Search¶

The search module provides a set of classes for finding and aggregating events stored within DynamiteNSM.

The Search Interface¶

The Search class provides a method for retrieving events or baseline intervals between a start and end date.

class dynamite_sdk.search.Search(index, as_dataframe=False)[source]¶
execute_query(start: datetime.datetime, end: datetime.datetime, search_filter=None)[source]¶

Executes a search query, stores the results in events instance variable

Parameters
  • start – The start time-frame

  • end – The end time-frame

  • search_filter – An optional search filter

Returns

None

Check out these search examples.

The Pivot Interfaces¶

Events generated by Zeek often have relationships with other events generated around the same time.

For example, a TCP session (represented in Zeek’s conn.log may have several corresponding HTTP events. The pivot interface allows the user the ability to easily locate these corresponding events.

Check out these pivot examples.

ConnectionEventToNetworkEventsPivot¶

class dynamite_sdk.search.ConnectionEventToNetworkEventsPivot(event: dynamite_sdk.objects.events.Event, as_dataframe=False)[source]¶

Provides an interface from a connection event to the corresponding network-event(s) (sub-event)

NetworkEventToConnectionEventPivot¶

class dynamite_sdk.search.NetworkEventToConnectionEventPivot(event: dynamite_sdk.objects.events.Event, as_dataframe=False)[source]¶

Provides an interface from pivoting from some network-event (sub-event) to the corresponding connection event

dynamite_sdk

Navigation

Installation/QuickStart

  • Installation

Libraries

  • Search
    • The Search Interface
    • The Pivot Interfaces
      • ConnectionEventToNetworkEventsPivot
      • NetworkEventToConnectionEventPivot
  • Intervals
  • Events

Related Topics

  • Documentation overview
    • Previous: Installation
    • Next: Intervals

Quick search

©2019, Jamin Becker. | Powered by Sphinx 2.2.1 & Alabaster 0.7.12 | Page source