Identify Relevant Data Sources

This skill translates a structured hunt hypothesis into a set of candidate data sources that could realistically capture the behavior being investigated.

It is executed after the hunt focus has been defined and before analytics are written or queries are executed.

Workflow

• You MUST complete each step in order and MUST NOT proceed until the current step is complete.
• You MUST NOT read reference documents unless the current step explicitly instructs you to do so.
• You MUST NOT write queries or perform data analysis in this skill.
• Do NOT introduce new research about system internals or adversary tradecraft.

Step 1: Interpret the Hunt Focus

Understand the investigative intent defined by the hunt hypothesis.