hunt-threat

What problem does it solve?

Proactive threat hunting based on threat intelligence, TTPs, or anomalies is complex and time-consuming; this skill provides a structured approach for Tier 3 analysts and threat hunters to generate hypotheses and conduct iterative investigations.

Core Features & Use Cases

• Hypothesis-driven hunting using GTI reports and observed anomalies to guide targeted searches.
• Iterative search and pivoting across SIEM, telemetry, and enrichment data to uncover leads.
• Comprehensive documentation and hunt-case tracking from hypothesis to resolution, including GTI enrichment results.
• Use Case: When a new IOC or actor TTP is observed, launch a focused hunt to validate presence across targets and pivot on findings.

Quick Start

Provide a HUNT_HYPOTHESIS and scope, then initiate initial GTI-enriched queries and begin recording findings.