Ian Hellen

Principal Dev, Microsoft Threat Intelligence Center
Author/maintainer of #msticpy and #msticnb Python packages for CyberSec.

[Ian Hellen @ianhellen]

MSTICPy Pluralsight Training
Delighted to announce "Threat Intelligence with MSTICPy" course released by @pluralsight.
Using notebooks to investigate 3 #mitreattack techniques.
https://t.co/bIRm9bKs30
#msticpy

[Ian Hellen @ianhellen]

🎉 Announcing MSTICPy 3.0 🚀

A big step for our Python threat hunting library.
(also passed the 1M downloads - currently 1.3M)!🍾
Release 3 is mainly a cleanup release, new Py version support, clearing out old junk. But new features also. See details: https://t.co/bqoUAis6BQ

[Ian Hellen @ianhellen]

MSTICPy v2.17.0 released
- new RRCF outlier detection
- AWS extension for Prisma Cloud AWS
- Update Defender Auth to OAuth v2 and fix bugs
- Python 3.12 support
More details here https://t.co/k3iajwq8gu
@msticpy

[msticpy @msticpy]

MSTICPy 2.11.0 released
This minor release includes:
- Better handling of large/split queries for MS Sentinel
- Updated support for installing MSTICPy in a Conda environment
- Updates for future pandas support
https://t.co/zLO8aoOiHC

[Ian Hellen @ianhellen]

@Cyb3rMonk To be fair, it's a really difficult problem. Compared with GitHub copilot a) there isn't the same huge repository of KQL queries b) the schema is variable (unlike a std language like Python, which has a more constrained set of keywords). Most KQL is about schema more than syntax

[Roberto Rodriguez 🇵🇪 @Cyb3rWard0g]

🌟Happy to see the community coming together and taking some of their time from their busy schedules to share and learn something new with others ❤️ #InfosecJupyterthon @OTR_Community Join us! 🚀

🔴Day 1 Live Stream: https://t.co/u2lNjVDGtL
🎤 Agenda: https://t.co/rbYqa2XU2Q

[InfoSec Jupyterthon @jupyterthon]

❤️ See you all soon 🚀 Join us online! @OTR_Community #Infosec #Jupyterthon

📺Day 1: https://t.co/Gi3697oH35
📺Day 2: https://t.co/jCYLKIOlQR

👉Register: https://t.co/RSzDGpeRsg
🎤 Agenda: https://t.co/zBHEGuJayb

[InfoSec Jupyterthon @jupyterthon]

🚨Mark your 🗓️ Feb 15-16! #InfosecJupyterthon Online🔴

📢 Hacking Proprietary Protocols with Pandas
🌟@aboutsecurity, VP Threat Research & Intelligence @BlackBerry

👉 Register: https://t.co/RSzDGpeRsg

[InfoSec Jupyterthon @jupyterthon]

🚨Mark your 🗓️ Feb 15-16! #InfosecJupyterthon Online🔴

📢 Threat Hunting in Three Dimensions
🌟@iknowuhack, Security Researcher @splunk #SURGe

👉 Register: https://t.co/RSzDGpfphO

[InfoSec Jupyterthon @jupyterthon]

🚨Mark your 🗓️ Feb 15-16! #InfosecJupyterthon Online🔴

📢Graphing Ransomware & Data Leak Sites Trends with Plotly
🌟@th3_protoCOL, Threat Intelligence Analyst @Sophos

👉 Register: https://t.co/RSzDGpeRsg

[Ian Hellen @ianhellen]

Pioneering work in at-scale use of notebooks in Infosec at Secureworks.
Also friend of and contributor to @msticpy - don't miss this!

[InfoSec Jupyterthon @jupyterthon]

🚨Mark your 🗓️ Feb 15-16! #InfosecJupyterthon Online🔴

📢Keynote: Barn Raising: Building a Community Around Jupyter Notebooks for DFIR, SecOps, and Detection Engineering Teams
🌟@detectdotdev, Principal Security Researcher @Secureworks

👉 Register: https://t.co/RSzDGpeRsg

[Ian Hellen @ianhellen]

@msticpy Note: the graphic showing in the tweet is the release page for MSTIC notebooklets. MSTICPy is at release 2.10.0 - it hasn't revered 3 years 😁

[Ian Hellen @ianhellen]

Things have been a bit slow recently due to other work commitments but have a new release out today.
Several things in there including some updates to Splunk, XForce and Virustotal support and fixes for users in Azure Machine Learning.
https://t.co/LWT5wuLw0s

[msticpy @msticpy]

New versions of MSTICPy and MSTIC Notebooklets released:
https://t.co/ueuxqWVHsD
https://t.co/hj7Eg4cTRS

[Ian Hellen @ianhellen]

The clock is counting to Jupyterthon 2024. Would love to have you there!

[Microsoft Threat Intelligence @MsftSecIntel]

We’re inviting members of the infosec community to join the fourth InfoSec Jupyterthon event to meet and engage with security practitioners on using Jupyter notebooks in their daily work: https://t.co/ZWWfMokAOz

[Ian Hellen @ianhellen]

And not least @Cyb3rWard0g!
Time to register!

[Roberto Rodriguez 🇵🇪 @Cyb3rWard0g]

🚨 Registration is open for one of my favorite conferences of the year @jupyterthon ! ❤️

Thanks to @ianhellen, @ashwinpatil, @PeteABryan, and @fr0gger_, this event is possible once again!

📢 A true community event, by the community and for the community. Looking forward to seeing you all soon! 🔥

[Ian Hellen @ianhellen]

#Infosec #Jupyterthon 2024
Back to welcome in the new year.
We're looking for speakers, so get your thinking caps on and cool demos at the ready. 🎇
Also looking for input on the kinds of content that you'd like to see. 👷‍♀️➡️🔣
Check out @Cyb3rWard0g's announcement for links.

[InfoSec Jupyterthon @jupyterthon]

🚨 The #Infosec #Jupyterthon is back 📺! 🔥

🗓️February 2024! ❄️🔥Your opportunity to share your curiosity and inspire others🌎! @OTR_Community

🚀 Call for Notebooks (Dec 15th, 2023 - Jan 15th, 2024) https://t.co/Mec9sjZ5rv
📢 Help us shape the event! https://t.co/EAjU83nzPL

[Ian Hellen @ianhellen]

@john_lam @msticpy thanks John!

[Ian Hellen @ianhellen]

Hmm - just noticed that @msticpy blew past quarter of a million sometime in the last couple of months!
(ok, I know pandas does that in a day😁 but it's big deal for us 🏆)
https://t.co/tHSfaabfsk

[Ian Hellen @ianhellen]

MSTICPy 2.9.0 on PyPI
Also includes some great guidance and scripts for packaging msticpy for use in isolated environments.
https://t.co/fspjRfdszR
(thx Chris Cianelli!)

[msticpy @msticpy]

MSTICPY 2.9.0 released
Includes new Threat Intel provider IPQualityScore and updated M365D to use MS Graph API for hunting queries.
Fixes to startup, Synapse compat issues, Entities and more. See the release notes for a full rundown
https://t.co/s4nJozQS75

[Ian Hellen @ianhellen]

@2xyo Not sure if some notebook environments like vscode, colab, pycharm, even use notebook pypi package

[Ian Hellen @ianhellen]

Release notes here
https://t.co/0SS1Lsc1aG

[msticpy @msticpy]

MSTICPy v2.8.0 released.
Stability release - with several important fixes:
- MS Sentinel failure when connecting using a connection string
- Using supported method for multi-cloud Azure endpoints
- Using msticpy in isolated environments.

[Ian Hellen @ianhellen]

@2xyo Msticpy doesn't directly depend on the notebook package. It should need even ipython but it does use some ipython functions if available.