We Keep Coding

Getting error while running the configuring MSTICPY on Azure sentinel notebook

I am using Azure sentinel notebook for threat intelligence. While trying to configure msticpy for it to connect to Azure sentinel but getting 'Value error'. Following is the code that I am using :
from msticpy.config import MpConfigEdit
import os
mp_conf = "msticpyconfig.yaml"
# check if MSTICPYCONFIG is already an env variable
mp_env = os.environ.get("MSTICPYCONFIG")
mp_conf = mp_env if mp_env and Path (mp_env).is_file() else mp_conf
if not Path(mp_conf).is_file():
print(
"No msticpyconfig.yaml was found!",
"Please check that there is a config.json file in your workspace folder.",
"If this is not there, go back to the Microsoft Sentinel portal and launch",
"this notebook from there.",
sep="\n"
)
else:
mpedit = MpConfigEdit(mp_conf)
mpedit.set_tab("AzureSentinel")
display(mpedit)
ValueError: File not found: 'None'.

In the Azure ML terminal, create the nbuser_settings.py file in the root of your user folder, which is the folder with your username.
In the nbuser_settings.py file, add the following lines:
import os
os.environ["MSTICPYCONFIG"] = "~/msticpyconfig.yaml"
https://learn.microsoft.com/en-us/Azure/sentinel/notebooks-msticpy-advanced?msclkid=e7cd84dfd05c11ecb0df15e0892300fc&tabs=azure-ml
Reference
Some elements of MSTICPy require configuration parameters. An example is the Threat Intelligence providers. Values for these and other parameters can be set in the msticpyconfig.yaml file.
The package has a default configuration file, which is stored in the package directory. You should not need to edit this file directly. Instead you can create a custom file with your own parameters - these settings will combine with or override the settings in the default file.
By default, the custom msticpyconfig.yaml is read from the current directory. You can specify an explicit location using an environment variable MSTICPYCONFIG.
You should also read the MSTICPy Settings Editor document to see how to configure settings using and interactive User Interface from a Jupyter notebook.
!!! NOTE !!! For the Linux and Windows options, you'll need to restart your Jupyter server for it to pick up the environment variable that you defined.
https://msticpy.readthedocs.io/en/latest/getting_started/msticpyconfig.html?msclkid=96fde57dd04d11ec9e5406de243d7c67

The author of msticpy has posted the issue on github & we have to wait for the latest release. Please follow the thread for more details:
https://github.com/microsoft/msticpy/issues/393

Interactive Python Execution in NPP

I've made a bunch of tweaks to NPP following this guide, and so far it's gone over well.
But I have a somewhat annoying problem. I want to use input commands in my code.
If the console is closed, this isn't a problem—it pops up and I can type right away in the input field just fine, no clicking.
But when I edit the code and re-run the script (without closing the console), the console clears and runs the program, but I have to click over to be able to interact.
I don't want to close the NppExec console every time I finish the script.
I don't want to have to click over on the console every time I run the script.
As a bonus, I don't want to have to kill my script every time I run it again, either.
I just want to run, type required inputs, go back to editing, re-run, type, etc. without interruptions, if possible..
Can anyone help me with this?
Thank you....

Please check the NppExec Manual for NppExec ver. 0.6 RC2. It includes a lovely script in the section "4.6.4. Running Python & wxPython":
npp_console - // disable any output to the Console
npp_save // save current file (a .py file is expected)
cd "$(CURRENT_DIRECTORY)" // use the current file's dir
set local #exit_cmd_silent = exit() // allows to exit Python automatically
set local PATH_0 = $(SYS.PATH) // current value of %PATH%
env_set PATH = $(SYS.PATH);C:\Python27 // use Python 2.7
npp_setfocus con // set the focus to the Console
npp_console + // enable output to the Console
python -i -u "$(FILE_NAME)" // run Python's program interactively
npp_console - // disable any output to the Console
env_set PATH = $(PATH_0) // restore the value of %PATH%
npp_console + // enable output to the Console
The command
npp_setfocus con
looks like the one you are looking for.

Python 2.6 pxssh Password GUI spawned on login failure

Before I get into the details, I have already attempted the solution from this question with no success.
I am trying to use the pxssh module within pexpect to SSH to a remote system and collect the uptime data. However, whenever I enter the incorrect password, the script generates a GUI password prompt for openSSH.
The script will query a large number of systems and write the output to a log, so I want it to just write a note in the log whenever the SSH connection fails; I don't want it to ever pop up a window.
Here is the current code of the function:
def getUptime(ipAddr, passwd):
try:
os.unsetenv('SSH_ASKPASS')
ssh = px.pxssh.pxssh()
ssh.options={"NumberOfPasswordPrompts":"1"}
ssh.force_password=True
ssh.options = {'RequestTTY':'Force'}
ssh.login(ipAddr,"root",passwd,auto_prompt_reset=False)
ssh.sendline("uptime")
ssh.prompt()
uptime = ssh.before.split()
ssh.logout()
uptime = ' '.join(uptime[uptime.index('up'):]).split(',')[0].strip('up')
return(uptime)
except(px.pxssh.ExceptionPxssh):
return("SSH connection failed; double-check the password")
I apologize if there are typos in that code, I had to re-type it by hand since Virtualbox is not letting me copy and paste from my development environment (SLES 11 x64, if that matters), even with bidirectional clipboard enabled.
I have tried the following steps (some of which are visible above):
Set ssh.force_password=True
Set ssh.options = {'RequestTTY':'Force'} (This should be equivalent to using "-t" in the SSH CLI argument, if I understand the openSSH documentation)
Set auto_prompt_reset=False
Edit pxssh.py to set "ssh_options" from '' to '-t -x' (I tried each option separately, then both together).
Manually unset SSH_ASKPASS in the shell before running the script.
Unset SSH_ASKPASS with os.unsetenv() immediately before invoking pxssh within the script.
Set the "NumberOfPasswordPrompts" option to "1".
The observed behavior when it gets an incorrect password is that it will print "SSH connection failed..." as expected, but it will also popup the openSSH password window.
None of those listed steps has had any noticeable effect on the script's performance whatsoever, and most of my Google searches on this issue point back to that linked question. If anyone has any idea of how I can possibly 100% suppress that password window, I would very much appreciate the assistance.
Thank you all in advance for your advice.
Potential Solution
I've found that I can keep the window from popping up by taking the following steps:
In pxssh.py change ssh_options from '' to "-o 'NumberOfPasswordPrompts=1'"
In my script, catch pexpect.EOF along with pexpect.pxssh.ExceptionPxssh to determine when a password has failed.
I'm not accepting this as an answer just yet because it seems like a very poor solution to me, particularly editing pxssh.py. I attempted to set the NumberOfPasswordPrompts option within my script, but it has no effect, so I must have the incorrect syntax.

You don't need to update pxssh.py at all. Instead:
ssh = px.pxssh.pxssh()
ssh.force_password = True
ssh.SSH_OPTS = "-o 'NumberOfPasswordPrompts=1'"

I had this problem quite a while ago, see if this helps. Python PXSSH GUI spawn on login failure
If not then trying opening the pxsssh module in you python library. If I remember correctly theres an issue that's explained in the __init__ where all you need to do is comment a line and uncomment a line.
Edit:
In the pexpect package theres the pxssh.py file, open it up and look at line 115 there should be your fix. Heres what your looking for
path: /usr/lib/python2.7/dist-packages/pexpect/pxssh.py
# Comment this line
self.SSH_OPTS = ("-o'RSAAuthentication=no'"
+ " -o 'PubkeyAuthentication=no'")
# Disabling host key checking, makes you vulnerable to MITM attacks.
# + " -o 'StrictHostKeyChecking=no'"
# + " -o 'UserKnownHostsFile /dev/null' ")
# Disabling X11 forwarding gets rid of the annoying SSH_ASKPASS from
# displaying a GUI password dialog. I have not figured out how to
# disable only SSH_ASKPASS without also disabling X11 forwarding.
# Unsetting SSH_ASKPASS on the remote side doesn't disable it! Annoying!
# UNCOMMENT THE LINE BELOW
#self.SSH_OPTS = "-x -o'RSAAuthentication=no' -o 'PubkeyAuthentication=no'"
self.force_password = False
self.auto_prompt_reset = True
I haven't used the pxssh module in quite sometime. But I think you can find away to override the SSH_OPTS so that you don't need to physically modify the module.

how to include NSUserNotificationCenter in py2app

I am making an app in python 2.7 on mac osx 10.8.5 I want to show notification number of times, therefore using NSUserNotificationCenter. Notifications are coming while running code on eclipse. But, the issue is when I made app using py2app, Notifications are not coming. Moreover, the default page of error of open console and Terminate is coming. Please suggest some way, how to include Notification in dist generated by py2app, so that It will work on any other machine.
My setup.py is
from setuptools import setup
APP=['CC4Box.py']
DATA_FILES= [('',['config.cfg'])]
OPTIONS={'iconfile':'cc.icns','argv_emulation': True,'plist':{'CFBundleShortVersionString':'1.0'}}
setup(
app=APP,
data_files=DATA_FILES,
options={'py2app': OPTIONS},
setup_requires=['py2app']
)
My notification code is:
def notify(title, subtitle, info_text, delay=0, sound=False, userInfo={}):
NSUserNotification = objc.lookUpClass('NSUserNotification')
NSUserNotificationCenter = objc.lookUpClass('NSUserNotificationCenter')
notification = NSUserNotification.alloc().init()
notification.setTitle_(title)
notification.setSubtitle_(subtitle)
notification.setInformativeText_(info_text)
notification.setUserInfo_(userInfo)
if sound:
notification.setSoundName_("NSUserNotificationDefaultSoundName")
notification.setDeliveryDate_(Foundation.NSDate.dateWithTimeInterval_sinceDate_(delay, Foundation.NSDate.date()))
NSUserNotificationCenter.defaultUserNotificationCenter().scheduleNotification_(notification)
def notificationBalloon(title,msg):
notify(title1, msg1,"", sound=False)
On eclipse, notifications are coming as expected, however, import error produced in lines:
NSUserNotification = objc.lookUpClass('NSUserNotification')
NSUserNotificationCenter = objc.lookUpClass('NSUserNotificationCenter')
but in terminal these lines are nicely run.

My guess is, .lookUpClass() should be resolved at runtime. Thus you don't actually want to include that class in your py2app. Unless you wrote this class yourself that it.
What you do want to include is objc and related libraries. Make sure it's in your virtualenv when you call py2app. If python -m pydoc objc works, so should python setup.py py2app.

If you are trying to create a pop-up window to notify the user of certain information, there are plenty of python modules for this purpose. Wx python is a good choice. Here is the documentation for pop-up windows:
http://wxpython.org/docs/api/wx.PopupWindow-class.html
EDIT: That won't get an apple notification in the way you want. Try this code. It uses a downloadable command line tool called terminal-notifier to make notifications, accessed through python via sub process:
import subprocess
def notification(title, subtitle, message):
subprocess.Popen(['terminal-notifier','-message',message,'-title',title,'-subtitle',subtitle])
notification(title = 'notification title', subtitle = 'subtitle', message = 'Hello World')
This should get the results you want, although to install it automatically you need to run a build in ruby. You could also get it to play sounds, change some ID parameters, and even tell it to run a shell command when you click on it. For more information go here, this is where you can get the source and the docs:
https://github.com/julienXX/terminal-notifier

Is there any way to modify the pydevd_file_utils.PATHS_FROM_ECLIPSE_TO_PYTHON value without having to modify that file?

I am using the pydev plugin to debug a remote application.
This (remote) application has a structure of files that differs from the structure where my Eclipse is running. This leads to problems when I set the breakpoints from the Eclipse IDE because the pydev debugger server cannot match the absolute path of the file with the file on the remote application and hence the breakpoint isn´t hit.
I dont want to hardcode the pydevd_file_utils.PATHS_FROM_ECLIPSE_TO_PYTHON constant to enable filepath translations.
Do you know some way to modify this value without changing the file?
Thanks!

There are 2 ways of setting the path translation:
Use an environment variable such as PATHS_FROM_ECLIPSE_TO_PYTHON that maps the paths from the client to the server side.
The value is a json string with a list(list(str, str)) such that:
PATHS_FROM_ECLIPSE_TO_PYTHON=[["c:/local/path", "/path/in/server"]]
Note that you may set the environment variable in any place you'd like (such as the Environment tab in the Python interpreter preferences page, in the OS itself, in the launch config, etc).
Use the pydevd API to set the tracing at runtime from the python process:
from pydevd_file_utils import setup_client_server_paths
MY_PATHS_FROM_ECLIPSE_TO_PYTHON = [
('/home/user/local-project', '/remote/path/to/project'),
]
setup_client_server_paths(MY_PATHS_FROM_ECLIPSE_TO_PYTHON)
# At this point we could connect to the remote debugger client with:
import pydevd
pydevd.settrace("10.0.0.12")
See: https://www.pydev.org/manual_adv_remote_debugger.html for more info on the Remote Debugging.
Note: the mapping set in Window > Preferences select PyDev > Debug > Source Locator doesn't really map to that environment variable nor the actual debugger mapping (that's a separate translation that only translates paths which are found on Eclipse locally and it's not really passed on to the debugger to hit breakpoints remotely).

You can do that by setting a new environment variable like this:
PATHS_FROM_ECLIPSE_TO_PYTHON='[["client_src_fullpath", "remote_src_fullpath"]]'
In linux simply run that before starting the program from the command line, or set is as a global variable.
In windows you will need to set it as a global system variable.
Variable name: PATHS_FROM_ECLIPSE_TO_PYTHON
Variable value: [["client_src_path", "remote_src_path"]]
As an alternative, you can also do this in code, BUT you need to do it BEFORE you import pydevd:
import os
os.environ.setdefault("PATHS_FROM_ECLIPSE_TO_PYTHON",'[["client_src_path","remote_src_path"]]')
import pydevd
pydevd.settrace("10.0.2.2", port=5678,stdoutToServer=True, stderrToServer=True, suspend=False,patch_multiprocessing=True)
(I'm aware this is a very old question, but none of the answers were updated to the current code)

Unfortunately there is no good way to do that.
As a workaround I explicitly replaced function NormFileToServer by adding the following code at the beginning of my source file.
def SrcPathMapping(file):
eclipse_src_path = 'C:\\tmp\\workspace\\test\\Scripts\\'
server_src_path = '/home/tester/test/Scripts/'
return file.replace(eclipse_src_path, server_src_path)
import pysrc.pydevd as pydevd
pydevd.NormFileToServer = SrcPathMapping
This simplistic mapping is sufficient when all source files are located in one directory. For proper implementation of the mapping function check NormFileToServer in the pydevd_file_utils.