msticpy
msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to: - Query log data from multiple sources - Enrich the data with Threat Intelligence, geolocations and Azure resource data - Extract Indicators of Activity (IoA) from logs and unpack encoded data - Perform sophisticated analysis such as anomalous session detection and time series decomposition - Visualize data using interactive timelines, process trees and multi-dimensional Morph Charts - Includes time-saving notebook tools such as widgets to set query time boundaries, select and display items from lists, and configure the notebook environment. - Initially developed to support Jupyter Notebooks authoring for Azure Sentinel, now extended to pull log data from other sources.
FEATURES
EXPLORE BY TAGS
SIMILAR TOOLS
A minimalistic Java library for representing threat model data in a normalized way and automating threat intelligence extraction.
A tool designed to extract additional value from enterprise-wide AppCompat / AmCache data
A PowerShell script to interact with the MITRE ATT&CK Framework via its own API using the deprecated MediaWiki API.
VX-Underground is a vast online repository of malware samples, featuring various collections for cybersecurity professionals and researchers to analyze and combat cyber threats.
A threat hunting tool for Windows event logs to detect APT movements and decrease the time to uncover suspicious activity.
Robust Python SDK and Command Line Client for interacting with IntelOwl's API.
OpenPhish provides real-time phishing trends, detecting new phishing URLs and targeting various brands.
ONYPHE is a cyber defense search engine that discovers exposed assets and provides real-time monitoring to identify vulnerabilities and potential risks.
A repository to aid Windows threat hunters in looking for common artifacts.
PINNED
Mandos
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.