msticpy
@msticpy
Followers
851
Following
36
Media
24
Statuses
199
#msticpy is an open source library for InfoSec investigation and hunting in #Jupyter Notebooks and #Python.
Joined January 2022
MSTICPy 2.11.0 released This minor release includes: - Better handling of large/split queries for MS Sentinel - Updated support for installing MSTICPy in a Conda environment - Updates for future pandas support https://t.co/zLO8aoOiHC
0
6
10
New versions of MSTICPy and MSTIC Notebooklets released: https://t.co/ueuxqWVHsD
https://t.co/hj7Eg4cTRS
github.com
What's Changed Test and doc updates by @ianhelle in #39 [Fix] Added MANIFEST.in to include YAML files by @rjaakke in #38 Fixes for MSTICPy 2.9 compatibility by @ianhelle in #41 Ianhelle/fix bu...
1
3
12
thx to contributors @PeteABryan Joey Dreyer, Chis Cianelli, Florian Bracq and 2xyo
1
0
1
MSTICPY 2.9.0 released Includes new Threat Intel provider IPQualityScore and updated M365D to use MS Graph API for hunting queries. Fixes to startup, Synapse compat issues, Entities and more. See the release notes for a full rundown https://t.co/s4nJozQS75
2
9
21
MSTICPy v2.8.0 released. Stability release - with several important fixes: - MS Sentinel failure when connecting using a connection string - Using supported method for multi-cloud Azure endpoints - Using msticpy in isolated environments.
0
1
7
MSTICPy 2.7.0 release - 2 new threat intel providers for CrowdSec and AbuseIPDB - New MS Sentinel and Kusto drivers now the defaults - Query file editor for MSTICPy template queries - Azure auth fixes for MicrosoftSentinel More details https://t.co/M8Tn0QuC8f
0
8
22
@T_8ase is going to present about @msticpy at the SANS DFIR Japan, check this out if you are around 🤩 Cc: @ianhellen
9月7日と8日開催のSANS APAC DFIR Summitのアジェンダが公開されました！長谷川達也さんは「msticpyの実践活用: 高度な脅威ハンティングを実現すべくSIEMとの虹の懸け橋となる」と題して講演します！ msticpyの機能紹介を説明し、msticpyとSIEMの活用について紹介します。 https://t.co/k0yxx9abig
1
2
3
MSTICPy 2.6.0 released - Parallel queries for multiple instances of MS Sentinel workspaces and Kusto clusters - Parallel split queries (large time-range queries divided by smaller time periods) - Velociraptor data provider for querying exported data sets https://t.co/tL511uP82x
0
11
22
... continued * Panel tabulator now supported as default data viewer (see https://t.co/YwvJyAzdiT) These are described more fully in the release notes and (mostly) in the updated docs
0
0
1
MSTICPy 2.5.0 released * New Sentinel and Kusto drivers with parallel queries, proxy and user-defined timeouts. * Plugin framework for MSTICPy data/TI/context providers * Import Sentinel hunting and detection queries * OSQuery data provider ... https://t.co/LBaT0JLqt3
github.com
Summary of main changes New MS Sentinel and Azure Kusto drivers/data providers - these include support for multi-threaded parallel queries, proxies and user-defined query timeouts. Extensibility m...
1
1
5
Had a report that the search in MSTICPy ReadtheDocs was broken (apparently broken for a while due to a bug in the ReadTheDocs template. Happy to report that this is now fixed. https://t.co/3968jFgEGk
0
1
5
🚨 #MSTICPy has just merged a new PR to main! ashwin-patil added the PR - Read the docs update for Managed spark installation https://t.co/PSHzUYb2yI
#python #MSTIC #infosec
github.com
added section under Installing for how to install in managed spark compute in AML
0
0
2
🚨 #MSTICPy has just merged a new PR to main! petebryan added the PR - Updated Sentinel incident docs to reflect filtering options https://t.co/YZJDwrxekI
#python #MSTIC #infosec
github.com
Updated the Sentinel documenation to reflect the fact that you can now pass parameters to list_incidents to affect the returned results. The documents provide simple examples of adjusting the numbe...
0
0
1
MSTICPy v2.4.0 released - New Pulsedrive TI module - Process tree updates (inc FireEye HX compat) - Bokeh 3.0 support - Improved diagnostics/logging - Fixes to Azure auth, Sentinel APIs and more. https://t.co/adgS3yHBDL
github.com
Main changes for this release There are no huge changes in this release but a good variety of important updates and fixes. We're also delighted to welcome 3 new contributors to the MSTICPy fami...
0
5
14
🚨 #MSTICPy has just merged a new PR to main! ianhelle added the PR - Reverting to bokeh version 2.4.3 for default install https://t.co/5HyFdrudgn
#python #MSTIC #infosec
github.com
Replacing NAs in process_tree DF - causes Bokeh 3.0 to fail
0
1
1
🚨 #MSTICPy has just merged a new PR to main! ianhelle added the PR - Misc updates for 2.3.2 release: https://t.co/q9vBk2BKO4
#python #MSTIC #infosec
github.com
adding bs4 to mocks for sphinx in conf.py updating min scikit-learn version to avoid numpy aliased types removal fix to azure_auth_core.py - if clientsecret type is specified it will only get added...
0
0
2
🚨 #MSTICPy has just merged a new PR to main! ianhelle added the PR - Adding data query paths test for DEX support https://t.co/lRILFa8E3q
#python #MSTIC #infosec
github.com
MyPy suppressions for some uses of ProviderSettings and PivotRegistration classes.
0
0
0
🚨 #MSTICPy has just merged a new PR to main! ianhelle added the PR - ProcTree and init_notebook fixes https://t.co/wXhfr2MirO
#python #MSTIC #infosec
github.com
Added process tree text renderer to process_tree_utils.py Found bug in process ordering due to sorting of short string numerics - fixed in proc_tree_builder.py related item in vtfile_behavior.py F...
0
1
0
🚨 #MSTICPy has just merged a new PR to main! ianhelle added the PR - Adding logging and updating settings access https://t.co/QmekHjGz6l
#python #MSTIC #infosec
github.com
Added Python logging to MSTICPy - currently only a few modules have this implemented but it's now there for use. We should instrument places like the authentication modules. I've al...
0
0
2
MSTICPy release 2.3.1 - Hide progress bar with TILookup - init_notebook works offline or in air-gapped env - some important Azure/Sentinel/AzureML fixes Now on PyPI https://t.co/OHDnrkTl66 Read the goodness in the rel notes: https://t.co/Y2OHFHxDu1
#msticpy #CyberSec #Jupyter
github.com
This is minor release with mostly fixes. Some higlights from the #631 PR #629 - You can now suppress progress bar for Threat Intel lookups (useful to avoid screen mess when running multiple lookups...
0
3
10