{"repo":"Nebulock-Inc/agentic-threat-hunting-framework","free":true,"listed":false,"github":"https://github.com/Nebulock-Inc/agentic-threat-hunting-framework","clone":"git clone https://github.com/Nebulock-Inc/agentic-threat-hunting-framework.git","description":"ATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.","language":"Python","stars":361,"topics":["agentic-ai","ai-agents","automation","cybersecurity","detection-engineering","security","siem","threat-hunting","thrunting","threat-analysis"],"license":"MIT","category":"security-tools","readme_excerpt":"Agentic Threat Hunting Framework (ATHF) Quick Start • Installation • Documentation • Examples Give your threat hunting program memory and agency. The Agentic Threat Hunting Framework (ATHF) is the memory and automation layer for your threat hunting program. It gives your hunts structure, persistence, and context - making every past investigation accessible to both humans and AI. ATHF works with any hunting methodology (PEAK, TaHiTI, or your own process). It's not a replacement; it's the layer that makes your existing process AI-ready. What is ATHF? ATHF provides structure and persistence for threat hunting programs. It's a markdown-based framework that: - Documents hunts using the LOCK pattern (Learn → Observe → Check → Keep) - Maintains a searchable repository of past investigations - Enables AI assistants to reference your environment and previous work - Works with any SIEM/EDR platform - NEW: Includes AI-powered research and hypothesis generation agents (v0.3.0+) The Problem Most threat hunting programs lose valuable context once a hunt ends. Notes live in Slack or tickets, queries are written once and forgotten, and lessons learned exist only in analysts' heads. Even AI tools start from zero every time without access to your environment, your data, or your past hunts. ATHF changes that by giving your hunts structure, persistence, and context. Read more: docs/why-athf.md The LOCK Pattern Every threat hunt follows the same basic loop: Learn → Observe → Check → Keep . - Lear","default_branch":null,"files":null,"tree":[],"storefront":"/r/Nebulock-Inc","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/Nebulock-Inc/agentic-threat-hunting-framework/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}