microsoft/msticpy

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

1995 stars · 332 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

msticpy is a Python library from Microsoft for security investigation and threat hunting in Jupyter notebooks. It provides data acquisition from SIEM and log sources, threat intelligence enrichment, analysis, and interactive visualization for SOC investigators.

Use cases

• query log data from Sentinel, Splunk, or Defender in a Jupyter notebook
• enrich security events with threat intelligence and geolocation data
• extract indicators of activity from logs
• detect anomalous sessions and perform time series analysis on security data
• visualize process trees and interactive timelines for incident investigation
• build SOC hunting notebooks with reusable widgets and query tools

When to choose

• you do security incident response or threat hunting in Jupyter notebooks
• you use Microsoft Sentinel or Azure and want first-party tooling
• you want a Python library that standardizes on pandas DataFrames for security analysis

When to avoid

• you need a standalone GUI or web application rather than a notebook library
• your SIEM is not among the supported sources and you cannot write a custom data provider
• you need a fully maintained PyPI release right now, since publishing is temporarily halted

Facets

library · maturity active

data-visualization analytics search-engine monitoring nlp security data-science developer-tools analytics python cross-platform threat-intelligence jupyter siem microsoft-sentinel security-hunting incident-response soc-tools pandas

Member repositories

For agents

markdown · JSON · MCP: product_card(name="microsoft/msticpy")