# microsoft/msticpy

Microsoft Threat Intelligence Security Tools

Repository: https://github.com/microsoft/msticpy
Canonical: https://ross.abutalabs.com/products/msticpy
Language: Python
License: NOASSERTION
License Family: other
Last push: 2026-08-13T13:03:14+00:00

## Health v2 (maintenance only)
Score: 92/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 97, release rhythm 81, longevity 100
- inputs: {"age_days": 2750, "days_push": 20, "days_rel": 46, "gap_med": 36.0, "n_releases_24m": 13}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1995, forks 332 (observed 2026-08-28T04:06:03.441743+00:00)

## What it is
msticpy is a Python library from Microsoft for security investigation and threat hunting in Jupyter notebooks. It provides data acquisition from SIEM and log sources, threat intelligence enrichment, analysis, and interactive visualization for SOC investigators.

## Use cases
- query log data from Sentinel, Splunk, or Defender in a Jupyter notebook
- enrich security events with threat intelligence and geolocation data
- extract indicators of activity from logs
- detect anomalous sessions and perform time series analysis on security data
- visualize process trees and interactive timelines for incident investigation
- build SOC hunting notebooks with reusable widgets and query tools

## When to choose
- you do security incident response or threat hunting in Jupyter notebooks
- you use Microsoft Sentinel or Azure and want first-party tooling
- you want a Python library that standardizes on pandas DataFrames for security analysis

## When to avoid
- you need a standalone GUI or web application rather than a notebook library
- your SIEM is not among the supported sources and you cannot write a custom data provider
- you need a fully maintained PyPI release right now, since publishing is temporarily halted

## Facets
- artifact type: library
- maturity: active
- function: data-visualization, analytics, search-engine, monitoring, nlp
- domain: security, data-science, developer-tools, analytics
- platform: python, cross-platform
- tags: threat-intelligence, jupyter, siem, microsoft-sentinel, security-hunting, incident-response, soc-tools, pandas

## Member repositories
- microsoft/msticpy (main) score 92

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:03.441743+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:02:31.268480+00:00, confidence not recorded.
  - readme: https://github.com/microsoft/msticpy (fetched 2026-08-28T04:06:03.441743+00:00, sha f010c15dd4d9)
  - registry_pypi: https://pypi.org/pypi/msticpy/json (fetched 2026-08-29T10:42:10.400054+00:00, sha a09cd35d6bd5)
- Data as of 2026-08-30T08:39:29.467469+00:00.