msticpy

library3.0.1pypypi✓ verified 84d ago

MSTIC Security Tools for Jupyter notebooks, providing data acquisition, analysis, and visualization for security investigations. Current version is 3.0.0, released with Python 3.13 support and breaking changes. Release cadence: major/minor releases every few months.

observability

pip install msticpy

github ↗package ↗homepage ↗docs ↗

INSTALL

IMPORT

SIG · MSTICPY

msticpy

observabilitypythonv3.0.1

Install

30.8s avg

Import

4927ms

Disk

530MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v3.0.1 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 5.138s · 524.8MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 30.8s · import 4.716s · 515MB

530MB installed

● package 530MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

QueryProvider

✓ from msticpy.data import QueryProvider

✗ from msticpy import QueryProvider

QueryProvider is in msticpy.data, not top-level.

MSTICPyAnalysis

✓ from msticpy.analysis import timeseries_anomalies

✗ from msticpy import analysis

Use specific submodules, not the analysis package directly.

nbdisplay

✓ from msticpy.vis import nbdisplay

✗ from msticpy import nbdisplay

nbdisplay is in msticpy.vis.

GeoIPLookup

✓ from msticpy.context.geoip import GeoIPLookup

✗ from msticpy.nbtools import GeoIPLookup

GeoIPLookup moved to msticpy.context.geoip in v2.x+.

Initialize a QueryProvider using the AzureResourceGraph driver. Replace 'AzureResourceGraph' with other supported drivers (e.g., 'LogAnalytics', 'MSSentinel').

from msticpy.data import QueryProvider import pandas as pd # Initialize a data provider (example: Azure Resource Graph) qry_prov = QueryProvider('AzureResourceGraph') print('QueryProvider initialized successfully')

Debug

Known issues

breakingDropped Python 3.8 and 3.9 support. Requires Python >=3.10.

fix

Upgrade Python to 3.10+.

affects: >=3.0.0

deprecatedAzure Log Analytics driver (driver='LogAnalytics') is deprecated; use Azure Monitor driver instead.

fix

Change driver to 'AzureMonitor' and update queries to use the new API.

affects: <3.0.0

gotchaMany imports have changed between v2.x and v3.x. Always check the official docs for the correct import path.

fix

Refer to the migration guide at https://msticpy.readthedocs.io/en/latest/migration.html

affects: all

gotchaQueryProvider requires a supported driver string; misspelling or using an unsupported driver yields a cryptic error.

fix

Use one of: 'AzureResourceGraph', 'AzureMonitor', 'MSSentinel', 'M365Def', 'ODS', 'LogAnalytics' (deprecated).

affects: all

Errors

Common errors & fixes

ModuleNotFoundError: No module named 'msticpy'

msticpy not installed or installed in a different environment.

fix

Run 'pip install msticpy' in your active environment.

AttributeError: module 'msticpy' has no attribute 'QueryProvider'

Importing from top-level instead of msticpy.data.

fix

Use 'from msticpy.data import QueryProvider'.

ValueError: Unsupported driver: 'LogAnalytics'

Using deprecated driver name in v3.x.

fix

Replace 'LogAnalytics' with 'AzureMonitor' or another supported driver.

ImportError: cannot import name 'plot_timeline' from 'msticpy.vis'

Function moved or renamed in v3.x.

fix

Check docs for updated plot functions; use 'from msticpy.vis.timeline import display_timeline'.

Upgrade

Version history

3.0.1latest on PyPI · released May 11, 2026

Audit

Dependencies

pandasrequiredCore data analysis

bokehrequiredVisualizations

matplotlibrequiredVisualizations

azure-identityrequiredAzure authentication

azure-monitor-queryoptionalAzure Monitor data provider (replaced deprecated azure-loganalytics)

azure-mgmt-securityoptionalMicrosoft Defender API access

requestsrequiredHTTP requests

KqlmagicoptionalKusto query support

tqdmrequiredProgress bars

Agent activity

23 hits · last 30 days

node

OpenAI (training)

Resources