"Cyber Security Investigations with Jupyter Notebooks"
summary
Shows a concrete toolkit and patterns for doing incident hunting inside Jupyter: uses MSTICPy with drivers for Microsoft Sentinel and Splunk, builds parameterized queries stored as YAML/JSON and generates callable query methods that return pandas DataFrames, and applies decorators/wrappers to turn varied enrichment functions (geo/WHOIS/threat intel) into consistent entity methods. Demonstrates pandas accessor pipelines and interactive Bokeh visuals (timeline, matrix, process tree) that chain together for repeatable, large‑scale investigations.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:01Background
- 8:53Data Provider Demo
- 13:04Context and Enrichment
- 15:48Wrappers
- 20:19Visualization
- 23:42Composability
- 24:26Pipelines
- 25:54Conclusion
related talks
01h 04mAI Agents and Jupyter Notebooks for Security Data Analysis
31mStreamlining Threat Hunting in Cloud Environments with Jupyter
30mPython Platforms for Cyber Security
23mPython for Threat Intelligence
25mMischief Managed: What hackers can do on your Jupyter instance
24mJupyter Notebooks for Ops
41mUsing Jupyter Notebooks to Explore Public CVE Data
45mThreat Hunting with Python and Pandas