agentic-threat-hunting-framework

What the README says you get

• AI
  AI assistant context recallEnables AI assistants to reference your environment and previous work
• AI
  AI research and hypothesis agentsIncludes AI-powered research and hypothesis generation agents
• API
  MCP serverMCP Server (NEW in v0.11.0)
• API
  MCP tool exposureExposes 17 tools: hunt management, semantic search, ATT&CK coverage, research, investigations, and AI-powered hypothesis generation
• Other
  LOCK hunt documentationDocuments hunts using the LOCK pattern (Learn → Observe → Check → Keep)
• Other
  Searchable hunt repositoryMaintains a searchable repository of past investigations
• Other
  SIEM/EDR platform agnosticWorks with any SIEM/EDR platform
• Other
  GATES detection validationvalidates whether your findings should be promoted to production detections
• Other
  Hunt-to-detection promotionproceed to ADEF for production detection engineering
• Other
  Hunt management CLIATHF includes a full-featured CLI for managing your hunts
• Other
  ATT&CK data managementATT&CK Data Management (NEW in v0.11.0)
• Other
  Pure markdown optionPure Markdown (No Installation)
• Other
  Example huntsView example hunts
• Other
  Featured macOS stealer huntH-0001: macOS Information Stealer Detection

Extracted from the kit's README by a local AI model (deepseek-flash) on Oct 12, 2026. Every item is checked against an exact README quote. A README claim is the maker's description, not something we tested.