MSTICPy — The Cyber Toolchain

MSTICPy v3.1.0

Mon, 21 Sep 2026 22:52:42 GMT

MSTICPy 3.1.0 adds a new ScanMalware TI provider for DNS, IP, and URL observables with no API key required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the `ScanMalware` threat-intelligence provider supporting verdict lookups for hosts and URLs, passive-DNS context for IP addresses, and `quick` query modes for bulk lookups — no API credentials required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Python 3.14 to the supported package classifiers and CI test matrix. Breaking changes: • NumPy 1.x is no longer supported by the declared runtime requirements — review environment constraints for NumPy 2 compatibility before upgrading. • Code that directly indexes the dictionary returned by mp_ua_header() must replace `["UserAgent"]` with `["User-Agent"]`; code that passes the complete dictionary as HTTP headers does not need to change, and code needing the raw identifier can use `MSTICPY_USER_AGENT`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v3.0.1

Mon, 11 May 2026 20:44:44 GMT

MSTICPy v3.0.1 adds path traversal protection for archive extraction across GeoIP, Mordor, and Sentinel query pack downloads. • Adds centralized `msticpy.common.archive_utils` module that validates archive member paths before extraction, preventing tar-slip/zip-slip attacks when extracting GeoIP databases, Mordor datasets, and Sentinel query packs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v3.0.0

Tue, 28 Apr 2026 21:56:57 GMT

MSTICPy v3.0.0 adds OpenObserve data provider, Sentinel certificate auth, and Python 3.13 support. • New OpenObserve data provider enables querying OpenObserve instances directly via mp.QueryProvider('OpenObserve'), with support for time-range parameters, result limits, timezone config, and custom timeouts. • Microsoft Sentinel connections now support certificate-based authentication as an alternative to client secrets, improving security for automated pipelines and service accounts. • Cybereason driver gains automatic HTTP 429 rate-limit retry with backoff, additional query parameters (`page_size`, `timeout`, `retry_on_error`), improved timeout handling, and better error reporting via `MsticpyDataQueryError`. • Cybereason driver's data flattening (`_flatten_simple_values`, `_flatten_element_values`) reworked for more reliable output, with extra fields now mapped to the result DataFrame. • The `ThreatIntelIndicators` BYOTI provider now supports both old and new table schemas, enabling seamless operation across Sentinel workspaces with either schema version. • Configurable TI confidence threshold — now a class constant that can be overridden rather than a hardcoded value. • New KQL timespan conversion utilities for converting KQL timespan strings to Python `timedelta` objects using `azure-kusto-data`'s `parse_timedelta`. • Python 3.13 is now fully supported. Breaking changes: • Python 3.8 and 3.9 are no longer supported; supported versions are 3.10, 3.11, 3.12, and 3.13. • The `msrestazure` package is removed; code catching `msrestazure.azure_exceptions.CloudError` must be updated to catch `azure.core.exceptions.HttpResponseError` instead. • The `kql` install extra (`pip install msticpy[kql]`) is removed; KqlmagicCustom is no longer a supported dependency. • The `aiagents` install extra (`pip install msticpy[aiagents]`) is removed; the `autogen-agentchat` integration is no longer included. • The `sql2kql` extra now requires `mo-sql-parsing>=11,<12` (previously `>=8,<9`); environments using `sql_to_kql` must be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v2.17.0

Thu, 25 Sep 2025 17:43:55 GMT

MSTICPy v2.17.0 adds RRCF outlier detection, expanded Prisma Cloud AWS coverage, and OAuth2 for Defender providers. • Adds RRCF (Random Cut Forest) outlier detection for ensemble-based anomaly scoring on telemetry data. • Expands Prisma Cloud AWS detection coverage for broader cloud security analysis. Breaking changes: • Defender provider auth will fail until `msticpyconfig.yaml` scopes are updated to OAuth2 `.default` values — legacy non-OAuth2 or incorrect scope names are no longer accepted. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v2.16.0

Fri, 21 Feb 2025 02:35:36 GMT

MSTICPy v2.16.0 adds Prisma Cloud data driver, Cyberint TI provider, and certificate auth for OData drivers • Adds PrismaCloudDriver for querying Prisma Cloud assets, configurations, and events via its CSPM API within MSTICPy workflows. • Adds Cyberint as a new Threat Intelligence provider for IoC lookup via the Cyberint API. • Adds certificate authentication support for OData-based drivers (Microsoft Defender and Microsoft Graph). • Adds experimental Azure Monitor search driver with support for custom tables (tracked as issue #831). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v2.15.0

Fri, 06 Dec 2024 21:42:43 GMT

MSTICPy v2.15.0 adds multi-dimensional outlier visualizations and federated auth improvements for M365D/Graph providers. • Adds multi-dimensional plot support to `analysis.outliers` via `plot_outlier_results`, enabling visual interpretation of Isolation Forest anomaly detection across N-dimensional feature sets. • Improves federated authentication (delegated auth) support in the MDATP/Defender data provider, with cleaned-up code alongside the existing documentation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v2.14.0

Mon, 21 Oct 2024 19:03:57 GMT

MSTICPy v2.14.0 adds declarative user session config, nested-dict DataFrame expansion, and HTTP 429 retry control. • Adds mp.load_user_session() to declaratively initialize and connect multiple data providers and components from a YAML file, publishing them directly into the notebook namespace. • Adds mp_pivot.dict_to_dataframe(col=...) pandas extension method to recursively expand nested dictionaries and lists in a DataFrame column into multiple columns and rows. • Adds a max-retry parameter to prevent HTTP 429 (rate-limit) errors during query execution. • Supports Maxmind GeoIPLite's new `AccountID`-based download authentication mechanism via `msticpyconfig.yaml`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v2.13.0

Fri, 13 Sep 2024 00:31:11 GMT

MSTICPy v2.13.0 adds an LLM-powered document Q&A agent via Autogen/RAG and a new BinaryEdge threat-intel provider. • Adds an LLM/RAG-based document Q&A agent (`msticpy.aiagents.mp_docs_rag_magic`) powered by Autogen, enabling natural-language queries against MSTICPy documentation inside notebooks. • Adds a new Threat Intelligence provider for BinaryEdge, expanding TI lookup coverage. • Adds upload data styles to the Splunk uploader. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v2.12.0

Fri, 10 May 2024 23:25:43 GMT

MSTICPy v2.12.0 adds MSSentinel key support, Args subkey for auth params, and JWT expiry checks for Splunk. • `msticpyconfig.yaml` now supports the `MSSentinel` key as an alias for `AzureSentinel` • WorkspaceConfig entries in `msticpyconfig.yaml` support an `Args` subkey to pass authentication parameters like `client_id` to query_provider.connect() • The MSSentinel QueryProvider now accepts explicit connection parameters (e.g. `client_secret`) via the connect() method instead of relying solely on config keys Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v2.11.0

Mon, 25 Mar 2024 23:58:28 GMT

Adds fail_if_partial parameter to Sentinel exec_query to enforce failure on partial results • Adds `fail_if_partial` parameter to the Sentinel query provider's `exec_query` method to raise an exception when queries return partial results • Introduces a warning for Kusto/Sentinel queries that return partial results in split queries to prevent silent data loss Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v2.10.0

Mon, 12 Feb 2024 19:00:42 GMT

Adds VirusTotal search queries and SplunkUploader token auth support in v2.10.0 • `VirusTotalQueries` class provides Virus Total Search Capabilities • Config key `authentication.token` in `msticpyconfig.yaml` enables security token auth for `SplunkUploader` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v2.9.0

Wed, 15 Nov 2023 22:08:10 GMT

Adds IPQualityScore threat intel provider and Graph-based Defender Advanced Hunting via `M365DGraph` environment. • Adds `IPQualityScore` as a new TI provider to query IP reputation statistics • Adds support for Microsoft Defender Graph API by using the `M365DGraph` DataEnvironment name in the data provider Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v2.8.0

Wed, 04 Oct 2023 21:05:50 GMT

MSTICPy v2.8.0 adds Splunk bearer token auth, Cybereason paging, and YAML validation. • `Add bearer token auth to splunk driver` - Supports authentication via security token instead of username/password • `Cybereason pagination support + multi-threading` - Handles large CyberReason queries with paging • `Validation of the YAML structure of query files` - Validates query yaml file structure Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v2.7.0

Tue, 15 Aug 2023 16:24:39 GMT

MSTICPy v2.7 adds CrowdSec and AbuseIPDB TI providers, a new Query Editor UI, and native Azure data connectors. • Adds `CrowdSec` Threat Intelligence provider for malicious IP lookups • Adds `AbuseIPDB` Threat Intelligence provider for malicious IP address abuse lists • Introduces an ipywidgets-based `QueryEditor` to edit and manage KQL query templates with parameter definitions and metadata • Enables parallel query execution across multiple workspaces by splitting large queries into time chunks via the `split_query_by` parameter in new MSSentinel/Kusto drivers • Allows passing an `AzureCredential` object directly to the `credential` parameter of AzureData.connect() and MicrosoftSentinel.connect() methods for authentication • Supports specifying sovereign clouds via the `cloud` parameter in AzureData.connect() and MicrosoftSentinel.connect() methods • Adds `delete_watchlist_item` method to the MS Sentinel API integration Breaking changes: • Kqlmagic dependencies are no longer installed by default; install with `pip install msticpy[kql]` if needed • Default data environment identifiers changed to `MSSentinel` and `Kusto` (replacing `MSSentinel_New` and `Kusto_New`); use `MSSentinel_Legacy` or `Kusto_Legacy` for previous Kqlmagic-based drivers Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v2.6.0

Tue, 25 Jul 2023 01:04:02 GMT

MSTICPy v2.6.0 adds parallel multi-instance querying and a Velociraptor local data provider • QueryProvider.add_connection() enables running queries across multiple Sentinel/Defender/Splunk instances in parallel. • `max_threads` parameter on `QueryProvider` controls concurrent thread count (default 4, configurable via init). • `VelociraptorLogs` data environment added to read local exported Velociraptor logs into pandas DataFrames. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v2.5.0

Tue, 30 May 2023 16:52:24 GMT

MSTICPy v2.5.0 adds OSQuery and new MSSentinel/Kusto drivers with plugin extensibility. • mp.QueryProvider("OSQueryLogs") enables importing OSQuery JSON logs into dataframes for forensic analysis • mp.load_plugins(plugin_paths=...) allows side-loading private data, TI, and context providers alongside built-in ones • New `MSSentinel_New` provider uses `azure-kusto-data` SDK and supports multi-threaded parallel queries across multiple workspaces • download_and_write_sentinel_queries(query_type="Hunting") downloads detection/hunting queries from the Sentinel repo for use with MSTICPy • `Panel` Tabulator is now available as a data viewer control, configurable via initialization parameters Breaking changes: • The `mp_az_auth` parameter is deprecated in favor of `auth_types` (will be removed in a future release) • The `mp_az_auth_tenant_id` parameter is deprecated and unsupported in new providers, replaced by `tenant_id` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v2.3.1

Fri, 24 Feb 2023 02:05:12 GMT

Adds `progress` parameter to Threat Intel lookup functions and removes auto-displayed license info in geoip. • tilookup.lookup_iocs() now accepts a `progress=False` argument to suppress the progress bar output. • The `geoip` module no longer automatically displays license information during execution. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v2.3.0

Wed, 25 Jan 2023 21:54:05 GMT

MSTICPy v2.3.0 adds Sentinel Dynamic Summaries, dynamic parameterized queries via QueryProvider.add_custom_query, and query search • Adds sentinel.list_dynamic_summaries(), create_dynamic_summary(), get_dynamic_summary(), and new_dynamic_summary() to manage Microsoft Sentinel dynamic summaries in preview • Adds `DynamicSummary` class (importable from `msticpy.context.azure.sentinel_dynamic`) for manipulating summary objects with methods like to_df() • Adds QueryProvider.add_custom_query() API to register ad-hoc parameterized queries at runtime with defined parameters • Adds `QueryProvider.Param` constructor for defining query parameter metadata (name, type, description, default) • Adds QueryProvider.search() method for finding queries by name, properties, table, or parameter using regex-like terms Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v2.2.0

Tue, 29 Nov 2022 04:03:03 GMT

MSTICPy v2.2.0 adds ServiceNow context provider, IoC de-fanging, and Python 3.11 support • Adds `ContextProviders` config section in `msticpyconfig.yaml` with a `ServiceNow` provider for querying ServiceNow via the new generic context lookup API. • Adds `defang_ioc` and `refang_ioc` utility functions in `msticpy.common.utility` to handle common de-fanging markup ([.], AT, hXXp) in IoCs. • Adds support for Python 3.11 to the MSTICPy library. • Adds GCC and Regional Cloud support to MDE/M365 data providers for government cloud customers. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v2.1.5

Tue, 01 Nov 2022 21:19:21 GMT

MSTICPy v2.1.5 allows Process Tree viewer to accept process GUIDs as ProcessID • `process_tree` now accepts GUID format for `ProcessID` and `ParentProcessID` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v2.1.4

Tue, 25 Oct 2022 20:21:40 GMT

Adds `create_*` API ID returns and `init_notebook` config param for custom settings files in MSTICPy v2.1.4 • `MicrosoftSentinel` connect methods now default to "Default" workspace or the name supplied as `workspace` parameter without requiring explicit configuration for those cases. • Sentinel `create_*` APIs (for incident, bookmark, analytic, and watchlist creation) now return the ID of the newly created item instead of None. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v2.1.3

Thu, 06 Oct 2022 17:51:57 GMT

MSTICPy v2.1.3 adds mp_plot_process schema argument and MS Sentinel query retrieval support • Adds `schema` parameter to `mp_plot_process` and related process tree functions to accept dictionary mappings instead of only `ProcSchema` objects • Adds capability to retrieve stored queries from an MS Sentinel workspace via a new API integration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v2.0.0

Thu, 07 Jul 2022 18:23:33 GMT

MSTICPy v2.0 introduces new `mp.search`, `plot_map`, async TI lookups, and `msticpyconfig.yaml` support • Adds mp.search() function to search for modules across the reorganized package structure • Adds `plot_map` function in `msticpy.vis.foliummap` for direct DataFrame-to-map plotting with layer and icon control • Adds `.mp_plot.folium_map` pandas accessor for plotting maps directly from DataFrames • Enables asynchronous execution for TILookup.lookup_iocs() when multiple Threat Intelligence providers are configured • Adds `ti_lookup.enable_provider`, `ti_lookup.disable_provider`, and `ti_lookup.set_provider_state` methods to control TI providers at runtime • Adds `config` parameter to init_notebook() to allow specifying a custom `msticpyconfig.yaml` path Breaking changes: • Drops official support for Python 3.6; minimum supported version is now Python 3.8 • Many modules have moved to new package locations (e.g., `sectools` migrated to `context`, `transform`, or `analysis`); old import paths remain but issue Deprecation warnings Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v1.8.2

Mon, 23 May 2022 17:26:57 GMT

MSTICPy v1.8.2 adds user-delegated auth to OData drivers and switches token cache to memory • Adds Delegated Auth support to all OData Drivers, allowing MDE and Graph users to use User-delegated authentication instead of app ID/secrets. • Replaces MSAL auth plaintext file cache with a memory cache, removing the ability to use plaintext token cache due to security concerns. Breaking changes: • The `MSAL` auth plaintext file cache is replaced with a memory cache; the previous mechanism for persisting tokens to disk is removed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v1.8.0

Wed, 04 May 2022 22:17:41 GMT

Adds Sentinel Search API support, MSAL token caching, configurable HTTP timeouts via `timeout` parameter, and `database` in Kusto query files. • `SentinelSearchProvider` enables creation, status checking, and deletion of automated search jobs via the Sentinel Search API • Adds `MSALTokenCache` support for authentication to leverage MSAL token caching • Configurable HTTP timeouts via configuration and `timeout=` parameter in network providers (e.g., mde_prov.my_query(..., timeout=30)) • Kusto query files now support a `database` element to control the target database without encoding it in the datafamily Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v1.7.5

Wed, 23 Mar 2022 03:13:32 GMT

MSTICPy v1.7.5 adds Splunk async queries, PowerShell de-obfuscation, and keyring management functions • Introduces `msticpy.analysis.code_cleanup.format_powershell` to de-obfuscate and format PowerShell strings into readable code • Adds refresh and delete functions in the keyring module for managing cached secrets Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v1.7.0

Thu, 17 Feb 2022 18:17:04 GMT

Adds IntSights and Cybereason data providers, SentinelAlert entity, and async HTTP support via httpx • `IntSights` provider for threat intelligence lookups • `Cybereason` data provider for endpoint detection and response data • `SentinelAlert` entity class that auto-extracts related entities from MS Sentinel alerts • Underlying HTTP client switched from `requests` to `httpx` for async support Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v1.6.1

Wed, 19 Jan 2022 18:58:15 GMT

MSTICPy v1.6.0 adds Sentinel Analytics/Watchlists APIs, VirusTotal V3 pivoting, multiple Dataprovider instances, and Mordor caching • Adds `FoliumMap` layering and subgrouping support • Adds `Analytics` and `Watchlists` modification operations to the Sentinel API module (class names now drop the "Azure" prefix) • Adds VirusTotal V3 `FileBehavior`, `ObjectBrowser`, and Pivot functions via new VT Relationship APIs • Enables multiple configuration entries in `msticpyconfig.yaml` for Splunk, Sumologic, and Microsoft Sentinel workspaces using an instance suffix (e.g., `Spunk-Env1`) • Adds default caching for Mordor Security Datasets driver, storing cache files in `$HOME/.msticpy/mordor` or the path specified in `Dataproviders/Mordor` in `msticpyconfig.yaml` • Adds a `ProcSchema` mapping for Sysmon process data in the `process_tree` visualization Breaking changes: • The Sentinel API module and class names no longer include the "Azure" prefix (renamed from Azure Sentinel to Microsoft Sentinel) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v1.5.1

Wed, 22 Dec 2021 22:56:58 GMT

MSTICPy v1.5.1 adds MSI SSO for Azure Sentinel and fixes MDE process tree datetime handling • QueryProvider.connect() accepts `mp_az_auth` parameter to control Azure authentication methods for Microsoft Sentinel connections. • Supports Managed Identity (MSI) credentials automatically for authenticating to Microsoft Sentinel when running in Azure ML notebooks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy

MSTICPy v1.5.0

Mon, 29 Nov 2021 21:16:26 GMT

v1.5.0 adds EntityGraph visualization, RiskIQ threat intel provider, M365D/Kusto query providers, and sovereign cloud support for MS Graph. • New `EntityGraph` class and .mp_plot.incident_graph() Pandas accessor for visualizing investigation graphs and timelines • New `RiskIQ` threat intel provider with registered pivot functions for hostnames, FQDNs, and IP addresses • New `M365D` QueryProvider name enabling consolidated access to Microsoft Defender 365 APIs • Preview support for the `Kusto` query provider targeting Azure Data Explorer clusters • Sovereign cloud support added to the Microsoft Graph provider Full history on Cyber Toolchain: https://cybertoolchain.io/tools/msticpy