# SOC-Hunter

> Proactive, hypothesis-driven threat hunting using the LOCK pattern across SIEM, EDR, VM, CSPM, CASB, and code search

- Type: Skill
- Author: sherlon1
- License: MIT
- Trust tier: vetted (passed the Exchange Inspector security review process)
- Vetted on: 2026-10-07
- Vetted commit: 5eea59b39817d9710ef89ec1abe550293ad2d71b. The security review covers that commit only; anything pushed after it is unreviewed
- Commits since vetted: 0 (0 means the reviewed code is current)
- Last reviewed: 2026-10-07
- Source repository: https://github.com/sherlon1/soc-hunter
- Repo state: not archived
- Last push: 2026-10-06T16:09:39Z
- Stars: 7 (a popularity signal, not a safety signal)
- Forks: 2 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Splunk, SentinelOne, Tenable, Netskope, CrowdStrike
- Domains: security-operations, threat-intelligence
- Tags: threat-hunting, lock-pattern, mitre-attack, siem, edr, secops, incident-response
- Date added: 2026-07-08
- Compatible platforms: Claude Code
- Invocation: `/soc-hunter`
- Listing page: https://exchange.tenable.com/skills/soc-hunter
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/soc-hunter.md

SOC-Hunter is a Claude Code skill that brings structured, proactive threat hunting to your IR workstation. Instead of waiting for alerts, you form hypotheses and systematically test them across your entire security data stack using the **LOCK pattern** (Learn, Observe, Check, Keep).

## What it does

- Runs seven hunting modes: `hunt`, `research`, `execute`, `review`, `baseline`, `investigate`, and `lookup`
- Orchestrates queries across SIEM, EDR, Vulnerability Management, CSPM, CASB, Log Analytics, IPAM, and Code Search via MCP — in a structured layered correlation approach
- Maps every hunt to MITRE ATT&CK with live STIX coverage analysis and gap detection
- Maintains persistent hunt memory across sessions (`hunts/`, `research/`, `investigations/`)
- Detects statistical deviations from versioned behavioral baselines (sigma scoring)
- Fully vendor-agnostic — configure your own MCP servers, SIEM indexes, and credentials via `CONFIG.md`

## How it works

Each hunt follows four approval-gated phases: **Learn** (hypothesis + ABLE scoping), **Observe** (define normal vs. suspicious, map to data sources), **Check** (count-first query execution across 7 data source layers), and **Keep** (structured hunt file with TP/FP classification and lessons learned). Lightweight investigations use the **TRACE** pattern (Trigger, Recon, Assess, Conclude, Emit) for quick structured triage without full LOCK overhead. Built-in quality tools — `hunt-similar.py`, `hunt-validate.py`, and `attack-lookup.py` — prevent duplicate work and enforce frontmatter consistency across the hunt library.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/soc-hunter.json. The full index and how to read it: https://exchange.tenable.com/llms.txt