microsoft / msticpy

Microsoft Threat Intelligence Security Tools
Other
1.78k stars 321 forks source link

Add Panel Perspective Widget for Pivot Table Functionality #683

Open Cyb3r-Monk opened 1 year ago

Cyb3r-Monk commented 1 year ago

Pivot tables in Excel are useful for investigation. Panel library has Perspective widget that turns a data frame into an interactive pivot table where you can select columns and aggregate functions and turn the data into a pivot table quickly. It would be nice to have the functionality in MSTICPy.

ianhelle commented 1 year ago

I had a look through the panel and perspective docs and there was quite a lot there. Wondered if you had a few use cases in mind that would be worth creating generic wrappers for. E.g. what startup params to use of columns, what kind of aggregation functions, etc. Not fully sure I fully follow how it is meant to be used.

Cyb3r-Monk commented 1 year ago

The main use case for us as defenders is to easily apply group by, split by and aggregate without writing the code over and over again and see what happens. The Perspective widget makes it so easy by enabling drag and drop the columns and selecting the aggregations, etc. It's quite similar to the Pivot mode on Sentinel query results table.