns(self)<br>\nShow interactive selector to choose which ASNs to process.</p>\n<h3>show_selected_asn_map</h3>\n<p>show_selected_asn_map(self) -&gt; msticpy.nbtools.foliummap.FoliumMap<br>\nDisplay map of IP locations for selected ASNs.</p>\n<h2>Inherited methods</h2>\n<h3>get_provider</h3>\n<p>get_provider(self, provider_name:str)<br>\nReturn data provider for the specified name.</p>\n<h2>Other Methods</h2>\n<h3>all_options</h3>\n<p>all_options() -&gt; List[str]<br>\nReturn supported options for Notebooklet run function.</p>\n<h3>default_options</h3>\n<p>default_options() -&gt; List[str]<br>\nReturn default options for Notebooklet run function.</p>\n<h3>description</h3>\n<p>description() -&gt; str<br>\nReturn description of the Notebooklet.</p>\n<h3>entity_types</h3>\n<p>entity_types() -&gt; List[str]<br>\nEntity types supported by the notebooklet.</p>\n<h3>get_help</h3>\n<p>get_help(fmt=&#x27;html&#x27;) -&gt; str<br>\nReturn HTML document for class.</p>\n<h3>get_settings</h3>\n<p>get_settings(print_settings=True) -&gt; Union[str, NoneType]<br>\nPrint or return metadata for class.</p>\n<h3>import_cell</h3>\n<p>import_cell()<br>\nImport the text of this module into a new cell.</p>\n<h3>keywords</h3>\n<p>keywords() -&gt; List[str]<br>\nReturn search keywords for Notebooklet.</p>\n<h3>list_options</h3>\n<p>list_options() -&gt; str<br>\nReturn default options for Notebooklet run function.</p>\n<h3>match_terms</h3>\n<p>match_terms(search_terms:str) -&gt; Tuple[bool, int]<br>\nSearch class definition for <code>search_terms</code>.</p>\n<h3>name</h3>\n<p>name() -&gt; str<br>\nReturn name of the Notebooklet.</p>\n<h3>result</h3>\n<p>result [property]\nReturn result of the most recent notebooklet run.</p>\n<h3>show_help</h3>\n<p>show_help()<br>\nDisplay Documentation for class.</p>\n<h3>silent</h3>\n<p>silent [property]\nGet the current instance setting for silent running.</p>"
      }
     },
     "8407a907ebfd4144a321fa63d25aeb71": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "88f8e7976f9d4f0da93266afe7d07fc0": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": ""
      }
     },
     "89dd79c579a54fe4a1d5eb47570aed48": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "IntRangeSliderModel",
      "state": {
       "_model_name": "IntRangeSliderModel",
       "_view_name": "IntRangeSliderView",
       "description": "Time Range (day):",
       "layout": "IPY_MODEL_767b958d0f924a568c9d4c01a937f051",
       "max": 7,
       "min": -20,
       "style": "IPY_MODEL_bf92af78bffc42c084d0f7122d427755",
       "value": [
        -10,
        1
       ]
      }
     },
     "8bd97f7450b84901a5743f6feb648364": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": ""
      }
     },
     "8c3d4b88fb9b4ddda792de933d5dfe48": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "8d3cd3464e7a43afaaa3db3da5c4c686": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "VBoxModel",
      "state": {
       "children": [
        "IPY_MODEL_625310aebbe24142b3e2ba10e0c4e176",
        "IPY_MODEL_d00d1b1b47fe4c788ffd8f6e8a7592e2",
        "IPY_MODEL_a97a5a986285453d98636dbf18e3dff9"
       ],
       "layout": "IPY_MODEL_9f62870854464ee7a8813302a28699a6"
      }
     },
     "8d9c49c7d59948baadd9827581aa1dbf": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "8ef535166d9e4de0b911e192033d0c7d": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "9048c276e8474b6c85d3a9451fbe04d3": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "954d68ac6fbb42328d34d4b1a31dffc0": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": "initial"
      }
     },
     "96239c87477a49c2b9cab4b69c6d0b6c": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "9f62870854464ee7a8813302a28699a6": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "a144f13f57ad436b9ed6674edb9c4f73": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "a25453c687ca4158bb82e7659373ad5c": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "TextModel",
      "state": {
       "description": "Query start time (UTC):",
       "layout": "IPY_MODEL_c83f06723cf341ea85c17c48577afaf8",
       "style": "IPY_MODEL_954d68ac6fbb42328d34d4b1a31dffc0",
       "value": "2019-01-31 00:00:00"
      }
     },
     "a2762d95d7ee4dd0a1d71e663192d2ab": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "AccordionModel",
      "state": {
       "_titles": {
        "0": "Full class details",
        "1": "run() method documenation",
        "2": "Sample code"
       },
       "children": [
        "IPY_MODEL_81fe09b8676241028af1216129f848ed",
        "IPY_MODEL_3f26503797fa469f87b5f11974f48cef",
        "IPY_MODEL_589d9298e2d24d6ca2a2c25afee00595"
       ],
       "layout": "IPY_MODEL_74d86bb16e364ecaad127170d9df0e4d",
       "selected_index": 2
      }
     },
     "a3803c76f9de4567a9c4a226bb9719cc": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "SliderStyleModel",
      "state": {
       "description_width": "initial"
      }
     },
     "a577ffbfa39f4e6080443277d1ce8fe9": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": ""
      }
     },
     "a81dc0f76ee54724a0c1c40254bf27c6": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "border": "1px solid lightgray",
       "margin": "0px 0px 0px 10px",
       "width": "60%"
      }
     },
     "a97a5a986285453d98636dbf18e3dff9": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "TextModel",
      "state": {
       "description": "Query end time (UTC) :  ",
       "layout": "IPY_MODEL_be7cd0e54a33473a9db266e40457377f",
       "style": "IPY_MODEL_0ac0eba6188d4e0c997bc7ca88a302bd",
       "value": "2019-02-11 00:00:00"
      }
     },
     "b50be47e69e84afbb9c4689f5bba4225": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "ButtonModel",
      "state": {
       "description": "Insert code example",
       "layout": "IPY_MODEL_8ef535166d9e4de0b911e192033d0c7d",
       "style": "IPY_MODEL_34d280e2f5d044dd8683d24cf5b634ef"
      }
     },
     "b88494c76b0b4cd090211faf81656654": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "VBoxModel",
      "state": {
       "children": [
        "IPY_MODEL_ca29e3f4697c42d9ba56e973d67a2cd1",
        "IPY_MODEL_7ed8329615be42b798b990ae8fcc5a5e",
        "IPY_MODEL_fe049406389448559dbd9427827361de"
       ],
       "layout": "IPY_MODEL_96239c87477a49c2b9cab4b69c6d0b6c"
      }
     },
     "bda072a27c4d488099422fa887b5b03c": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "bda48c59266a4eb1b8363ecca7e42a59": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "HBoxModel",
      "state": {
       "children": [
        "IPY_MODEL_76bbef7126114766ba1f33dbcf8b8c30",
        "IPY_MODEL_3ef3e93f494745a198f27a79390b9c53"
       ],
       "layout": "IPY_MODEL_8407a907ebfd4144a321fa63d25aeb71"
      }
     },
     "be7cd0e54a33473a9db266e40457377f": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "50%"
      }
     },
     "bf92af78bffc42c084d0f7122d427755": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "SliderStyleModel",
      "state": {
       "description_width": "initial"
      }
     },
     "c7a77de50c5248a4b6af3c7c83b71bb4": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "HBoxModel",
      "state": {
       "children": [
        "IPY_MODEL_0324f5cb01fb493bbbef3c6b22141087",
        "IPY_MODEL_dcd3c7b644c745339ed2659a9e55c3c9"
       ],
       "layout": "IPY_MODEL_9048c276e8474b6c85d3a9451fbe04d3"
      }
     },
     "c83f06723cf341ea85c17c48577afaf8": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "50%"
      }
     },
     "ca29e3f4697c42d9ba56e973d67a2cd1": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "IntRangeSliderModel",
      "state": {
       "_model_name": "IntRangeSliderModel",
       "_view_name": "IntRangeSliderView",
       "description": "Time Range (day):",
       "layout": "IPY_MODEL_525c58f2ced54803989fc196fc95393e",
       "max": 7,
       "min": -20,
       "style": "IPY_MODEL_2ae21918228f4ef5a0a2a8133f4f1743",
       "value": [
        -10,
        1
       ]
      }
     },
     "d00d1b1b47fe4c788ffd8f6e8a7592e2": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "TextModel",
      "state": {
       "description": "Query start time (UTC):",
       "layout": "IPY_MODEL_d46cbe606917417c8010ec7e848a40d4",
       "style": "IPY_MODEL_69e826c983184a099e2b1d68e8fd454e",
       "value": "2019-01-31 00:00:00"
      }
     },
     "d138294780914cf49791558ef1b1f138": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "95%"
      }
     },
     "d13f1d4a92c5402ba69db7b7f74234be": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": ""
      }
     },
     "d45cf48ff33d44bb9026c14d4ad0479f": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": ""
      }
     },
     "d46cbe606917417c8010ec7e848a40d4": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "50%"
      }
     },
     "d66e9579979641a8a436a0eff5a2f2f3": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "dcd3c7b644c745339ed2659a9e55c3c9": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "HTMLModel",
      "state": {
       "layout": "IPY_MODEL_a81dc0f76ee54724a0c1c40254bf27c6",
       "style": "IPY_MODEL_ded0e5cbd9a241f2b41d3c9fcd24d94b",
       "value": "<h1>NetworkFlowSummary</h1><p>Network Flow Summary Notebooklet class.</p>\n<p>Queries network data and plots time lines for network\ntraffic to/from a host or IP address.</p>\n<ul>\n<li>Plot flows events by protocol and direction</li>\n<li>Plot flow count by protocol</li>\n<li>Display flow summary table</li>\n<li>Display flow summary by ASN</li>\n<li>Display results on map</li>\n</ul>\n<h2>Methods</h2>\n<ul>\n<li>run: main method for notebooklet.</li>\n<li>select_asns: Open an interactive dialog to choose which ASNs to\n  investigate further.</li>\n<li>lookup_ti_for_asn_ips: For selected ASNs, lookup Threat Intelligence\n  data for the IPs belonging to those ASNs.</li>\n<li>show_selected_asn_map: Show IP address locations for selected IP\n  (including any threats highlighted)</li>\n</ul>\n<h2>Default Options</h2>\n<ul>\n<li>plot_flows: Create plots of flows by protocol and direction.</li>\n<li>plot_flow_values: Plot flow county by protocol.</li>\n<li>flow_summary: Create a summarization of all flows and all flows grouped by ASN.</li>\n</ul>\n<h2>Other Options</h2>\n<ul>\n<li>resolve_host: Try to resolve the host name before other operations.</li>\n<li>geo_map: Plot a map of all IP address locations in communication with the host (see the method below for plotting selected IPs only).</li>\n</ul>"
      }
     },
     "dea26abe18b04225842ff023af36282f": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "HBoxModel",
      "state": {
       "children": [
        "IPY_MODEL_61e88f1f4cce4ea7b7e22155c03fca25",
        "IPY_MODEL_e72cfb7b4e4f4acebd5042b54d0fc541"
       ],
       "layout": "IPY_MODEL_40a7efb5c8c74d8a88c40ffe5d39bf91"
      }
     },
     "deb2e57255264b5591eb172b2080ec7f": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": ""
      }
     },
     "ded0e5cbd9a241f2b41d3c9fcd24d94b": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": ""
      }
     },
     "e2a80820cb6a4ad2b390faca85e4935b": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "e5b8bed440414bd2838ad2b46c552d9f": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {}
     },
     "e72cfb7b4e4f4acebd5042b54d0fc541": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "TextModel",
      "state": {
       "description": "Time (24hr)",
       "layout": "IPY_MODEL_8c3d4b88fb9b4ddda792de933d5dfe48",
       "style": "IPY_MODEL_88f8e7976f9d4f0da93266afe7d07fc0",
       "value": "00:00:00"
      }
     },
     "ecdc32f70c2948e29c88d64fb7e429e3": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "TextModel",
      "state": {
       "description": "Query end time (UTC) :  ",
       "layout": "IPY_MODEL_38c3500044ef4020887d4a490076e5f0",
       "style": "IPY_MODEL_080aeeb063ce4dafbb1acc0ffedd74bf",
       "value": "2019-02-11 00:00:00"
      }
     },
     "f59bbc4d857f4f999fc7ab3159bda87e": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "VBoxModel",
      "state": {
       "children": [
        "IPY_MODEL_c7a77de50c5248a4b6af3c7c83b71bb4",
        "IPY_MODEL_a2762d95d7ee4dd0a1d71e663192d2ab"
       ],
       "layout": "IPY_MODEL_3208d92410d34e9ebed656201a26a6ac"
      }
     },
     "fa4edae945364a65a4935eb520685c88": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "DescriptionStyleModel",
      "state": {
       "description_width": ""
      }
     },
     "fc5f422f4ae44202809300b5aef4a761": {
      "model_module": "@jupyter-widgets/base",
      "model_module_version": "1.2.0",
      "model_name": "LayoutModel",
      "state": {
       "width": "100%"
      }
     },
     "fe049406389448559dbd9427827361de": {
      "model_module": "@jupyter-widgets/controls",
      "model_module_version": "1.5.0",
      "model_name": "TextModel",
      "state": {
       "description": "Query end time (UTC) :  ",
       "layout": "IPY_MODEL_603de6e9c9024f4787ab3422b24ae185",
       "style": "IPY_MODEL_60a2cd7ea94d470ba09c174a0be601a5",
       "value": "2019-02-11 00:00:00"
      }
     }
    },
    "version_major": 2,
    "version_minor": 0
   }
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}