The Agentic Threat Hunting Framework (ATHF) organizes and retains threat hunting knowledge using a structured approach. It allows teams to document past investigations, making them accessible for future reference and AI assistance. ATHF supports various hunting methodologies and integrates with existing tools for enhanced efficiency.

This article explores how AI agents, specifically Claude Code, streamline the threat hunting process in security operations. Using Model Context Protocol (MCP) servers, analysts can quickly gather evidence and prioritize threats for investigation, transforming a traditionally manual task into a more efficient workflow.

This article discusses using a 3D visualization model called Time-Terrain-Behavior (TTB) to identify unusual workstation behavior in security data. By analyzing patterns without prior knowledge of what to look for, the approach reveals outlier workstations that may indicate compromise. The method is applied to the BOTS v2 dataset for practical validation.