Threat hunting — hypothesis discipline

This skill encodes the rigour of hypothesis-driven hunting (ABLE framework, scoring, anti-pattern checks) and the conversion path from validated hunts into OpenTide content. For language- or platform-level mechanics see the relevant skills (kusto-query-language, microsoft-sentinel, microsoft-defender-endpoint, splunk-spl-processing, etc.). For converting validated hunts into deployable rules, see detection-engineering.

OpenTide bridge:

• Hunt hypothesis ↔ TVM chaining/terrain narrative + DOM analytic intent.
• Hunt queries ↔ DOM signals (logical specification) and MDR configurations.* (deployable expression).
• Hunt verdict ↔ DOM/MDR maturity progression and TVM evidence updates.

1. Hypothesis lifecycle