Threat Hunter Playbook is a community-driven collection of threat hunting documentation and executable resources that structures detection logic and adversary tradecraft around the MITRE ATT&CK framework.
The project addresses the challenge of making threat hunting repeatable and knowledge-transferable by documenting not just what hunters find, but how they think and reason through investigations. It captures this knowledge in interactive Jupyter notebooks that combine markdown explanations, analytics, datasets, and validation queries. Hunts are organized by MITRE ATT&CK tactics and techniques, allowing hunters to understand post-compromise behavior in a standardized way. The notebooks function as executable documents that can be run locally or remotely using pre-recorded security datasets and BinderHub, enabling validation and experimentation without requiring live environments.
The tool suits threat hunting teams and detection engineers who want to build institutional knowledge around hunt methodology and share findings across their organization or the broader community. It works well for teams that value structured, repeatable hunting processes grounded in adversary tradecraft rather than ad hoc investigation. The project is particularly useful for those seeking to accelerate hunt development by leveraging documented techniques and datasets that others have already validated. The playbook emphasizes a three-stage lifecycle—plan, execute, and report—that applies whether you are designing new hunts or learning from existing ones.
The project is actively evolving to incorporate AI-augmented workflows through Agent Skills, which capture hunting knowledge as explicit, structured workflows with templates and references rather than replacing existing practices. Development focuses on integrating generative AI capabilities across the planning, execution, and reporting stages while maintaining human oversight and decision-making authority. The codebase is maintained as a community-driven resource where threat hunters contribute documented hunts and supporting materials.
