{"schema_version":"onlylabs.public_signal.v1","title":"Microsoft Repo: microsoft/msticpy","description":"Microsoft repo signal with public source context, captured evidence pages, related signals, and data-business radar classification.","url":"https://onlylabs.fyi/signals/c8ec5d05-7a41-4239-bc38-38ed94fb0e07","json_url":"https://onlylabs.fyi/signals/c8ec5d05-7a41-4239-bc38-38ed94fb0e07/signal.json","generated_at":"2026-06-11T03:56:46.417079+00:00","org":{"slug":"microsoft","name":"Microsoft","category":"frontier-lab","category_label":"Frontier lab","dossier_url":"https://onlylabs.fyi/labs/microsoft","dossier_json_url":"https://onlylabs.fyi/labs/microsoft/dossier.json"},"related_urls":{"signal":"https://onlylabs.fyi/signals/c8ec5d05-7a41-4239-bc38-38ed94fb0e07","signal_json":"https://onlylabs.fyi/signals/c8ec5d05-7a41-4239-bc38-38ed94fb0e07/signal.json","source":"https://github.com/microsoft/msticpy","lab_dossier":"https://onlylabs.fyi/labs/microsoft","lab_dossier_json":"https://onlylabs.fyi/labs/microsoft/dossier.json","analysis":"https://onlylabs.fyi/analysis/microsoft","analysis_json":"https://onlylabs.fyi/analysis/microsoft/analysis.json","analysis_evidence_json":"https://onlylabs.fyi/analysis/microsoft/evidence.json","category":"https://onlylabs.fyi/frontier","category_json":"https://onlylabs.fyi/frontier.json","category_feed":"https://onlylabs.fyi/frontier/feed.xml","category_signals_json":"https://onlylabs.fyi/signals.json","topic":null,"topic_signals_json":null,"topic_feed":null,"data_business":{"radar":"https://onlylabs.fyi/data-radar","radar_json":"https://onlylabs.fyi/data-radar.json","opportunities":"https://onlylabs.fyi/opportunities","opportunities_json":"https://onlylabs.fyi/opportunities.json","lanes":[{"key":"safety","label":"Safety and policy","url":"https://onlylabs.fyi/data-radar/safety","json_url":"https://onlylabs.fyi/data-radar/safety/signals.json"}]}},"answer_pack":{"answer":"Microsoft published microsoft/msticpy (Python). This repository signal exposes tooling, eval, infrastructure, or model-adjacent work before it may appear in a launch post. High-signal details: repo microsoft/msticpy · language Python. onlylabs links this event to 1 captured evidence page and 6 related repo signals. It also maps to Safety and policy in the data-business radar.","signal_desk":"repos","source_context":{"source_url":"https://github.com/microsoft/msticpy","source_host":"github.com","occurred_at":"2019-02-21T17:30:03+00:00","first_seen_at":"2026-06-06T01:49:41.740219+00:00","date_source":"source","context":"Python"},"context_markers":[{"label":"Lab","value":"Microsoft","source":"signal"},{"label":"Signal desk","value":"repos","source":"signal"},{"label":"Source host","value":"github.com","source":"source"},{"label":"Repository","value":"microsoft/msticpy","source":"source"},{"label":"Language","value":"Python","source":"source"},{"label":"Stars","value":"1,970","source":"traction"},{"label":"Radar lane","value":"Safety and policy","source":"radar"},{"label":"Matched term","value":"security","source":"radar"},{"label":"Watch term","value":"Infrastructure","source":"evidence"},{"label":"Watch term","value":"Safety and alignment","source":"evidence"},{"label":"Watch term","value":"Agents and tool use","source":"evidence"}],"evidence_coverage":{"target_pages":1,"captured_pages":1,"readable_pages":1,"capture_methods":["plain"],"missing_page_urls":[],"failed_page_urls":[],"blocked_page_urls":[],"page_urls":["https://github.com/microsoft/msticpy"],"related_signals":6,"has_source_url":true,"latest_page_fetched_at":"2026-06-11T03:56:46.417079+00:00"},"data_business":{"matches":true,"lanes":[{"key":"safety","label":"Safety and policy","url":"https://onlylabs.fyi/data-radar/safety","json_url":"https://onlylabs.fyi/data-radar/safety/signals.json"}],"matched_terms":["security"],"score":14,"reason":"Microsoft has a repo signal matching safety and policy."},"agent_handoff":{"signal_json":"https://onlylabs.fyi/signals/c8ec5d05-7a41-4239-bc38-38ed94fb0e07/signal.json","dossier_json":"https://onlylabs.fyi/labs/microsoft/dossier.json","analysis_json":"https://onlylabs.fyi/analysis/microsoft/analysis.json","analysis_evidence_json":"https://onlylabs.fyi/analysis/microsoft/evidence.json","topic_signals_json":null,"topic_feed":null,"category_signals_json":"https://onlylabs.fyi/signals.json","data_radar_json":"https://onlylabs.fyi/data-radar.json","opportunities_json":"https://onlylabs.fyi/opportunities.json"},"analysis_playbook":{"objective":"Turn new repository signals into early evidence of tooling, eval, infrastructure, model-adjacent, or product work before it appears in polished launch channels.","evidence_focus":["repo name","owner","description","language","stars","source URL","first seen time","data, eval, infra, safety, and product terms"],"extraction_questions":["What technical area does this repository expose?","Does the repo imply eval, data, infrastructure, agent, or deployment work?","Is the repo new evidence for a lab direction that is not yet in writing or releases?","Which related signals should an analyst inspect next?"],"signal_questions":["What does this new repository reveal before a formal announcement exists?","What technical area does this repository expose?","Does the repo imply eval, data, infrastructure, agent, or deployment work?","Which data-business lane explains this signal: Safety and policy?","Do the 6 related repo signals show a repeated pattern?"],"output_fields":["org","repo","technical_theme","data_business_lane","evidence_url"],"data_business_relevance":"New repositories can expose organization build priorities early, especially around internal tooling, eval infrastructure, data systems, deployment, and agent workflows.","required_sources":[{"label":"signal_json","url":"https://onlylabs.fyi/signals/c8ec5d05-7a41-4239-bc38-38ed94fb0e07/signal.json","required":true},{"label":"source","url":"https://github.com/microsoft/msticpy","required":true},{"label":"dossier_json","url":"https://onlylabs.fyi/labs/microsoft/dossier.json","required":true},{"label":"analysis_evidence_json","url":"https://onlylabs.fyi/analysis/microsoft/evidence.json","required":true},{"label":"topic_signals_json","url":null,"required":false},{"label":"data_radar_json","url":"https://onlylabs.fyi/data-radar.json","required":true}],"expected_output":["one-paragraph source-grounded interpretation","data-business implication","confidence and missing evidence","recommended next source to inspect"],"prompt_seed":"Using only the linked onlylabs JSON, captured source context, and cited evidence, analyze Microsoft's repo signal \"microsoft/msticpy\" for frontier lab strategy and data-business implications."},"semantic_triples":[{"subject":"Microsoft","predicate":"published repo","object":"microsoft/msticpy","text":"Microsoft published repo microsoft/msticpy."},{"subject":"microsoft/msticpy","predicate":"is classified as","object":"repo signal","text":"microsoft/msticpy is classified as repo signal."},{"subject":"microsoft/msticpy","predicate":"belongs to","object":"repos desk","text":"microsoft/msticpy belongs to repos desk."},{"subject":"microsoft/msticpy","predicate":"has context","object":"Python","text":"microsoft/msticpy has context Python."},{"subject":"microsoft/msticpy","predicate":"has evidence coverage","object":"1 captured evidence page","text":"microsoft/msticpy has evidence coverage 1 captured evidence page."},{"subject":"microsoft/msticpy","predicate":"matches data-business lanes","object":"Safety and policy","text":"microsoft/msticpy matches data-business lanes Safety and policy."},{"subject":"microsoft/msticpy","predicate":"has captured page count","object":"1","text":"microsoft/msticpy has captured page count 1."},{"subject":"microsoft/msticpy","predicate":"has readable page count","object":"1","text":"microsoft/msticpy has readable page count 1."},{"subject":"microsoft/msticpy","predicate":"has related signal count","object":"6","text":"microsoft/msticpy has related signal count 6."},{"subject":"microsoft/msticpy","predicate":"has analysis playbook objective","object":"Turn new repository signals into early evidence of tooling, eval, infrastructure, model-adjacent, or product work before it appears in polished launch channels.","text":"microsoft/msticpy has analysis playbook objective Turn new repository signals into early evidence of tooling, eval, infrastructure, model-adjacent, or product work before it appears in polished launch channels.."},{"subject":"microsoft/msticpy","predicate":"has source host","object":"github.com","text":"microsoft/msticpy has source host github.com."},{"subject":"microsoft/msticpy","predicate":"has lab","object":"Microsoft","text":"microsoft/msticpy has lab Microsoft."},{"subject":"microsoft/msticpy","predicate":"has signal desk","object":"repos","text":"microsoft/msticpy has signal desk repos."},{"subject":"microsoft/msticpy","predicate":"has source host","object":"github.com","text":"microsoft/msticpy has source host github.com."},{"subject":"microsoft/msticpy","predicate":"has repository","object":"microsoft/msticpy","text":"microsoft/msticpy has repository microsoft/msticpy."},{"subject":"microsoft/msticpy","predicate":"has language","object":"Python","text":"microsoft/msticpy has language Python."},{"subject":"microsoft/msticpy","predicate":"has stars","object":"1,970","text":"microsoft/msticpy has stars 1,970."},{"subject":"microsoft/msticpy","predicate":"has radar lane","object":"Safety and policy","text":"microsoft/msticpy has radar lane Safety and policy."},{"subject":"microsoft/msticpy","predicate":"has matched term","object":"security","text":"microsoft/msticpy has matched term security."}]},"intelligence":{"signal_desk":"repos","answer":"Microsoft published microsoft/msticpy (Python). This repository signal exposes tooling, eval, infrastructure, or model-adjacent work before it may appear in a launch post. High-signal details: repo microsoft/msticpy · language Python. onlylabs links this event to 1 captured evidence page and 6 related repo signals. It also maps to Safety and policy in the data-business radar.","semantic_triples":[{"subject":"Microsoft","predicate":"published repo","object":"microsoft/msticpy","text":"Microsoft published repo microsoft/msticpy."},{"subject":"microsoft/msticpy","predicate":"is classified as","object":"repo signal","text":"microsoft/msticpy is classified as repo signal."},{"subject":"microsoft/msticpy","predicate":"belongs to","object":"repos desk","text":"microsoft/msticpy belongs to repos desk."},{"subject":"microsoft/msticpy","predicate":"has context","object":"Python","text":"microsoft/msticpy has context Python."},{"subject":"microsoft/msticpy","predicate":"has evidence coverage","object":"1 captured evidence page","text":"microsoft/msticpy has evidence coverage 1 captured evidence page."},{"subject":"microsoft/msticpy","predicate":"matches data-business lanes","object":"Safety and policy","text":"microsoft/msticpy matches data-business lanes Safety and policy."}]},"signal":{"id":"c8ec5d05-7a41-4239-bc38-38ed94fb0e07","url":"https://onlylabs.fyi/signals/c8ec5d05-7a41-4239-bc38-38ed94fb0e07","json_url":"https://onlylabs.fyi/signals/c8ec5d05-7a41-4239-bc38-38ed94fb0e07/signal.json","source_url":"https://github.com/microsoft/msticpy","title":"microsoft/msticpy","summary":"Microsoft published a new repository. onlylabs watches repos for tooling, eval, infra, and model-adjacent work.","context":"Python","kind":{"key":"repo_new","label":"Repo"},"org":{"slug":"microsoft","name":"Microsoft","category":"frontier-lab"},"occurred_at":"2019-02-21T17:30:03+00:00","first_seen_at":"2026-06-06T01:49:41.740219+00:00","date_source":"source","evidence_coverage":{"target_pages":1,"captured_pages":1,"readable_pages":1,"capture_methods":["plain"],"missing_page_urls":[],"failed_page_urls":[],"blocked_page_urls":[],"page_urls":["https://github.com/microsoft/msticpy"]},"facets":{"repo":"microsoft/msticpy","language":"Python"},"traction":{"github_stars":1970,"hn_points":null,"hn_comments":null,"hn_story_id":null,"hf_downloads":null,"hf_likes":null},"data_radar":{"lanes":[{"key":"safety","label":"Safety and policy","url":"https://onlylabs.fyi/data-radar/safety"}],"score":14,"matched_terms":["security"],"reason":"Microsoft has a repo signal matching safety and policy."}},"primary_evidence_page":{"url":"https://github.com/microsoft/msticpy","final_url":"https://github.com/microsoft/msticpy","title":"microsoft/msticpy repository metadata","http_status":200,"content_type":"application/json","capture_method":"plain","fetched_at":"2026-06-11T03:56:46.417079+00:00","bytes":23358,"raw_path":"d5ea4e7cb25d08a4d9918e6ce91836a2082e0883462058d3de420728df9aa04c.json","content_hash":"4fac4e88249e56d5140fd0bf53798a89111e9e8533596457d7c91e763a0deefd","excerpt_chars":1200,"truncated":true,"excerpt":"microsoft/msticpy Description: Microsoft Threat Intelligence Security Tools Language: Python License: NOASSERTION Stars: 1970 Forks: 332 Open issues: 11 Created: 2019-02-21T17:30:03Z Pushed: 2026-06-08T13:03:14Z Default branch: main Fork: no Archived: no README: MSTIC Jupyter and Python Security Tools ![GitHub Actions build](https://github.com/microsoft/msticpy/actions/workflows/python-package.yml/badge.svg?branch=main) [![Azure Pipelines build](https://dev.azure.com/mstic-detections/mstic-jupyter/_apis/build/status/microsoft.msticpy?branchName=main)](https://dev.azure.com/mstic-detections/mstic-jupyter/_build/latest?definitionId=14&branchName=main) [![Downloads](https://pepy.tech/badge/msticpy)](https://pepy.tech/project/msticpy) Microsoft Threat Intelligence Python Security Tools. **msticpy** is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to: - query log data from multiple sources - enrich the data with Threat Intelligence, geolocations and Azure resource data - extract Indicators of Activity (IoA) from logs and unpack encoded data - perform sophisticated analysis such as anomalous session detection and time series..."},"evidence_pages":[{"url":"https://github.com/microsoft/msticpy","final_url":"https://github.com/microsoft/msticpy","title":"microsoft/msticpy repository metadata","http_status":200,"content_type":"application/json","capture_method":"plain","fetched_at":"2026-06-11T03:56:46.417079+00:00","bytes":23358,"raw_path":"d5ea4e7cb25d08a4d9918e6ce91836a2082e0883462058d3de420728df9aa04c.json","content_hash":"4fac4e88249e56d5140fd0bf53798a89111e9e8533596457d7c91e763a0deefd","excerpt_chars":1200,"truncated":true,"excerpt":"microsoft/msticpy Description: Microsoft Threat Intelligence Security Tools Language: Python License: NOASSERTION Stars: 1970 Forks: 332 Open issues: 11 Created: 2019-02-21T17:30:03Z Pushed: 2026-06-08T13:03:14Z Default branch: main Fork: no Archived: no README: MSTIC Jupyter and Python Security Tools ![GitHub Actions build](https://github.com/microsoft/msticpy/actions/workflows/python-package.yml/badge.svg?branch=main) [![Azure Pipelines build](https://dev.azure.com/mstic-detections/mstic-jupyter/_apis/build/status/microsoft.msticpy?branchName=main)](https://dev.azure.com/mstic-detections/mstic-jupyter/_build/latest?definitionId=14&branchName=main) [![Downloads](https://pepy.tech/badge/msticpy)](https://pepy.tech/project/msticpy) Microsoft Threat Intelligence Python Security Tools. **msticpy** is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to: - query log data from multiple sources - enrich the data with Threat Intelligence, geolocations and Azure resource data - extract Indicators of Activity (IoA) from logs and unpack encoded data - perform sophisticated analysis such as anomalous session detection and time series..."}],"related_signals":[{"id":"8afe79f4-378b-4748-9e2a-3cf5e3253fdb","url":"https://onlylabs.fyi/signals/8afe79f4-378b-4748-9e2a-3cf5e3253fdb","source_url":"https://github.com/microsoft/Dev-Trio","title":"microsoft/Dev-Trio","context":null,"kind":{"key":"repo_new","label":"Repo"},"org":{"slug":"microsoft","name":"Microsoft","category":"frontier-lab"},"occurred_at":"2026-06-08T03:41:01+00:00","first_seen_at":"2026-06-08T07:01:04.198092+00:00","date_source":"source"},{"id":"9e75fa50-dba7-4b77-9faf-166c323e3dff","url":"https://onlylabs.fyi/signals/9e75fa50-dba7-4b77-9faf-166c323e3dff","source_url":"https://github.com/microsoft/amplifier-app-paperclip","title":"microsoft/amplifier-app-paperclip","context":"TypeScript","kind":{"key":"repo_new","label":"Repo"},"org":{"slug":"microsoft","name":"Microsoft","category":"frontier-lab"},"occurred_at":"2026-06-04T21:13:41+00:00","first_seen_at":"2026-06-05T20:58:41.438741+00:00","date_source":"source"},{"id":"76cacf33-54b2-4074-bec0-23944d8fb67c","url":"https://onlylabs.fyi/signals/76cacf33-54b2-4074-bec0-23944d8fb67c","source_url":"https://github.com/microsoft/create-github-app-token-via-key-vault","title":"microsoft/create-github-app-token-via-key-vault","context":"TypeScript","kind":{"key":"repo_new","label":"Repo"},"org":{"slug":"microsoft","name":"Microsoft","category":"frontier-lab"},"occurred_at":"2026-06-04T18:22:49+00:00","first_seen_at":"2026-06-05T20:58:41.438741+00:00","date_source":"source"},{"id":"b2f7bcbd-9db3-4785-8a2a-2e0e0cb22ed2","url":"https://onlylabs.fyi/signals/b2f7bcbd-9db3-4785-8a2a-2e0e0cb22ed2","source_url":"https://github.com/microsoft/Enterprise-AI-Analytics-Pipeline","title":"microsoft/Enterprise-AI-Analytics-Pipeline","context":null,"kind":{"key":"repo_new","label":"Repo"},"org":{"slug":"microsoft","name":"Microsoft","category":"frontier-lab"},"occurred_at":"2026-06-04T16:48:58+00:00","first_seen_at":"2026-06-05T20:58:41.438741+00:00","date_source":"source"},{"id":"51a9ec5d-5f14-45d9-b57a-db362b5d1ace","url":"https://onlylabs.fyi/signals/51a9ec5d-5f14-45d9-b57a-db362b5d1ace","source_url":"https://github.com/microsoft/fabric-org-app-template","title":"microsoft/fabric-org-app-template","context":"TypeScript","kind":{"key":"repo_new","label":"Repo"},"org":{"slug":"microsoft","name":"Microsoft","category":"frontier-lab"},"occurred_at":"2026-06-03T18:26:42+00:00","first_seen_at":"2026-06-05T20:58:41.438741+00:00","date_source":"source"},{"id":"f26025da-153f-4d27-851c-7b4892602810","url":"https://onlylabs.fyi/signals/f26025da-153f-4d27-851c-7b4892602810","source_url":"https://github.com/microsoft/amplifier-bundle-amplifier-online","title":"microsoft/amplifier-bundle-amplifier-online","context":null,"kind":{"key":"repo_new","label":"Repo"},"org":{"slug":"microsoft","name":"Microsoft","category":"frontier-lab"},"occurred_at":"2026-06-03T17:26:20+00:00","first_seen_at":"2026-06-05T20:58:41.438741+00:00","date_source":"source"}]}