skills.rest
OpenTideHQ
OpenTideHQOFFICIAL
Explore all skills by this author →
WebsiteGitHub

threat-hunting

Generates and scores hypothesis-driven threat hunts using the ABLE framework and evidence-platform mapping.

Updated Jun 24, 2026
Search Tags:#hypothesis#threat hunting#siem#edr#mitre att&ck#detection engineering#able framework
One-click install
npx skills add https://github.com/opentidehq/skills --skill threat-hunting-opentidehq
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: threat-hunting
Source: https://github.com/opentidehq/skills/tree/main/skills/threat-hunting
Command: npx skills add https://github.com/opentidehq/skills --skill threat-hunting-opentidehq

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security teams often run ad-hoc hunts that lack rigor: vague hypotheses, unscored priorities, missing source citations, and no path from a validated hunt to a production detection. This Skill enforces a disciplined hypothesis lifecycle so hunts are specific, testable, traceable to intelligence, and convertible into deployable detections. ## Core Features & Use Cases - ABLE Hypothesis Framework: Structures every hunt around Actor, Behaviour, Location, and Evidence, with completeness checks and data-gap registration when telemetry is missing. - Scoring & Prioritization: Scores confidence, relevance, priority, and effort with defined criteria, plus anti-pattern checks (tautology, kitchen-sink, orphan, technology hunt, time traveler). - Hunt-to-Detection Bridge: Converts validated hunts into OpenTide TVM/DOM/MDR objects via a 7-step conversion process, and feeds blind spots back into data requirements. - Use Case: Given a CTI report describing an actor's lateral movement TTP, generate an ABLE-complete hypothesis with verbatim source quotes, map evidence to EDR and SIEM telemetry, score it, execute per-platform queries, classify results, and convert a confirmed hunt into a production detection rule. ## Quick Start Use the threat-hunting skill to turn this threat intelligence report into a scored, ABLE-complete hunt hypothesis with evidence mapping and a verdict workflow.

Frequently Asked Questions about threat-hunting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a threat hunting hypothesis from threat intelligence?▼

Extract each discrete threat-behaviour claim from the intelligence, then apply the ABLE framework: name the Actor, map the Behaviour to MITRE ATT&CK, define the Location, and identify the Evidence telemetry. Score confidence and relevance, attach verbatim source quotes, and run the anti-pattern self-review before locking the hypothesis.

What is the ABLE framework in threat hunting?▼

ABLE stands for Actor, Behaviour, Location, and Evidence — the four components every hunt hypothesis must define. A 4/4 score proceeds directly; missing Evidence triggers a data-gap check, and hypotheses scoring 2/4 or lower should not be created.

How do I choose between EDR and SIEM telemetry for a hunt?▼

Map each behavioural component to its evidence domain: process and file activity goes to EDR, while identity, cloud, and network appliance logs go to SIEM platforms. Cross-platform hypotheses are valid, but author separate queries per platform and never attempt cross-platform joins.

When is a threat hunt verdict REFUTED versus INCONCLUSIVE?▼

REFUTED requires all queries to run successfully with zero true positives — it is a strong claim. If any query failed with a syntax error, timed out, or was blocked by quota or auth issues, the verdict is INCONCLUSIVE or NOT_EXECUTED instead.

How do I convert a validated hunt into a production detection rule?▼

A hunt with confirmed true positives and tuned filters follows a 7-step conversion: adjust time filters, add entity output columns, reduce false positives from hunt observations, test with frequency lookback, map entities, set conservative response actions, and handle NRT constraints.

What happens when telemetry for a hypothesis is missing?▼

Register a data_gap with an impact rating: PARTIAL_COVERAGE lets you proceed with noted limitations, BLIND_SPOT downgrades confidence, and HYPOTHESIS_BLOCKED means the hunt can only be created at LOW confidence with an expected INCONCLUSIVE verdict.

Related Skills

Explore More Software Engineering Skills→
AxxxxxxaaannAxxxxxxaaann

analyzing-threat-actor-ttps-with-mitre-attack

Map threat actor techniques to MITRE ATT&CK and generate ATT&CK Navigator layers.

Community
Advanced
robit-manrobit-man

sigma-hunting

Applies Sigma detection rules to logs and converts them to Elasticsearch, Splunk, and grep queries.

Community
Advanced
woohyun212woohyun212
21

siem-rule

Convert threat objectives into Sigma rules and cross-platform SIEM detection queries.

Community
Advanced
GhostPWNGhostPWN
4

Threat Hunting & IOC Analysis

Extract and normalize indicators of compromise from threat reports.

Official
Advanced