in msticpy/nbtools/timeline.py [0:0]
def _display_timeline_dict(data: dict, **kwargs) -> figure: # noqa: C901, MC0001
"""
Display a timeline of events.
Parameters
----------
data : dict
Data points to plot on the timeline.
Need to contain:
Key - Name of data type to be displayed in legend
Value - dict of data containing:
data : pd.DataFrame
Data to plot
time_column : str
Name of the timestamp column
source_columns : list
List of source columns to use in tooltips
color: str
Color of datapoints for this data
Other Parameters
----------------
ref_time : datetime, optional
Input reference line to display (the default is None)
title : str, optional
Title to display (the default is None)
time_column : str, optional
Name of the timestamp column
(the default is 'TimeGenerated')
legend: str, optional
Where to position the legend
None, left, right or inline (default is None)
yaxis : bool, optional
Whether to show the yaxis and labels
range_tool : bool, optional
Show the the range slider tool (default is True)
source_columns : list, optional
List of default source columns to use in tooltips
(the default is None)
height : int, optional
The height of the plot figure
(the default is auto-calculated height)
width : int, optional
The width of the plot figure (the default is 900)
ref_events : pd.DataFrame, optional
Add references line/label using the event times in the dataframe.
(the default is None)
ref_time_col : str, optional
Add references line/label using the this column in `ref_events`
for the time value (x-axis).
(this defaults the value of the `time_column` parameter or 'TimeGenerated'
`time_column` is None)
ref_col : str, optional
The column name to use for the label from `ref_events`
(the default is None)
ref_times : List[Tuple[datetime, str]], optional
Add one or more reference line/label using (the default is None)
Returns
-------
figure
The bokeh plot figure.
"""
reset_output()
output_notebook()
height: int = kwargs.pop("height", None)
width: int = kwargs.pop("width", 900)
ref_time: Any = kwargs.pop("ref_time", None)
ref_label: str = kwargs.pop("ref_label", None)
title: str = kwargs.pop("title", None)
legend_pos: str = kwargs.pop("legend", None)
show_yaxis: bool = kwargs.pop("yaxis", False)
show_range: bool = kwargs.pop("range_tool", True)
xgrid: bool = kwargs.pop("xgrid", True)
ygrid: bool = kwargs.pop("ygrid", False)
hide: bool = kwargs.pop("hide", False)
ref_events: pd.DataFrame = kwargs.pop("ref_events", None)
ref_col: str = kwargs.pop("ref_col", None)
ref_time_col: str = kwargs.pop(
"ref_time_col", kwargs.get("time_column", "TimeGenerated")
)
ref_times: List[Tuple[datetime, str]] = kwargs.pop("ref_times", None)
tool_tip_columns, min_time, max_time = _unpack_data_series_dict(data, **kwargs)
series_count = len(data)
tooltips, formatters = _create_tool_tips(data, tool_tip_columns)
hover = HoverTool(tooltips=tooltips, formatters=formatters)
title = f"Timeline: {title}" if title else "Event Timeline"
start_range, end_range, min_time, max_time = _get_time_bounds(min_time, max_time)
height = height or _calc_auto_plot_height(len(data))
y_range = ((-1 / series_count), series_count - 1 + (1 / series_count))
plot = figure(
x_range=(start_range, end_range),
y_range=y_range,
min_border_left=50,
plot_height=height,
plot_width=width,
x_axis_label="Event Time",
x_axis_type="datetime",
x_minor_ticks=10,
tools=[hover, "xwheel_zoom", "box_zoom", "reset", "save", "xpan"],
title=title,
)
_set_axes_and_grids(data, plot, show_yaxis, ygrid, xgrid)
# Create plot bar to act as as range selector
rng_select = _create_range_tool(
data=data,
min_time=min_time,
max_time=max_time,
plot_range=plot.x_range,
width=width,
height=height,
)
# set the tick datetime formatter
plot.xaxis[0].formatter = _get_tick_formatter()
# plot the data
_plot_series(data, plot, legend_pos)
if ref_time is not None:
_add_ref_line(plot, ref_time, ref_label, len(data))
elif ref_events is not None or ref_times is not None:
_plot_ref_events(
plot=plot,
ref_events=ref_events,
time_col=ref_time_col,
group_count=series_count,
ref_col=ref_col,
ref_times=ref_times,
)
plot_layout = column(plot, rng_select) if show_range else plot
if not hide:
show(plot_layout)
return plot_layout