Conduct hypothesis-driven threat hunts across SIEM and telemetry sources with GTI enrichment.
npx skills add https://github.com/dandye/ai-runbooks --skill hunt-threat
Please help me install this Agent Skill. Skill: hunt-threat Source: https://github.com/dandye/ai-runbooks/tree/main/skills/hunt-threat Command: npx skills add https://github.com/dandye/ai-runbooks --skill hunt-threat
Proactive threat hunting based on threat intelligence, TTPs, or anomalies is complex and time-consuming; this skill provides a structured approach for Tier 3 analysts and threat hunters to generate hypotheses and conduct iterative investigations.
Provide a HUNT_HYPOTHESIS and scope, then initiate initial GTI-enriched queries and begin recording findings.
High-intent search queries and answers about installing and using this skill.
Hypothesis-driven threat hunting uses threat intelligence, TTPs, or anomalies to guide targeted searches. Analysts formulate hypotheses from GTI reports, execute iterative SIEM queries, pivot on findings, and document results to produce actionable findings.
Conduct iterative threat hunts by formulating advanced SIEM queries, applying GTI enrichment, and pivoting across telemetry data. This structured approach establishes a hunt case ID, tracks findings from hypothesis to resolution, and continuously documents results.
Yes, you can initiate proactive threat hunting using observed actor TTPs or anomalies. When a new IOC or TTP is observed, launch a focused hunt to validate presence across targets, apply GTI enrichment, and pivot on findings.
The best way to document threat hunting results is through comprehensive hunt-case tracking from hypothesis to resolution. Establish a hunt case ID, record iterative queries, document pivots, and include GTI enrichment results for actionable findings.
Yes, threat hunting with GTI enrichment is designed for Tier 3 analysts and threat hunters. It provides a structured approach to generate hypotheses and conduct iterative investigations using advanced queries across SIEM and telemetry sources.
To start a threat hunt when a new IOC is observed, provide a hunt hypothesis and scope, then initiate initial GTI-enriched queries. Establish a hunt case ID and begin recording findings and pivots across telemetry sources.
dandyeIntegrate threat actor profiles and intelligence to locate and report on IoCs and MITRE techniques in real-time network traffic.
zenobi-usCoordinate incident response for security breaches and operational incidents.
dandyeAggregate GTI reports, SIEM findings, and related entities for a single IOC.
SanctifiedOpsMonitor Solana wallet activity and send alerts across multiple channels.
