How sims718718/unifiedthreathunting works
This repository is a documented threat-hunting process and its working resources, not an executable application. Its central workflow runs from environment context and a triggering event through hypothesis, assessment, planning, execution, and reporting. The README explicitly connects data exploration and threat intelligence to the process, and describes maturity metrics and detection handoff as program capabilities. Supporting query, planner, and reference files are represented, but their internal relationships are limited to what the README documents; no source excerpts were available.
Main entry points: README.md Hunt execution · Intelligence-Led_Threat_Hunting.md Threat intelligence · Data_Analysis_Threat_Hunting.md Data analysis · threat-hunt-planner (2).skill Hunt planner skill
Components 24
Hunt lifecycle
- Environment context
README.md - Triggering event
README.md - Hypothesis development
README.md - Initial assessment
README.md - Feasibility gate
README.md - Scope and hunt plan
README.md - Hunt execution
README.md
Intelligence and analysis
- Threat intelligence
Threat_Intelligence/Intelligence-Led_Threat_Hunting.md - Data analysis
Data_Analysis/Data_Analysis_Threat_Hunting.md - Baselining
Data_Analysis/baselining_Threat_Hunters_Perspective.md - Hypothesis rubric
references/hypothesis_rubric.md - Telemetry gap assessment
references/telemetry_gap_assessment.md - Modern domain matrix
docs/modern_domain_matrix.md
Hunt execution resources
- Hunt planner skill
Threat_Hunt_Planner_Skill/threat-hunt-planner (2).skill - Planner user guide
Threat_Hunt_Planner_Skill/threat_hunt_planner_user_guide.md - Defender queries
ThreatHuntingQueries/Microsoft_Defender_for_EndPoint - VMware SPL queries
ThreatHuntingQueries/SPL - Hunt example
examples/hunt_example_asep_roasting.md
Outcomes and improvement
- Report and iterate
README.md - Detection engineering
Detection_Engineering_Meets_ThreatHunting/Signal-Based_Threat_Hunting.md - Detection handoff
references/detection_handoff_spec.md - Validation hook
references/validation_hook.md - Maturity metrics
docs/maturity_metric.md
Other components
- Hunt team
Connections 25
- Hunt team → Environment context: captures
- Environment context → Triggering event: informs
- Triggering event → Hypothesis development: initiates
- Hypothesis development → Initial assessment: assessed by
- Initial assessment → Feasibility gate: evaluated at
- Feasibility gate → Scope and hunt plan: gates
- Scope and hunt plan → Hunt execution: plans
- Hunt execution → Report and iterate: documents outcomes
- Report and iterate → Triggering event: iterates to
- Threat intelligence → Triggering event: can trigger
- Threat intelligence → Hypothesis development: informs
- Data analysis → Hunt execution: supports exploration
- Baselining → Data analysis: supports
- Planner user guide → Hunt planner skill: guides use
- Hunt planner skill → Scope and hunt plan: supports planning
- Defender queries → Hunt execution: provides queries
- VMware SPL queries → Hunt execution: provides queries
- Hunt example → Hunt execution: illustrates
- Hypothesis rubric → Hypothesis development: supports review
- Telemetry gap assessment → Feasibility gate: informs
- Detection engineering → Detection handoff: supports handoff
- Report and iterate → Detection handoff: specifies handoff
- Validation hook → Report and iterate: supports validation
- Maturity metrics → Report and iterate: measures progress
- Modern domain matrix → Environment context: supports context