olafhartong/ThreatHunting

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1188 stars · 179 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Splunk app with dashboards and over 130 pre-built search reports mapped to the MITRE ATT&CK framework to guide threat hunting. It requires Sysmon data ingested into Splunk and provides an ATT&CK navigator layer of all its hunts.

Use cases

• hunt for threats in Sysmon logs with Splunk
• map detection searches to MITRE ATT&CK
• find initial indicators of compromise in endpoint telemetry
• build a threat hunting program on top of Splunk
• explore ATT&CK technique coverage with dashboards

When to choose

• you already run Splunk and ingest Sysmon data
• you want ATT&CK-mapped hunting queries out of the box
• you need dashboards to triage suspicious endpoint activity

When to avoid

• you don't use Splunk or don't collect Sysmon data
• you want a fully automated detection product with no tuning
• you need actively maintained software with recent releases

Facets

application · maturity maintenance

monitoring search-engine security security monitoring developer-tools self-hosted splunk mitre-attack threat-hunting dfir sysmon siem web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="olafhartong/ThreatHunting")