msticpy
msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to: - Query log data from multiple sources - Enrich the data with Threat Intelligence, geolocations and Azure resource data - Extract Indicators of Activity (IoA) from logs and unpack encoded data - Perform sophisticated analysis such as anomalous session detection and time series decomposition - Visualize data using interactive timelines, process trees and multi-dimensional Morph Charts - Includes time-saving notebook tools such as widgets to set query time boundaries, select and display items from lists, and configure the notebook environment. - Initially developed to support Jupyter Notebooks authoring for Azure Sentinel, now extended to pull log data from other sources.
FEATURES
ALTERNATIVES
Python APIs for serializing and de-serializing STIX2 JSON content with higher-level APIs for common tasks.
Cisco Umbrella is a cloud security platform that offers protection against threats on the internet by blocking malicious activity.
Provides indicators of compromise (IOCs) to combat malware with Yara and Snort rules.
VirusTotal API v3 is a threat intelligence platform for scanning files, URLs, and IP addresses, and retrieving reports on threat reputation and context.
A minimalistic Java library for representing threat model data in a normalized way and automating threat intelligence extraction.
A set of rules for detecting threats in various formats, including Snort, Yara, ClamAV, and HXIOC.
The Cybersecurity and Infrastructure Security Agency (CISA) is a government agency that provides alerts, advisories, and resources to help protect the United States' critical infrastructure from cyber threats.
Container of 200 Windows EVTX samples for testing detection scripts and training on DFIR.
PINNED
InfoSecHired
An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.
Mandos Brief Newsletter
A weekly newsletter providing cybersecurity leadership insights, industry updates, and strategic guidance for security professionals advancing to management positions.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Check Point CloudGuard WAF
A cloud-native web application and API security solution that uses contextual AI to protect against known and zero-day threats without signature-based detection.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.
Wiz
Wiz Cloud Security Platform is a cloud-native security platform that enables security, dev, and devops to work together in a self-service model, detecting and preventing cloud security threats in real-time.