microsoft / msticpy

Microsoft Threat Intelligence Security Tools
Other
1.72k stars 310 forks source link

Enable query caching #756

Open FlorianBracq opened 4 months ago

FlorianBracq commented 4 months ago

Hello,

this is a WIP of the caching mechanism, heavily inspired by @rcobb-scwx work!

To test it, you can add the parameter "cache_path" to your query: import msticpy as mp prov: mp.QueryProvider = mp.QueryProvider("LogAnalytics") prov.connect() data = prov.Azure.list_aad_signins_for_account(cache_path=<PATH_TO_CACHE>) If it is executed from a notebook, and PATH_TO_CACHE is the path to the notebook, the cell's output will contain:

If it is executed outside of a notebook, the same data will be stored in the file provided in cache_path

The path to the notebook is required as the kernel does not know which file it is receiving inputs from, hence cannot know which cell output to read to find the cached data

Things to be done: