HuntPack

Turning news and threat reports into detections, alerts, and mitigating controls takes a lot of time. These HuntPacks do it in one self-contained file per threat: a threat overview and MITRE ATT&CK mapping, queries for CrowdStrike that open straight in your own Falcon instance and, in newer packs, SentinelOne PowerQuery to copy into your console, the IOCs worth searching, triage steps, and the hardening that closes the gap.

Big caveat: because these packs are automated, treat the queries as starting points, not finished detections. Validate field names and tune for false positives in your own environment before relying on anything. Your data model and noise profile will differ from mine.

hunts 327queries 2873ATT&CK 433CVEs 250latest 2026-11-04RSSView on GitHub
Hunt library · newest and recently updated

No hunts match your search.