skills.rest
patrykkopycinski
patrykkopycinskiCOMMUNITY
Explore all skills by this author →
GitHub

security-threat-hunting

Translate threat hypotheses into ES|QL and Elasticsearch queries.

6|Updated Feb 20, 2026
Search Tags:#security#elasticsearch#detection-engineering#incident-response#threat-hunting#esql#ioc-enrichment
One-click install
npx skills add https://github.com/patrykkopycinski/elastic-cursor-plugin --skill security-threat-hunting
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-threat-hunting
Source: https://github.com/patrykkopycinski/elastic-cursor-plugin/tree/main/skills/security-threat-hunting
Command: npx skills add https://github.com/patrykkopycinski/elastic-cursor-plugin --skill security-threat-hunting

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Guides analysts through proactive, hypothesis-driven threat hunting in Elastic Security by translating investigative questions into iterative ES|QL and Elasticsearch queries, enriching IOCs, and operationalizing detections and cases.

Core Features & Use Cases

  • Hypothesis-driven hunting: Formulate hunt hypotheses (MITRE techniques, IOC-based, behavioral, anomaly-driven) and map them to the right indices and fields.
  • Data source discovery: Verify availability of relevant data sources (endpoint, network, auth, cloud, DNS, file) before querying.
  • Iterative ES|QL exploration: Build and refine ES|QL queries to surface suspicious hosts, processes, network connections, and brute force activity.
  • IOC enrichment and pivoting: Enrich discovered IPs/domains/hashes across indices and summarize hits by host, index, or user.
  • Operationalization: Convert validated hunt queries into detection rules, create cases with attached evidence, or add exceptions when appropriate.

Quick Start

Ask the skill to hunt for unusual PowerShell execution across endpoint logs in the last 7 days and return findings with suggested detections.

Frequently Asked Questions about security-threat-hunting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I use ES|QL for threat hunting in Elasticsearch?▼

ES|QL threat hunting translates investigative hypotheses into iterative queries to surface suspicious hosts, processes, network connections, and brute force activity across Elastic Security indices.

What is hypothesis-driven threat hunting and how does it work with Elastic Security?▼

Hypothesis-driven threat hunting involves formulating hunt hypotheses based on MITRE techniques, IOCs, or anomalies, then mapping them to right indices and fields to locate suspicious activity.

How do I enrich IOCs across Elasticsearch indices during incident response?▼

IOC enrichment pivots discovered IPs, domains, and hashes across multiple indices, summarizing hits by host, index, or user to expand incident response context.

Do I need an ES_API_KEY to run ES|QL threat hunting queries?▼

Yes, interactive threat hunting requires ES_URL and ES_API_KEY access to the cluster to run esql_query, elasticsearch_api, discover_security_data, manage_detection_rules, and manage_cases integrations.

Can I convert validated threat hunting queries into detection rules in Elastic Security?▼

Yes, validated hunt queries can be operationalized by converting them into detection rules, creating cases with attached evidence, or adding exceptions when appropriate.

What's the best way to discover relevant data sources before threat hunting in Elastic?▼

Data source discovery verifies availability of endpoint, network, authentication, cloud, DNS, and file logs before querying, ensuring relevant fields exist for accurate threat hunting.

Related Skills

Explore More Data & Analytics Skills→
davidgeorgehopedavidgeorgehope
27

elasticsearch

Manage Elasticsearch and Kibana operations via REST API calls.

Community
Advanced
jc180105jc180105

Threat Detection Engineer

Author Sigma detection rules mapped to MITRE ATT&CK techniques.

Community
Advanced
patrykkopycinskipatrykkopycinski
6

security-alert-triage

Automate end-to-end security alert triage within Elastic Security.

Community
Advanced
elasticelastic
546

security-alert-triage

Automate triage of Elastic Security alerts with ES|QL queries and case management.

Official
Advanced