Threat Hunting & IOC Analysis

Evidence contract

The bundled mapper is a limited legacy ATT&CK v14 subset. --attack-version selects Navigator output metadata, not a database update. Resolve actor-to-technique relationships from a separately sourced dataset and supply the resulting IDs with --input; there is no --actor lookup. Generated SIEM queries require backend testing.

Separate observed, inferred, and unverified conclusions. For each finding, record the source/artifact reference, SHA-256 when a file is available, collection time, validation performed, limitations, and next verification step. Extraction confidence is not maliciousness confidence; unknown maliciousness stays unknown. Generated queries/rules are unverified until tested against the intended backend and labeled positive/negative fixtures. Never present simulated results as live evidence.