Skip to main content
Playbooks / The Hounds — Pack Playbook

The Hounds — Pack Playbook

Contributed

A skill-packaged playbook for The Hounds — 18 exposure-management specialists that hunt, tag, and calibrate risk over Tenable navi.

Authorpacketchaos
LicenseMIT
AddedJul 15, 2026
View on GitHub →

Agent Chain

  1. 1.Laelaps

    Finds and tags CISA KEV (known exploited) exposure.

    Manual Step
  2. 2.Certania

    Tracks certificate expiry and weak crypto.

    Manual Step
  3. 3.Heimdall

    Assesses post-quantum readiness.

    Manual Step
  4. 4.Fenrir

    Chains signals into ranked attack paths (foothold to crown jewel).

    Manual Step
  5. 5.Cerberus

    Confidence-scored IoT / OT / embedded device discovery.

    Manual Step
  6. 6.Pythia

    Discovers and governs AI/ML inventory across five sources.

    Manual Step
  7. 7.Atlas

    Establishes asset ownership.

    Manual Step
  8. 8.Mimir

    Software inventory.

    Manual Step
  9. 9.Charon

    Flags end-of-life / unsupported software.

    Manual Step
  10. 10.Anubis

    Calibrates Asset Criticality Rating (ACR).

    Manual Step
  11. 11.Chronos

    Scan health monitoring.

    Manual Step
  12. 12.Sirius

    Agent group analysis.

    Manual Step
  13. 13.Garmr

    Tag removal and cleanup.

    Manual Step
  14. 14.Orthrus

    Maps findings to MITRE ATT&CK.

    Manual Step
  15. 15.Argus

    Custom application discovery.

    Manual Step
  16. 16.Argos

    Single-asset deep-dive.

    Manual Step
  17. 17.Sphinx

    'On the Scent' environment overview.

    Manual Step
  18. 18.Covenant

    Enforces the AI Contract governance policy.

    Manual Step

Integrations

TenableAnthropic

Tags

tenableexposure-managementnaviplaybookclaude-skillsasset-taggingvulnerability-management

The Hounds is a pack of exposure-management specialists — “hounds” — that run over Tenable navi (navi.db + the Tenable API). This repository packages the pack as a Claude skill (the-hounds/SKILL.md plus references/): the domain knowledge for what each hound looks for, how it tags it, and which navi selector it uses.

What it does

Each hound hunts one kind of exposure and then tags it, calibrates its risk, or answers a question — from CISA KEV (Laelaps) and attack paths (Fenrir) to IoT/OT (Cerberus), AI inventory (Pythia), certificates (Certania), EOL software (Charon), and ACR calibration (Anubis). You can run a hound by name (“run Laelaps”) or “release the hounds” to run the whole pack.

How it works

The playbook follows a strict operating doctrine: grounded (answer only from real navi results), propose-then-confirm for every write (show the exact command, category:value, and matched-asset count; platform writes also require NAVI_MCP_ALLOW_WRITES=1), prefer built-in selectors, distinguish ephemeral vs persistent tags, surface blind/uncredentialed coverage, and verify after writing. Pair it with the navi skills (navi-core, navi-enrich, navi-explore, navi-mcp) that supply the tool mechanics.