security-threat-hunting

What problem does it solve?

Guides analysts through proactive, hypothesis-driven threat hunting in Elastic Security by translating investigative questions into iterative ES|QL and Elasticsearch queries, enriching IOCs, and operationalizing detections and cases.

Core Features & Use Cases

• Hypothesis-driven hunting: Formulate hunt hypotheses (MITRE techniques, IOC-based, behavioral, anomaly-driven) and map them to the right indices and fields.
• Data source discovery: Verify availability of relevant data sources (endpoint, network, auth, cloud, DNS, file) before querying.
• Iterative ES|QL exploration: Build and refine ES|QL queries to surface suspicious hosts, processes, network connections, and brute force activity.
• IOC enrichment and pivoting: Enrich discovered IPs/domains/hashes across indices and summarize hits by host, index, or user.
• Operationalization: Convert validated hunt queries into detection rules, create cases with attached evidence, or add exceptions when appropriate.

Quick Start

Ask the skill to hunt for unusual PowerShell execution across endpoint logs in the last 7 days and return findings with suggested detections.