Getting error while running the configuring MSTICPY on Azure sentinel notebook

Question

I am using Azure sentinel notebook for threat intelligence. While trying to configure msticpy for it to connect to Azure sentinel but getting 'Value error'. Following is the code that I am using :

from msticpy.config import  MpConfigEdit
import os

mp_conf = "msticpyconfig.yaml"

# check if MSTICPYCONFIG is already an env variable
mp_env = os.environ.get("MSTICPYCONFIG")
mp_conf = mp_env if mp_env and Path (mp_env).is_file() else mp_conf

if not Path(mp_conf).is_file():
print(
    "No msticpyconfig.yaml was found!",
    "Please check that there is a config.json file in your workspace folder.",
    "If this is not there, go back to the Microsoft Sentinel portal and launch",
    "this notebook from there.",
    sep="\n"
   )
else:
   mpedit = MpConfigEdit(mp_conf)
   mpedit.set_tab("AzureSentinel")
   display(mpedit)

ValueError: File not found: 'None'.

Answer 1

The author of msticpy has posted the issue on github & we have to wait for the latest release. Please follow the thread for more details:

https://github.com/microsoft/msticpy/issues/393

Answer 2

In the Azure ML terminal, create the nbuser_settings.py file in the root of your user folder, which is the folder with your username.

In the nbuser_settings.py file, add the following lines:

import os
  os.environ["MSTICPYCONFIG"] = "~/msticpyconfig.yaml"

https://learn.microsoft.com/en-us/Azure/sentinel/notebooks-msticpy-advanced?msclkid=e7cd84dfd05c11ecb0df15e0892300fc&tabs=azure-ml

Reference

Some elements of MSTICPy require configuration parameters. An example is the Threat Intelligence providers. Values for these and other parameters can be set in the msticpyconfig.yaml file.

The package has a default configuration file, which is stored in the package directory. You should not need to edit this file directly. Instead you can create a custom file with your own parameters - these settings will combine with or override the settings in the default file.

By default, the custom msticpyconfig.yaml is read from the current directory. You can specify an explicit location using an environment variable MSTICPYCONFIG.

You should also read the MSTICPy Settings Editor document to see how to configure settings using and interactive User Interface from a Jupyter notebook.

!!! NOTE !!! For the Linux and Windows options, you'll need to restart your Jupyter server for it to pick up the environment variable that you defined.

https://msticpy.readthedocs.io/en/latest/getting_started/msticpyconfig.html?msclkid=96fde57dd04d11ec9e5406de243d7c67