msticpy Logo

msticpy

0
Free
Visit Website

msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to: - Query log data from multiple sources - Enrich the data with Threat Intelligence, geolocations and Azure resource data - Extract Indicators of Activity (IoA) from logs and unpack encoded data - Perform sophisticated analysis such as anomalous session detection and time series decomposition - Visualize data using interactive timelines, process trees and multi-dimensional Morph Charts - Includes time-saving notebook tools such as widgets to set query time boundaries, select and display items from lists, and configure the notebook environment. - Initially developed to support Jupyter Notebooks authoring for Azure Sentinel, now extended to pull log data from other sources.

FEATURES

ALTERNATIVES

Tools to export data from MISP MySQL database for post-incident analysis and correlation.

RedEye is a visual analytic tool for enhancing Red and Blue Team operations.

VirusTotal API v3 is a threat intelligence platform for scanning files, URLs, and IP addresses, and retrieving reports on threat reputation and context.

Aggregates security threats from online sources and outputs to various formats.

Bearded Avenger is a cybersecurity tool with various integrations and deployment instructions available.

A threat hunting capability that leverages Sysmon and MITRE ATT&CK on Azure Sentinel

A collection of tools and resources for threat hunters.

CIFv3 is the next version of the Cyber Intelligence Framework, developed against Ubuntu16, encouraging users to transition from CIFv2.