New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Hunt Data Source Identification

by OTRF in OTRF/ThreatHunter-Playbook

Maps a structured threat hunt hypothesis to candidate telemetry sources by semantic search over a Sentinel table catalog, before any queries are written.

MITAuto-check passedSecurity

Install Hunt Data Source Identification

skills CLI
$ npx skills add OTRF/ThreatHunter-Playbook --skill hunt-data-source-identification -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install OTRF/ThreatHunter-Playbook hunt-data-source-identification --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/OTRF/ThreatHunter-Playbook.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.github/skills/hunt-data-source-identification .claude/skills/hunt-data-source-identification && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
hunt-data-source-identification
GitHub stars
4.7k
Token cost
~813 tokens
SKILL.md length
379 words
Files
2 (incl. references)
Skills in repo
5
Repo updated
First seen
Licence
MIT

At a glance

Maps a structured threat hunt hypothesis to candidate telemetry sources by semantic search over a Sentinel table catalog, before any queries are written.

  • Works in 4 steps: Interpret the Hunt Focus → Discover Candidate Data Sources → Refine and Validate Relevance → …
  • Planning a threat hunt once the hypothesis has been written
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
  • Finding which Sentinel tables could record a given attacker behavior

What it does

This is a planning step that runs after the hunt focus is defined and before analytics or queries exist. The agent works in four ordered steps: interpret the hypothesis into the observable activity it implies, search the telemetry catalog semantically, narrow the candidates by schema relevance, and write a data source summary.

The search goes through the MS Sentinel search_tables tool using descriptions of the behavior rather than table names, and it reasons only over schemas and metadata; it never claims that data is flowing, complete or retained. The skill forbids writing queries, analyzing data or adding new research on adversary tradecraft, asks the agent to note coverage gaps and planning assumptions, and reads its summary template under references only when the final step calls for it.

When your agent uses it

  • Planning a threat hunt once the hypothesis has been written
  • Finding which Sentinel tables could record a given attacker behavior
  • Documenting telemetry gaps before building detections

Example prompts

  • “Which Sentinel tables could capture scheduled task persistence on Windows hosts?”
  • “Identify candidate data sources for my hunt hypothesis about unusual cloud role assignments.”
  • “Write the data source summary for the credential dumping hunt we just scoped.”

Requirements

  • Access to the MS Sentinel search_tables tool

Workflow steps

4 steps, taken from the step headings in SKILL.md.

  1. Interpret the Hunt Focus
  2. Discover Candidate Data Sources
  3. Refine and Validate Relevance
  4. Produce Data Source Summary

What it can do on your machine

Read from SKILL.md and the folder at commit d310f38. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Hunt Data Source Identification loads about 813 tokens when it runs, and up to ~1.2k if it reads all its reference files. Until then it costs about 108 tokens; SKILL.md has 379 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~108
When it runs · the whole SKILL.md, loaded when a task matches
~813
With references · SKILL.md plus every file in references/, read only if the agent opens them
~1.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from OTRF/ThreatHunter-Playbook at commit d310f38, republished under its MIT licence (© OTRF). 379 words, ~813 tokens.

Download SKILL.mdSave it as .claude/skills/hunt-data-source-identification/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
hunt-data-source-identification
description
Identify relevant security data sources that could capture the behavior defined in a structured hunt hypothesis. Use this skill after the hunt focus has been defined to translate investigative intent into candidate telemetry sources using existing platform catalogs. This skill supports hunt planning by reasoning over available schemas and metadata before analytics development or query execution.
metadata.short-description
Identify relevant data sources for hunt planning

Identify Relevant Data Sources

This skill translates a structured hunt hypothesis into a set of candidate data sources that could realistically capture the behavior being investigated.

It is executed after the hunt focus has been defined and before analytics are written or queries are executed.

Workflow

  • You MUST complete each step in order and MUST NOT proceed until the current step is complete.
  • You MUST NOT read reference documents unless the current step explicitly instructs you to do so.
  • You MUST NOT write queries or perform data analysis in this skill.
  • Do NOT introduce new research about system internals or adversary tradecraft.
Step 1: Interpret the Hunt Focus

Understand the investigative intent defined by the hunt hypothesis.

  • Review the structured hunt hypothesis.
  • Identify:
    • The attack behavior being investigated
    • The platform context (e.g., Windows, Cloud)
    • The type of activity that must be observable (e.g., configuration changes, execution, authentication)
  • Do NOT infer specific data tables yet.

This step is complete when the expected observable activity is clearly understood at a conceptual level. Do NOT read reference documents during this step.

Show full SKILL.md (201 more words)Show less
Step 2: Discover Candidate Data Sources

Identify data sources that could capture the expected activity.

  • Use MS Sentinel.search_tables to perform a semantic search over the telemetry catalog.
  • Search using:
    • The hunt hypothesis
    • Descriptions of the expected behavior
    • Relevant platform or activity keywords
  • Do NOT search for data sources using specific table names.
  • Review returned table descriptions and schemas to assess relevance.

This step reasons over schemas and metadata available in the data lake catalog and does not assert that data is currently flowing, complete, or retained.

Do NOT write queries or validate detections in this step. Do NOT read reference documents during this step.

Step 3: Refine and Validate Relevance

Narrow the list of candidate data sources.

  • Select tables that:
    • Are plausibly able to capture the expected behavior
    • Expose schema elements aligned with the observable activity
  • Explicitly note:
    • Conceptual coverage limitations based on available schemas
    • Planning-level assumptions inferred from table names, descriptions, and schema semantics
  • Surface gaps where expected categories of telemetry do not appear to be represented.
Step 4: Produce Data Source Summary

Produce a final summary using the following documents within this step ONLY.

  • Structure the output using references/data-source-summary-template.md.
  • Do NOT include queries, filters, validation steps, or execution logic.

© OTRF, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in .github/skills/hunt-data-source-identification of OTRF/ThreatHunter-Playbook.

  • SKILL.md
  • references/data-source-summary-template.md

Open the folder on GitHubat commit d310f38

Compare with similar skills

Hunt Data Source Identification next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Hunt Data Source Identification compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Hunt Data Source Identification this skillOTRF/ThreatHunter-Playbook4.7k—~813Automated safety check: PassMIT
Security Alert Triageelastic/agent-skills5921 repos~3.5kAutomated safety check: NotesApache-2.0
Kubernetes Network Security Auditkubeshark/kubeshark12k—~7.3kAutomated safety check: NotesApache-2.0
Security Detection Rule Managementelastic/agent-skills5921 repos~3.9kAutomated safety check: NotesApache-2.0
Campaign Attribution Evidence Analysismukul975/Anthropic-Cybersecurity-Skills34k—~2.3kAutomated safety check: PassApache-2.0
Chaitin CLIchaitin/chaitin-cli114—~15kAutomated safety check: NotesGPL-3.0

Similar skills

  • Security Alert Triage

    elastic/agent-skills

    Official

    Triage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge.

    592 GitHub starsUsed in 1 repo~3.5k tokens
    SecurityAuto-check: notes

  • Kubernetes Network Security Audit

    kubeshark/kubeshark

    Hunts for compromised workloads and malicious traffic in a Kubernetes cluster by sweeping network data through Kubeshark MCP, mapped to MITRE ATT&CK.

    12k GitHub stars~7.3k tokensUpdated yesterday
    SecurityAuto-check: notes

  • Security Detection Rule Management

    elastic/agent-skills

    Official

    Create, tune, and manage Elastic Security detection rules (SIEM and Endpoint).

    592 GitHub starsUsed in 1 repo~3.9k tokens
    SecurityAuto-check: notes

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Chaitin CLI

    chaitin/chaitin-cli

    A skill your agent uses when running chaitin-cli commands to manage Chaitin security products: SafeLine WAF (site management, IP blocking, ACL, policy rules, attack logs), X-Ray vulnerability…

    114 GitHub stars~15k tokensUpdated 9 days ago
    SecurityAuto-check: notes

  • Gates

    Nebulock-Inc/agentic-threat-hunting-framework

    GATES method validation for hunt-derived detections. An agent skill from Nebulock-Inc/agentic-threat-hunting-framework.

    385 GitHub stars~12k tokensUpdated 5 days ago
    SecurityAuto-check passed

More from OTRF/ThreatHunter-Playbook

  • Threat Hunt Blueprint Assembly

    OTRF/ThreatHunter-Playbook

    Assembles a single execution-ready hunt blueprint from the outputs of earlier hunt planning steps, without adding new research, evidence or analytics.

    4.7k GitHub stars~1.2k tokensUpdated 8 mo ago
    Auto-check passed

  • Hunt Focus Definition

    OTRF/ThreatHunter-Playbook

    Turns completed system-internals and adversary-tradecraft research into one focused, testable threat hunt hypothesis about a single attack pattern.

    4.7k GitHub stars~600 tokensUpdated 8 mo ago
    Auto-check passed

  • Threat Hunt Research Grounding

    OTRF/ThreatHunter-Playbook

    Builds a cited research base on normal system behavior and adversary abuse patterns before a threat hunt hypothesis gets written.

    4.7k GitHub stars~1.3k tokensUpdated 8 mo ago
    Auto-check passed

  • Hunt Analytics Generation

    OTRF/ThreatHunter-Playbook

    Translates a threat hunt's investigative intent into query-agnostic analytics that describe how adversary behavior should appear in data, grounded in table schemas.

    4.7k GitHub stars~819 tokensUpdated 8 mo ago
    Auto-check passed

Categories

Questions about Hunt Data Source Identification

What does Hunt Data Source Identification do?

Maps a structured threat hunt hypothesis to candidate telemetry sources by semantic search over a Sentinel table catalog, before any queries are written. This is a planning step that runs after the hunt focus is defined and before analytics or queries exist. The agent works in four ordered steps: interpret the hypothesis into the observable activity it implies, search the telemetry catalog semantically, narrow the candidates by schema relevance, and write a data source summary.

When should I use Hunt Data Source Identification?

Hunt Data Source Identification fits situations like: planning a threat hunt once the hypothesis has been written; finding which Sentinel tables could record a given attacker behavior; documenting telemetry gaps before building detections.

How do I install Hunt Data Source Identification in Claude Code?

Run `npx skills add OTRF/ThreatHunter-Playbook --skill hunt-data-source-identification -a claude-code`. Or copy the skill folder (.github/skills/hunt-data-source-identification in OTRF/ThreatHunter-Playbook) into .claude/skills/hunt-data-source-identification in your project. Claude Code loads it when a task matches its description.

How do I install Hunt Data Source Identification in Codex?

Run `npx skills add OTRF/ThreatHunter-Playbook --skill hunt-data-source-identification -a codex`. Or copy the skill folder (.github/skills/hunt-data-source-identification in OTRF/ThreatHunter-Playbook) into .agents/skills/hunt-data-source-identification in your project. Codex loads it when a task matches its description.

Can I use Hunt Data Source Identification in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add OTRF/ThreatHunter-Playbook --skill hunt-data-source-identification -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/hunt-data-source-identification, .gemini/skills/hunt-data-source-identification, .github/skills/hunt-data-source-identification and .opencode/skills/hunt-data-source-identification in your project.

What does Hunt Data Source Identification need to run?

SKILL.md names no scripts, command-line tools or credentials: Hunt Data Source Identification is instructions for the agent only. Our summary lists: Access to the MS Sentinel search_tables tool.

Does Hunt Data Source Identification access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Hunt Data Source Identification safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Hunt Data Source Identification use?

Hunt Data Source Identification is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Hunt Data Source Identification use?

About 813 tokens (SKILL.md is roughly 3.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 429 tokens, read only when the agent opens those files.

What are the alternatives to Hunt Data Source Identification?

Skills that share tags, products or a category with Hunt Data Source Identification: Security Alert Triage (elastic/agent-skills, 592 stars), Kubernetes Network Security Audit (kubeshark/kubeshark, 12k stars), Security Detection Rule Management (elastic/agent-skills, 592 stars) and Campaign Attribution Evidence Analysis (mukul975/Anthropic-Cybersecurity-Skills, 34k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Hunt Data Source Identification?

OTRF (a GitHub organization) maintains it in OTRF/ThreatHunter-Playbook, which has 4,683 GitHub stars. The repository holds 5 skills in this directory. The repository was last updated on January 12, 2026.

Source: OTRF/ThreatHunter-Playbook on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.