{"id":49829487,"url":"https://github.com/THORCollective/threat-hunting-mcp-server","last_synced_at":"2026-05-30T10:00:37.239Z","repository":{"id":324323647,"uuid":"1023747757","full_name":"THORCollective/threat-hunting-mcp-server","owner":"THORCollective","description":"Production-ready MCP server for threat hunting knowledge base systems integrating PEAK, SQRRL, and intelligence-driven methodologies","archived":false,"fork":false,"pushed_at":"2025-11-15T04:08:38.000Z","size":89,"stargazers_count":1,"open_issues_count":0,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-11-15T05:46:43.604Z","etag":null,"topics":["atlassian","cybersecurity","defensive-security","mcp-server","mitre-attack","python","splunk","threat-hunting"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/THORCollective.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-07-21T16:22:13.000Z","updated_at":"2025-11-15T04:08:41.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/THORCollective/threat-hunting-mcp-server","commit_stats":null,"previous_names":["thorcollective/threat-hunting-mcp-server"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/THORCollective/threat-hunting-mcp-server","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/THORCollective%2Fthreat-hunting-mcp-server","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/THORCollective%2Fthreat-hunting-mcp-server/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/THORCollective%2Fthreat-hunting-mcp-server/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/THORCollective%2Fthreat-hunting-mcp-server/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/THORCollective","download_url":"https://codeload.github.com/THORCollective/threat-hunting-mcp-server/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/THORCollective%2Fthreat-hunting-mcp-server/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33687722,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-05-30T02:00:06.278Z","response_time":92,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["atlassian","cybersecurity","defensive-security","mcp-server","mitre-attack","python","splunk","threat-hunting"],"created_at":"2026-05-13T20:00:48.387Z","updated_at":"2026-05-30T10:00:37.230Z","avatar_url":"https://github.com/THORCollective.png","language":"Python","funding_links":[],"categories":["cybersecurity"],"sub_categories":[],"readme":"# Threat Hunting MCP Server\n\nA next-generation Model Context Protocol (MCP) server that **hunts for behaviors, not indicators**. Built on the philosophy that effective threat hunting focuses on adversary **Tactics, Techniques, and Procedures (TTPs)** at the top of the Pyramid of Pain—the behaviors that are hardest for attackers to change.\n\n## Philosophy: Hunt Behaviors, Not Indicators\n\nThis MCP server is designed around a core principle from the **[Pyramid of Pain](https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html)**:\n\n```\n                            ▲\n                           ╱ ╲\n                          ╱   ╲ 🎯 TOUGH\n                         ╱ TTPs╲ ← WE FOCUS HERE\n                        ╱———————╲\n                       ╱         ╲\n                      ╱ 🛠️  Tools ╲\n                     ╱—————————————╲\n                    ╱               ╲\n                   ╱ 📊 Host/Network ╲\n                  ╱———————————————————╲\n                 ╱                     ╲\n                ╱  🌐 Domain Names      ╲\n               ╱—————————————————————————╲\n              ╱                           ╲\n             ╱     🔢 IP Addresses         ╲\n            ╱———————————————————————————————╲\n           ╱                                 ╲\n          ╱       #️⃣  Hash Values             ╲\n         ╱—————————————————————————————————————╲\n```\n\n**Why behavioral hunting?**\n- **Hash values** → Adversaries change in seconds\n- **IP addresses** → Adversaries change in minutes\n- **Domain names** → Adversaries change in hours\n- **Network/Host artifacts** → Adversaries change in days\n- **Tools** → Adversaries change in weeks\n- **TTPs (Behaviors)** → Adversaries change in months/years ✅ **Hunt for these!**\n\nWhen you hunt for *how* adversaries behave rather than *what* specific indicators they use, you create durable detections that survive indicator rotation and force adversaries to fundamentally change their operations.\n\n## Features\n\n### Behavioral Hunting Focus\n- **TTP-First Approach**: All hunts prioritize behavioral patterns over atomic indicators\n- **MITRE ATT\u0026CK Integration**: Deep integration with technique-level behavioral analytics\n- **Behavior Pattern Library**: Pre-built detection logic for common adversary behaviors\n- **Anti-Evasion Design**: Hunt for behaviors that persist across tool/infrastructure changes\n\n### Core Hunting Frameworks\n- **PEAK Methodology**: Prepare, Execute, Act with Knowledge - state-of-the-art framework\n- **SQRRL Framework**: Hunting Maturity Model (HMM0-HMM4) progression\n- **TaHiTI Framework** ⭐ NEW: Targeted Hunting integrating Threat Intelligence (3 phases, 6 steps)\n- **Intelligence-Driven**: Hypothesis-driven hunting using behavioral threat intelligence\n\n### Advanced Cognitive Capabilities ⭐ NEW\n- **Bias Awareness Checks**: Heuristic prompts for confirmation, anchoring, and availability biases (rule-based, not ML — intended as analyst checklists, not automated judgment)\n- **Competing Hypotheses Generator**: Generates benign / insider / external / supply-chain alternatives so ACH (Analysis of Competing Hypotheses) is forced before commitment\n- **Pyramid-of-Pain-weighted Confidence**: TTP-level evidence anchors the score; lower-pyramid indicators (hashes, IPs) only add supplemental context and cannot dilute it\n- **Hunt Stopping Criteria**: Coverage / diminishing-returns / time / confidence thresholds to prevent tunnel vision\n- **Investigation Question Generator**: Standard skeptical prompts (\"what would disprove this?\", \"what's missing?\") to ensure thorough analysis\n\n### Graph-Based Threat Detection ⭐ NEW\n- **Attack Path Analysis**: Identifies critical paths from initial compromise to crown jewels (domain controllers, databases, admin accounts)\n- **Living-off-the-Land Detection**: Behavioral detection of LOLBin abuse via parent-child relationships and command-line patterns\n- **Pivot Point Identification**: Brandes betweenness centrality (via NetworkX) over the attack graph; falls back to BFS shortest-path scoring if NetworkX is unavailable\n- **Provenance Tracking**: Data lineage and ancestry chains for forensic context\n- **Lateral-Movement \u0026 Credential-Access Edge Tagging**: SMB/RDP/WinRM connections and lsass-targeted process access are tagged at graph-build time so MITRE TTP extraction (T1021, T1003) works on real path traversals\n\n### Deception Technology Integration ⭐ NEW\n- **Honeytoken Generation**: Fake AWS keys, passwords, SSH keys, API tokens with embedded callback markers\n- **Strategic Placement Helpers**: Suggested locations — browser history, .env files, config files, memory dumps\n- **Decoy System Templates**: Configurable fake servers, workstations, databases\n- **Canary File Generation**: Executive documents, credentials, source code with embedded beacons\n- **Trigger-Based Detection**: Designed for high-signal, low-noise alerting — actual signal-to-noise ratio depends on telemetry wiring in your environment\n\n### Community Knowledge Base ⭐ NEW\n- **HEARTH Integration**: Access 50+ community-curated threat hunting hypotheses\n- **Hypothesis-Driven Hunts (Flames)**: Real-world attack scenarios from practitioners\n- **Baseline Hunts (Embers)**: Environmental baselining and exploratory analysis\n- **Model-Assisted Hunts (Alchemy)**: ML and algorithmic detection approaches\n- **AI-Powered Recommendations**: Personalized hunt suggestions for your environment\n- **Tactic Coverage Analysis**: Identify gaps across MITRE ATT\u0026CK tactics\n- **Incident-Based Suggestions**: Get relevant hunts based on incident descriptions\n\n### Traditional Capabilities\n- **Natural Language Processing**: Convert behavioral hunt requests into executable queries (requires `spacy` — gracefully disabled if absent)\n- **Atlassian Integration**: Confluence and Jira for knowledge management (optional)\n- **Splunk Integration**: TTP-focused hunting queries via the Splunk SDK; connection is **lazy** (server boots even if Splunk is unreachable) and the entire integration is gated so the module imports without `splunk-sdk`/`numpy`/`pandas`/`sklearn` installed\n- **MITRE ATT\u0026CK Framework**: Technique and sub-technique mapping with behavioral hunt queries (Sysmon EID 10 for T1003, behavioral cmd.exe/PowerShell discovery for T1083, etc.)\n- **Security Controls**: JWT auth, encryption, audit logging, rate limiting\n- **Caching \u0026 Performance**: Redis-based caching (optional)\n\n## Behavioral Hunting Examples\n\n### What We Hunt For (Top of Pyramid)\n\n**✅ Good: Behavioral Patterns (TTPs)**\n- Process injection techniques (T1055.*) - behavior persists across tools\n- LSASS memory access patterns - fundamental credential theft behavior\n- Lateral movement via remote services - core post-compromise behavior\n- Living-off-the-Land binaries (LOLBins) - detection-evasion behavior\n- Parent-child process anomalies - execution pattern behaviors\n- Kerberoasting patterns - Active Directory attack behaviors\n\n**❌ Avoid: Atomic Indicators (Easy to Change)**\n- Specific malware hashes - trivial to modify\n- Known-bad IP addresses - adversaries rotate rapidly\n- C2 domain names - disposable infrastructure\n- Specific file paths - easily changed\n\n### Behavioral Hunt Examples\n\n**Example 1: Credential Access Behavior**\n```\nHunt for: Any process accessing LSASS memory (T1003.001)\nWhy: This behavior is required for credential theft, regardless of the tool\nTools that use it: Mimikatz, ProcDump, custom malware\nDetection persists: Even when tools change\n```\n\n**Example 2: Lateral Movement Behavior**\n```\nHunt for: Remote execution patterns via WMI/DCOM/SMB (T1021.*)\nWhy: Fundamental behavior for spreading through networks\nTools that use it: PsExec, Impacket, WMIC, custom tools\nDetection persists: Even with infrastructure/tool rotation\n```\n\n**Example 3: Defense Evasion Behavior**\n```\nHunt for: Process injection patterns (T1055.*)\nWhy: Core evasion technique requiring specific OS API calls\nTools that use it: Cobalt Strike, Metasploit, custom loaders\nDetection persists: API call patterns remain consistent\n```\n\n## Getting Started with Behavioral Hunting\n\n**New to behavioral hunting?** Start with these resources:\n\n1. **[Quick Reference Card](BEHAVIORAL_HUNTING_QUICK_REF.md)** - One-page behavioral hunting cheat sheet\n2. **[Behavioral Hunting Guide](BEHAVIORAL_HUNTING_GUIDE.md)** - Complete guide to hunting behaviors vs indicators\n3. **[PEAK Hunt Example](examples/PEAK-Hunt-Example-LSASS-Memory.md)** - Complete example hunt report using PEAK Framework\n4. **[HEARTH Community Hunts](#hearth-community-integration)** - 50+ real-world behavioral hunt hypotheses\n5. **[PEAK Template](templates/PEAK-Template.md)** - Official PEAK Framework template from THOR Collective\n\n### Quick Behavioral Hunt Examples\n\nTry these natural language queries focused on behaviors:\n\n```bash\n# Credential Access Behaviors\n\"Hunt for any process accessing LSASS memory (T1003.001)\"\n\"Find credential dumping patterns regardless of tool used\"\n\n# Lateral Movement Behaviors\n\"Detect lateral movement via remote execution (T1021.*)\"\n\"Hunt for RDP/WMI/PsExec execution patterns\"\n\n# Process Injection Behaviors\n\"Find process injection into system processes (T1055)\"\n\"Detect CreateRemoteThread patterns across all tools\"\n\n# Living-off-the-Land Behaviors\n\"Hunt for PowerShell download cradles (T1059.001)\"\n\"Detect LOLBin abuse patterns (certutil, bitsadmin, etc.)\"\n\n# Command and Control Behaviors\n\"Find C2 beaconing patterns regardless of infrastructure\"\n\"Detect DNS tunneling behaviors (T1071.004)\"\n```\n\n**Notice:** These focus on **adversary behaviors** that persist across tool/infrastructure changes, not specific IOCs that change hourly.\n\n---\n\n## Architecture\n\n### Core Components\n\n1. **Hunt Frameworks**\n   - **PEAK/SQRRL** ([src/frameworks/hunt_framework.py](src/frameworks/hunt_framework.py))\n     - PEAK methodology implementation\n     - SQRRL framework components\n     - Intelligence-driven hunting approach\n   - **TaHiTI** ([src/frameworks/tahiti.py](src/frameworks/tahiti.py)) ⭐ NEW\n     - 3-phase methodology (Initialize, Hunt, Finalize)\n     - 6-step process with continuous threat intelligence integration\n     - Hunt backlog management and prioritization\n     - Automated handover to security processes\n\n2. **Cognitive Module** ([src/cognitive/hunter_brain.py](src/cognitive/hunter_brain.py)) ⭐ NEW\n   - Heuristic checks for confirmation, anchoring, and availability biases (rule-based; not an LLM judge)\n   - Competing hypotheses generator — synthesizes benign / insider / external / supply-chain alternatives for ACH\n   - Pyramid-of-Pain-anchored confidence scoring (high-pyramid evidence dominates; low-pyramid evidence cannot dilute)\n   - Hunt stopping criteria (coverage, diminishing returns, time, confidence)\n   - Investigation question generator\n\n3. **Graph Correlation Engine** ([src/correlation/graph_engine.py](src/correlation/graph_engine.py)) ⭐ NEW\n   - Attack graph construction with role promotion (hosts → `domain_controller` / `database`, users → `admin_account`) so high-value targets are actually identifiable\n   - Living-off-the-Land (LOLBin) detection via parent-child anomalies, suspicious command lines, and chained execution\n   - Attack path identification with configurable high-value target types\n   - Pivot point detection via Brandes betweenness centrality (NetworkX); BFS shortest-path fallback when NetworkX is missing\n   - Provenance tracking and ancestry analysis\n   - Lateral-movement / credential-access edge tagging based on ports, services, and lsass-targeted ProcessAccess\n\n4. **Deception Manager** ([src/deception/honeytokens.py](src/deception/honeytokens.py)) ⭐ NEW\n   - Honeytoken generation and deployment\n   - Decoy system management\n   - Canary file deployment\n   - High-confidence threat detection\n   - Deception trigger monitoring and response\n\n5. **Integrations**\n   - **Atlassian** ([src/integrations/atlassian.py](src/integrations/atlassian.py)): Confluence/Jira integration (optional)\n   - **Splunk** ([src/integrations/splunk.py](src/integrations/splunk.py)): Query execution and optional ML analysis (Isolation Forest, DBSCAN, time-series anomaly). Connection is lazy and the entire integration imports cleanly without `splunk-sdk` / `numpy` / `pandas` / `sklearn` — features are gated and self-report unavailability when deps are missing.\n\n6. **Intelligence Engine**\n   - **MITRE ATT\u0026CK** ([src/intelligence/threat_intel.py](src/intelligence/threat_intel.py))\n     - MITRE ATT\u0026CK framework\n     - Pyramid of Pain implementation\n     - Diamond Model analysis\n     - Cyber Kill Chain mapping\n   - **HEARTH Integration** ([src/intelligence/hearth_integration.py](src/intelligence/hearth_integration.py)) ⭐ NEW\n     - Community hunt repository access\n     - Hunt search and recommendation engine\n     - Tactic coverage analysis\n     - Incident-based hunt suggestions\n     - 50+ curated threat hunting hypotheses\n   - **THOR Collective** ([src/intelligence/thor_collective.py](src/intelligence/thor_collective.py))\n     - Community threat hunting knowledge\n     - THRF (Threat Hunting Relevancy Factors)\n     - Thrunting philosophy integration\n\n7. **NLP Processing** ([src/nlp/hunt_nlp.py](src/nlp/hunt_nlp.py))\n   - Natural language query processing\n   - Intent classification\n   - Entity extraction\n   - Query generation\n   - Integration with cognitive capabilities\n\n8. **Security Manager** ([src/security/security_manager.py](src/security/security_manager.py))\n   - JWT authentication\n   - Data encryption\n   - Audit logging\n   - Rate limiting\n\n## Quick Start (HEARTH Integration Only)\n\nThe fastest way to get started with community hunt knowledge:\n\n1. **Clone repositories**:\n   ```bash\n   git clone https://github.com/THORCollective/threat-hunting-mcp-server\n   cd threat-hunting-mcp-server\n\n   # Clone HEARTH repository (required for community hunts)\n   git clone https://github.com/THORCollective/HEARTH ../HEARTH\n   ```\n\n2. **Install dependencies**:\n   ```bash\n   pip install -r requirements.txt\n   ```\n\n3. **Configure environment** (minimal setup):\n   ```bash\n   cp .env.example .env\n   # The .env file is already configured with HEARTH_PATH\n   # You can use it as-is for HEARTH features\n   ```\n\n4. **Connect to Claude Code**:\n\n   Add to your Claude Code settings (`.claude/config.json` or settings UI):\n   ```json\n   {\n     \"mcpServers\": {\n       \"threat-hunting\": {\n         \"command\": \"python3\",\n         \"args\": [\"-u\", \"/path/to/threat_hunting_mcp/run_server.py\"]\n       }\n     }\n   }\n   ```\n\n5. **Start using it**:\n\n   Open Claude Code and try natural language queries:\n   - \"Show me HEARTH hunts for credential access\"\n   - \"Recommend threat hunts for my Windows AD environment\"\n   - \"What's the tactic coverage in HEARTH?\"\n\n## Production Deployment\n\nFor production deployment features including health monitoring, testing, optimization, and structured logging, see **[PRODUCTION.md](PRODUCTION.md)**.\n\n**Production Features:**\n- 🏥 Health monitoring with `get_server_health()` MCP tool\n- 🛡️ Input validation and security (Pydantic models)\n- ⚡ Token optimization (40-50% reduction)\n- ✅ Automated testing (63 tests, 100% pass rate — covers validators, HEARTH integration, server health, splunk query content, graph correlation, and pyramid-of-pain weighting)\n- 📊 Structured JSON logging to stderr\n- 🔄 Graceful degradation for optional features (Splunk SDK, NumPy/Pandas/scikit-learn, NetworkX, spaCy, Redis are all gated — server boots and degrades cleanly when any are absent)\n\n## Full Installation\n\nFor complete functionality including Splunk, Atlassian, and ML features:\n\n1. **Clone the repository**:\n   ```bash\n   git clone https://github.com/THORCollective/threat-hunting-mcp-server\n   cd threat-hunting-mcp-server\n   ```\n\n2. **Install base dependencies**:\n   ```bash\n   pip install -r requirements.txt\n   ```\n\n3. **Install optional components** as needed (all are gated — the server runs without them and reports unavailability via `get_server_health()`):\n   ```bash\n   # Splunk live querying:\n   pip install splunk-sdk\n\n   # Math / M-ATH (Isolation Forest, DBSCAN, time-series anomaly):\n   pip install numpy pandas scikit-learn\n\n   # NLP (natural-language hunt query parsing):\n   pip install spacy\n   python -m spacy download en_core_web_lg\n   ```\n\n4. **Configure environment**:\n   ```bash\n   cp .env.example .env\n   # Edit .env with your Splunk/Atlassian credentials\n   ```\n\n\u003e **Python version**: tested on 3.11–3.13. The optional ML stack pins are kept out of the default `requirements.txt` so a fresh install on Python 3.13 doesn't fail on transient compatibility issues — uncomment those lines in `requirements.txt` (or install manually as above) when you need them.\n\n## Configuration\n\nCopy `.env.example` to `.env` and configure required integrations: **Atlassian** (URL, username, API token) • **Splunk** (host, port, auth token) • **Security** (JWT secret, encryption key) • **Redis** (connection details, optional).\n\nSee [PRODUCTION.md](PRODUCTION.md) for detailed configuration examples, security hardening, and deployment best practices.\n\n## Usage\n\n### Starting the Server\n\n```bash\npython -m src.server\n```\n\n### Key MCP Tools\n\n**Core Hunting Tools:**\n- `hunt_threats(query, framework)` - Natural language threat hunting interface\n- `get_server_health()` - Server diagnostics and feature availability\n- `analyze_adversary(adversary_id)` - Threat actor analysis (e.g., G0016 for APT29)\n\n**HEARTH Community Tools:**\n- `search_community_hunts(tactic, tags, keyword)` - Search 50+ community hunt hypotheses\n- `recommend_hunts(tactics, keywords, environment)` - AI-powered hunt recommendations\n- `suggest_hunts_for_incident(description)` - Incident-driven hunt suggestions\n\n**PEAK Framework Tools:**\n- `create_behavioral_hunt(technique_id, hypothesis, ...)` - Create PEAK hunt reports\n- `suggest_behavioral_hunt_from_ioc(ioc, ioc_type)` - Pivot IOCs to behavioral hunts\n- `list_peak_hunts()` - List created hunt reports\n\n**20+ additional tools available** - see full API documentation for complete tool reference with examples.\n\n### Example: Search Community Hunts\n\n```python\n# Search for credential access hunts\nhunts = await search_community_hunts(\n    tactic=\"Credential Access\",\n    tags=[\"lateral_movement\"],\n    limit=5\n)\n```\n\n### Example: Create Behavioral Hunt\n\n```python\n# Pivot from IOC to behavioral detection\nbehavioral_hunt = await suggest_behavioral_hunt_from_ioc(\n    ioc=\"192.168.1.100\",\n    ioc_type=\"ip\"\n)\n# Returns TTP-focused hunt suggestions instead of IOC-based detection\n```\n\n## Hunting Methodologies\n\n### TaHiTI Framework ⭐ NEW\n\nDeveloped by the Dutch Payments Association, TaHiTI (Targeted Hunting integrating Threat Intelligence) provides a standardized methodology combining threat intelligence with hunting practices. The framework features three phases: **Initialize** (trigger and abstract), **Hunt** (hypothesis and investigation), and **Finalize** (validation and handover). Built on intelligence-driven focus with continuous enrichment, risk-based prioritization, and collaborative information sharing.\n\n### PEAK Framework\n\nSimple, practical framework with three phases: **Prepare** (research and hypotheses), **Execute** (analyze and investigate), **Act with Knowledge** (document and detect). Supports three hunt types: Hypothesis-Driven, Baseline, and Model-Assisted (M-ATH).\n\n### SQRRL Framework\n\nFeatures a Hunting Maturity Model (HMM0-HMM4), Hunt Loop (Hypothesis → Investigate → Patterns → Analytics), and Hunt Matrix mapping activities to maturity levels.\n\n**See [FRAMEWORKS.md](FRAMEWORKS.md) for detailed framework documentation, examples, and implementation guidance.**\n\n## HEARTH Community Integration ⭐ NEW\n\nIntegrates with **[HEARTH](https://github.com/THORCollective/HEARTH)** (Hunting Exchange and Research Threat Hub), an open-source repository of 50+ professionally-curated threat hunting hypotheses. HEARTH uses PEAK framework categories: 🔥 **Flames** (hypothesis-driven), 🪵 **Embers** (baseline), 🔮 **Alchemy** (model-assisted).\n\n**Key Features:** Search by tactic/technique/tags • AI-powered hunt recommendations • Tactic coverage analysis • Incident-driven hunt suggestions • Real-time community updates\n\n**Quick Example:**\n```python\nhunts = await search_community_hunts(tactic=\"Credential Access\", tags=[\"brute_force\"])\nrecommendations = await recommend_hunts(environment=\"Windows AD\")\n```\n\n**Resources:** [Live Database](https://thorcollective.github.io/HEARTH/) • [GitHub Repo](https://github.com/THORCollective/HEARTH) • [Submit Hunts](https://github.com/THORCollective/HEARTH/issues/new/choose)\n\n## Security\n\nEnterprise-grade security features including JWT authentication, AES encryption, comprehensive audit logging, and rate limiting. See **[SECURITY.md](SECURITY.md)** for complete security documentation, hardening guidelines, and responsible disclosure policy.\n\n**Key Features:** JWT auth • AES encryption • Audit logging • Rate limiting • Input validation • SIEM integration\n\n## Contributing\n\nContributions are welcome! See [CONTRIBUTING.md](CONTRIBUTING.md) for development guidelines, project structure, and how to add new features.\n\n## License\n\nThis project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.\n\n### Responsible Use\n\nThis is a defensive security tool designed for:\n- Threat hunting and detection\n- Security monitoring and analysis\n- Incident response and investigation\n- Security research and education\n\nBy using this software, you agree to use it only for lawful and authorized security purposes. Always obtain proper authorization before conducting security activities in any environment.\n\n## Support\n\nFor support and questions:\n- Create GitHub issues for bugs\n- Check documentation first\n- Follow security disclosure policy\n- Provide detailed reproduction steps\n\n---\n\n**Note**: This is a defensive security tool designed for threat hunting and detection. Use responsibly and in accordance with your organization's security policies.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FTHORCollective%2Fthreat-hunting-mcp-server","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FTHORCollective%2Fthreat-hunting-mcp-server","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FTHORCollective%2Fthreat-hunting-mcp-server/lists"}