# OTRF/ThreatHunter-Playbook

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

Repository: https://github.com/OTRF/ThreatHunter-Playbook
Canonical: https://ross.abutalabs.com/products/threathunter-playbook
Language: Python
License: MIT
License Family: permissive
Topics: threat-hunting, sysmon, hunting-campaigns, hypothesis, hunting, dfir, hunter, mitre-attack-db, mitre
Last push: 2026-01-12T00:17:37+00:00

## Health v2 (maintenance only)
Score: 60/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 61, release rhythm 35, longevity 100
- inputs: {"age_days": 3445, "days_push": 234, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 4643, forks 860 (observed 2026-08-28T04:08:55.511613+00:00)

## What it is
A community-driven open-source collection of threat hunting playbooks documenting adversary tradecraft, detection logic, and hunt hypotheses organized by MITRE ATT&CK. Hunts are expressed as interactive Jupyter notebooks that can be executed against pre-recorded security datasets locally or via BinderHub.

## Use cases
- learn how to plan and execute threat hunts
- find detection logic for specific MITRE ATT&CK techniques
- practice threat hunting with pre-recorded security datasets
- build hunt hypotheses based on adversary tradecraft
- run interactive hunting notebooks in Jupyter or Binder
- standardize threat hunting workflows across a security team

## When to choose
- you want structured, repeatable threat hunting methodology grounded in MITRE ATT&CK
- you need executable hunt notebooks paired with sample security datasets for validation
- you are building detection engineering or DFIR skills and want community-vetted tradecraft examples

## When to avoid
- you need a production SIEM or automated detection deployment tool rather than hunting documentation
- you require real-time telemetry collection or alerting, which this project does not provide

## Facets
- artifact type: learning-resource
- maturity: active
- function: security, documentation, analytics
- domain: security, developer-tools, tutorials
- platform: python, cross-platform
- tags: threat-hunting, mitre-attack, dfir, sysmon, jupyter-notebooks, detection-engineering, security-datasets

## Member repositories
- OTRF/ThreatHunter-Playbook (main) score 60

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:55.511613+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:19:32.897356+00:00, confidence not recorded.
  - readme: https://github.com/OTRF/ThreatHunter-Playbook (fetched 2026-08-28T04:08:55.511613+00:00, sha 7c0da53e2078)
- Data as of 2026-08-30T08:39:29.467469+00:00.