# sims718718/unifiedthreathunting architecture

> Architecture diagram of the GitHub repository sims718718/unifiedthreathunting, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/sims718718/unifiedthreathunting
- Repository: https://github.com/sims718718/unifiedthreathunting

## Overview

This repository is a documented threat-hunting process and its working resources, not an executable application. Its central workflow runs from environment context and a triggering event through hypothesis, assessment, planning, execution, and reporting. The README explicitly connects data exploration and threat intelligence to the process, and describes maturity metrics and detection handoff as program capabilities. Supporting query, planner, and reference files are represented, but their internal relationships are limited to what the README documents; no source excerpts were available.

Main entry points: [`README.md`](https://github.com/sims718718/unifiedthreathunting/blob/main/README.md) (Hunt execution), [`Threat_Intelligence/Intelligence-Led_Threat_Hunting.md`](https://github.com/sims718718/unifiedthreathunting/blob/main/Threat_Intelligence/Intelligence-Led_Threat_Hunting.md) (Threat intelligence), [`Data_Analysis/Data_Analysis_Threat_Hunting.md`](https://github.com/sims718718/unifiedthreathunting/blob/main/Data_Analysis/Data_Analysis_Threat_Hunting.md) (Data analysis), [`Threat_Hunt_Planner_Skill/threat-hunt-planner (2).skill`](https://github.com/sims718718/unifiedthreathunting/blob/main/Threat_Hunt_Planner_Skill/threat-hunt-planner%20(2).skill) (Hunt planner skill)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_lifecycle["Hunt lifecycle"]
  node_context["Environment context<br/>[README.md]"]
  node_trigger["Triggering event<br/>[README.md]"]
  node_hypothesis["Hypothesis development<br/>[README.md]"]
  node_initial_assessment["Initial assessment<br/>[README.md]"]
  node_feasibility["Feasibility gate<br/>[README.md]"]
  node_scope_plan["Scope and hunt plan<br/>[README.md]"]
  node_execution["Hunt execution<br/>[README.md]"]
end

subgraph group_analysis["Intelligence and analysis"]
  node_threat_intelligence["Threat intelligence"]
  node_data_analysis["Data analysis"]
  node_baselining["Baselining"]
  node_hypothesis_rubric["Hypothesis rubric"]
  node_telemetry_gaps["Telemetry gap assessment"]
  node_domain_matrix["Modern domain matrix"]
end

subgraph group_execution["Hunt execution resources"]
  node_planner_skill["Hunt planner skill"]
  node_planner_guide["Planner user guide"]
  node_mde_queries["Defender queries"]
  node_spl_queries["VMware SPL queries"]
  node_hunt_example["Hunt example"]
end

subgraph group_outcomes["Outcomes and improvement"]
  node_report["Report and iterate<br/>[README.md]"]
  node_detection_engineering["Detection engineering"]
  node_handoff_spec["Detection handoff"]
  node_validation_hook["Validation hook<br/>[validation_hook.md]"]
  node_maturity_metrics["Maturity metrics<br/>[maturity_metric.md]"]
end

node_hunt_team(("Hunt team"))

node_hunt_team -->|"captures"| node_context
node_context -->|"informs"| node_trigger
node_trigger -->|"initiates"| node_hypothesis
node_hypothesis -->|"assessed by"| node_initial_assessment
node_initial_assessment -->|"evaluated at"| node_feasibility
node_feasibility -->|"gates"| node_scope_plan
node_scope_plan -->|"plans"| node_execution
node_execution -->|"documents outcomes"| node_report
node_report -->|"iterates to"| node_trigger
node_threat_intelligence -->|"can trigger"| node_trigger
node_threat_intelligence -->|"informs"| node_hypothesis
node_data_analysis -->|"supports exploration"| node_execution
node_baselining -->|"supports"| node_data_analysis
node_planner_guide -->|"guides use"| node_planner_skill
node_planner_skill -->|"supports planning"| node_scope_plan
node_mde_queries -->|"provides queries"| node_execution
node_spl_queries -->|"provides queries"| node_execution
node_hunt_example -->|"illustrates"| node_execution
node_hypothesis_rubric -->|"supports review"| node_hypothesis
node_telemetry_gaps -->|"informs"| node_feasibility
node_detection_engineering -->|"supports handoff"| node_handoff_spec
node_report -->|"specifies handoff"| node_handoff_spec
node_validation_hook -->|"supports validation"| node_report
node_maturity_metrics -->|"measures progress"| node_report
node_domain_matrix -->|"supports context"| node_context

click node_context "https://github.com/sims718718/unifiedthreathunting/blob/main/README.md"
click node_trigger "https://github.com/sims718718/unifiedthreathunting/blob/main/README.md"
click node_hypothesis "https://github.com/sims718718/unifiedthreathunting/blob/main/README.md"
click node_initial_assessment "https://github.com/sims718718/unifiedthreathunting/blob/main/README.md"
click node_feasibility "https://github.com/sims718718/unifiedthreathunting/blob/main/README.md"
click node_scope_plan "https://github.com/sims718718/unifiedthreathunting/blob/main/README.md"
click node_execution "https://github.com/sims718718/unifiedthreathunting/blob/main/README.md"
click node_report "https://github.com/sims718718/unifiedthreathunting/blob/main/README.md"
click node_threat_intelligence "https://github.com/sims718718/unifiedthreathunting/blob/main/Threat_Intelligence/Intelligence-Led_Threat_Hunting.md"
click node_data_analysis "https://github.com/sims718718/unifiedthreathunting/blob/main/Data_Analysis/Data_Analysis_Threat_Hunting.md"
click node_baselining "https://github.com/sims718718/unifiedthreathunting/blob/main/Data_Analysis/baselining_Threat_Hunters_Perspective.md"
click node_detection_engineering "https://github.com/sims718718/unifiedthreathunting/blob/main/Detection_Engineering_Meets_ThreatHunting/Signal-Based_Threat_Hunting.md"
click node_planner_skill "https://github.com/sims718718/unifiedthreathunting/blob/main/Threat_Hunt_Planner_Skill/threat-hunt-planner%20(2).skill"
click node_planner_guide "https://github.com/sims718718/unifiedthreathunting/blob/main/Threat_Hunt_Planner_Skill/threat_hunt_planner_user_guide.md"
click node_mde_queries "https://github.com/sims718718/unifiedthreathunting/tree/main/ThreatHuntingQueries/Microsoft_Defender_for_EndPoint"
click node_spl_queries "https://github.com/sims718718/unifiedthreathunting/tree/main/ThreatHuntingQueries/SPL"
click node_hunt_example "https://github.com/sims718718/unifiedthreathunting/blob/main/examples/hunt_example_asep_roasting.md"
click node_handoff_spec "https://github.com/sims718718/unifiedthreathunting/blob/main/references/detection_handoff_spec.md"
click node_hypothesis_rubric "https://github.com/sims718718/unifiedthreathunting/blob/main/references/hypothesis_rubric.md"
click node_telemetry_gaps "https://github.com/sims718718/unifiedthreathunting/blob/main/references/telemetry_gap_assessment.md"
click node_validation_hook "https://github.com/sims718718/unifiedthreathunting/blob/main/references/validation_hook.md"
click node_maturity_metrics "https://github.com/sims718718/unifiedthreathunting/blob/main/docs/maturity_metric.md"
click node_domain_matrix "https://github.com/sims718718/unifiedthreathunting/blob/main/docs/modern_domain_matrix.md"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_context,node_trigger,node_hypothesis,node_initial_assessment,node_feasibility,node_scope_plan,node_execution toneBlue
class node_threat_intelligence,node_data_analysis,node_baselining,node_hypothesis_rubric,node_telemetry_gaps,node_domain_matrix toneAmber
class node_planner_skill,node_planner_guide,node_mde_queries,node_spl_queries,node_hunt_example toneMint
class node_report,node_detection_engineering,node_handoff_spec,node_validation_hook,node_maturity_metrics toneRose
class node_hunt_team toneIndigo
```

## Components

### Hunt lifecycle

- [Environment context](https://github.com/sims718718/unifiedthreathunting/blob/main/README.md): `README.md`
- [Triggering event](https://github.com/sims718718/unifiedthreathunting/blob/main/README.md): `README.md`
- [Hypothesis development](https://github.com/sims718718/unifiedthreathunting/blob/main/README.md): `README.md`
- [Initial assessment](https://github.com/sims718718/unifiedthreathunting/blob/main/README.md): `README.md`
- [Feasibility gate](https://github.com/sims718718/unifiedthreathunting/blob/main/README.md): `README.md`
- [Scope and hunt plan](https://github.com/sims718718/unifiedthreathunting/blob/main/README.md): `README.md`
- [Hunt execution](https://github.com/sims718718/unifiedthreathunting/blob/main/README.md): `README.md`

### Intelligence and analysis

- [Threat intelligence](https://github.com/sims718718/unifiedthreathunting/blob/main/Threat_Intelligence/Intelligence-Led_Threat_Hunting.md): `Threat_Intelligence/Intelligence-Led_Threat_Hunting.md`
- [Data analysis](https://github.com/sims718718/unifiedthreathunting/blob/main/Data_Analysis/Data_Analysis_Threat_Hunting.md): `Data_Analysis/Data_Analysis_Threat_Hunting.md`
- [Baselining](https://github.com/sims718718/unifiedthreathunting/blob/main/Data_Analysis/baselining_Threat_Hunters_Perspective.md): `Data_Analysis/baselining_Threat_Hunters_Perspective.md`
- [Hypothesis rubric](https://github.com/sims718718/unifiedthreathunting/blob/main/references/hypothesis_rubric.md): `references/hypothesis_rubric.md`
- [Telemetry gap assessment](https://github.com/sims718718/unifiedthreathunting/blob/main/references/telemetry_gap_assessment.md): `references/telemetry_gap_assessment.md`
- [Modern domain matrix](https://github.com/sims718718/unifiedthreathunting/blob/main/docs/modern_domain_matrix.md): `docs/modern_domain_matrix.md`

### Hunt execution resources

- [Hunt planner skill](https://github.com/sims718718/unifiedthreathunting/blob/main/Threat_Hunt_Planner_Skill/threat-hunt-planner%20(2).skill): `Threat_Hunt_Planner_Skill/threat-hunt-planner (2).skill`
- [Planner user guide](https://github.com/sims718718/unifiedthreathunting/blob/main/Threat_Hunt_Planner_Skill/threat_hunt_planner_user_guide.md): `Threat_Hunt_Planner_Skill/threat_hunt_planner_user_guide.md`
- [Defender queries](https://github.com/sims718718/unifiedthreathunting/tree/main/ThreatHuntingQueries/Microsoft_Defender_for_EndPoint): `ThreatHuntingQueries/Microsoft_Defender_for_EndPoint`
- [VMware SPL queries](https://github.com/sims718718/unifiedthreathunting/tree/main/ThreatHuntingQueries/SPL): `ThreatHuntingQueries/SPL`
- [Hunt example](https://github.com/sims718718/unifiedthreathunting/blob/main/examples/hunt_example_asep_roasting.md): `examples/hunt_example_asep_roasting.md`

### Outcomes and improvement

- [Report and iterate](https://github.com/sims718718/unifiedthreathunting/blob/main/README.md): `README.md`
- [Detection engineering](https://github.com/sims718718/unifiedthreathunting/blob/main/Detection_Engineering_Meets_ThreatHunting/Signal-Based_Threat_Hunting.md): `Detection_Engineering_Meets_ThreatHunting/Signal-Based_Threat_Hunting.md`
- [Detection handoff](https://github.com/sims718718/unifiedthreathunting/blob/main/references/detection_handoff_spec.md): `references/detection_handoff_spec.md`
- [Validation hook](https://github.com/sims718718/unifiedthreathunting/blob/main/references/validation_hook.md): `references/validation_hook.md`
- [Maturity metrics](https://github.com/sims718718/unifiedthreathunting/blob/main/docs/maturity_metric.md): `docs/maturity_metric.md`

### Other components

- **Hunt team**

## Connections

- Hunt team → Environment context: captures
- Environment context → Triggering event: informs
- Triggering event → Hypothesis development: initiates
- Hypothesis development → Initial assessment: assessed by
- Initial assessment → Feasibility gate: evaluated at
- Feasibility gate → Scope and hunt plan: gates
- Scope and hunt plan → Hunt execution: plans
- Hunt execution → Report and iterate: documents outcomes
- Report and iterate → Triggering event: iterates to
- Threat intelligence → Triggering event: can trigger
- Threat intelligence → Hypothesis development: informs
- Data analysis → Hunt execution: supports exploration
- Baselining → Data analysis: supports
- Planner user guide → Hunt planner skill: guides use
- Hunt planner skill → Scope and hunt plan: supports planning
- Defender queries → Hunt execution: provides queries
- VMware SPL queries → Hunt execution: provides queries
- Hunt example → Hunt execution: illustrates
- Hypothesis rubric → Hypothesis development: supports review
- Telemetry gap assessment → Feasibility gate: informs
- Detection engineering → Detection handoff: supports handoff
- Report and iterate → Detection handoff: specifies handoff
- Validation hook → Report and iterate: supports validation
- Maturity metrics → Report and iterate: measures progress
- Modern domain matrix → Environment context: supports context