OTRF/ThreatHunter-Playbook resource

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

4643 stars · 860 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

A community-driven open-source collection of threat hunting playbooks documenting adversary tradecraft, detection logic, and hunt hypotheses organized by MITRE ATT&CK. Hunts are expressed as interactive Jupyter notebooks that can be executed against pre-recorded security datasets locally or via BinderHub.

Use cases

• learn how to plan and execute threat hunts
• find detection logic for specific MITRE ATT&CK techniques
• practice threat hunting with pre-recorded security datasets
• build hunt hypotheses based on adversary tradecraft
• run interactive hunting notebooks in Jupyter or Binder
• standardize threat hunting workflows across a security team

When to choose

• you want structured, repeatable threat hunting methodology grounded in MITRE ATT&CK
• you need executable hunt notebooks paired with sample security datasets for validation
• you are building detection engineering or DFIR skills and want community-vetted tradecraft examples

When to avoid

• you need a production SIEM or automated detection deployment tool rather than hunting documentation
• you require real-time telemetry collection or alerting, which this project does not provide

Facets

learning-resource · maturity active

security documentation analytics security developer-tools tutorials python cross-platform threat-hunting mitre-attack dfir sysmon jupyter-notebooks detection-engineering security-datasets

Member repositories

For agents

markdown · JSON · MCP: product_card(name="OTRF/ThreatHunter-Playbook")