Nebulock-Inc/agentic-threat-hunting-framework

Agentic Threat Hunting Framework (ATHF)

What it is – A Python‑based, markdown‑driven framework that adds memory and automation to any threat‑hunting workflow. It stores each hunt using the LOCK pattern (Learn → Observe → Check → Keep) so that past investigations are searchable and can be referenced by large‑language‑model (LLM) assistants.

Key capabilities

• Structured documentation – hunts are saved as markdown files following the LOCK template.
• Searchable repository – full‑text and MITRE ATT&CK‑aware search across all hunts.
• AI‑ready – optional agents can generate research, hypotheses, and even run queries on SIEM/EDR tools via the MCP integration.
• Maturity model – five levels (ad‑hoc → documented → searchable → generative → fully agentic) that guide incremental adoption.
• CLI – athf command provides init, research, hunt creation, validation, stats, ATT&CK look‑ups, and an MCP server for LLM tools.
• Extensible – plug‑in style agents, optional mitreattack-python for live ATT&CK data, and a local MCP server that exposes 17 tools to any AI coding assistant (Claude, Copilot, Cursor, etc.).

Installation

# From PyPI (recommended)
pip install agentic-threat-hunting-framework

# Or from source
git clone https://github.com/Nebulock-Inc/agentic-threat-hunting-framework
cd agentic-threat-hunting-framework
pip install -e .

Optional extras:

• pip install 'agentic-threat-hunting-framework[attack]' – live ATT&CK data.
• pip install 'agentic-threat-hunting-framework[mcp]' – MCP server dependencies.

Quick start

athf init                     # set up a workspace
athf research new --topic "LSASS dumping" --technique T1003.001
athf hunt new --technique T1003.001 --title "LSASS Credential Dumping" --research R-0001

The CLI also supports listing, searching, validating, and generating statistics for hunts and research documents.

Who it’s for – Security teams that already have a hunting methodology (e.g., PEAK, TaHiTI) and want a lightweight way to capture, recall, and eventually automate that work with LLM assistance. It is not a full‑blown SIEM or EDR product; it is a framework that sits on top of existing tools.

Community & docs – Full documentation lives in the docs/ folder (why ATHF, LOCK pattern, maturity model, CLI reference, integration guides). The project is open‑source under MIT, welcomes forks, and provides a GitHub Discussions space for questions.

---

All details are taken directly from the repository’s README; no additional features are inferred.