def _create_session_browser(summ_data, data, column_map):
browse_cols = [
column_map[COL_ACCT],
column_map[COL_TS],
column_map[COL_SESS],
column_map[COL_PID],
column_map[COL_PROC],
column_map[COL_CMD],
]
if "ParentProcessName" in data:
browse_cols.append("ParentProcessName")
browse_cols.append("Rarity")
item_dict = {
f"{item[1]} - {item[0]}, mean rarity: {item[2]}": item[0]
for item in summ_data[
[column_map[COL_SESS], column_map[COL_ACCT], "MeanRarity"]].values
}
def show_events(logon_id):
return (data[browse_cols].query(
f"{column_map[COL_SESS]} == '{logon_id}'").sort_values(
column_map[COL_TS]))
return nbwidgets.SelectItem(item_dict=item_dict, action=show_events)
def _get_bookmark_select(bookmarks_df):
"""Create and return Selector for bookmarks."""
opts = dict(
bookmarks_df.apply(
lambda x: (
f"{x.BookmarkName} - LastUpdated {x.LastUpdatedTime}",
x.BookmarkId,
),
axis=1,
).values)
def display_bookmark(bookmark_id):
return pd.DataFrame(data=bookmarks_df[bookmarks_df["BookmarkId"] ==
bookmark_id].iloc[0].T).rename(
columns={0: "value"})
return nbwidgets.SelectItem(item_dict=opts,
action=display_bookmark,
height="200px",
width="100%")
def _get_account_selector(qry_prov, all_acct_dfs: pd.DataFrame, result,
timespan, options, geoip):
"""Build and return the Account Select list."""
action_func = _create_display_callback(
qry_prov=qry_prov,
all_acct_dfs=all_acct_dfs,
result=result,
timespan=timespan,
options=options,
geoip=geoip,
)
acct_index_df = _create_account_index(all_acct_dfs)
accts_dict = _get_select_acct_dict(acct_index_df)
return nbwidgets.SelectItem(
item_dict=accts_dict,
description="Select an account to explore",
action=action_func,
height="200px",
width="100%",
)