MSTICpy is a Python library for cybersecurity threat hunting and investigation, primarily designed for use in Jupyter Notebooks. It provides a unified interface to query multiple data sources (Azure Sentinel, Splunk, Kusto, MDE, etc.), enrich data with threat intelligence and geolocation, perform anomaly detection and process tree analysis, and visualize results with interactive timelines, maps, and graphs. The architecture follows a modular, plugin-based design: data drivers abstract away backend-specific protocols, threat intelligence providers are registered via a consistent base class, and a pivot framework dynamically attaches investigation functions to entity types. The library also includes configuration editors, Azure authentication helpers, and notebook widgets to streamline analyst workflows. While the core purpose is security analysis, the repository also contains substantial research-oriented components, such as anomalous sequence detection (Markov models on command sessions), time-series anomaly detection, and event clustering. These are packaged alongside the production-grade query and enrichment infrastructure, making the repo a hybrid of an application library and a data analysis toolkit. The codebase is well-tested with extensive unit and integration tests, though many require mocked or optional external services. Key entry points include the `QueryProvider` class for data acquisition, `TILookup` for threat intelligence, `Pivot` for entity-driven investigations, and the `mp` pandas accessor for inline transformations. External dependencies span Azure SDK, Bokeh, ipywidgets, and multiple third-party APIs, which introduces some maintenance overhead. Overall, MSTICpy is a mature, actively maintained tool that demonstrates strong engineering practices with reusable patterns, but some modules show signs of version drift and compatibility workarounds.