Cyber Threat Hunting

Priority: P0 (CRITICAL)

Preserve provenance and bound every conclusion to authorized evidence.

Structure

Input: falsifiable hypothesis, behavior, entities, scope, sources, window, expected signal, stop condition. Process: define positive/negative observations; normalize without overwriting originals; test narrowest evidence; correlate by entity/time; record gaps and alternatives. Output: status, cited evidence, bounded conclusion, limitations, owner.

Rules

• Active collection or network operations require cyber-authorization, documented scope, and runtime-proven controls; unsupported or missing scope blocks execution.
• Use controlled synthetic/offline fixtures. Preserve query/version, fixture provenance, retention, clock, identity, and source limitations.
• Status is confirmed, suspected, false-positive, blocked, or not-tested; only cited evidence supports a status.
• “No evidence found in the examined dataset/time window” is bounded negative evidence, never proof of no compromise.
• Include engagement/scope reference; skill/version/source; observation time; status; evidence references; limitations; accountable owner. Reuse shared skill IDs.

Anti-Patterns

• Never call an empty or incomplete dataset clean.
• Never treat one ambiguous hit as confirmed compromise.
• Never collect live telemetry before authorization or invent hunt metrics.