ThreatHunter-Playbook for structured, repeatable threat hunting guided by MITRE ATT&CK

A community-driven open source project that documents how threat hunters plan, reason and execute hunts as executable Jupyter notebooks mapped to MITRE ATT&CK.

Tool	OTRF/ThreatHunter-Playbook — a community-driven, open source library of threat hunting logic, adversary tradecraft and detection analytics
Category	Threat hunting methodology and detection content library
Primary Use	Planning, executing and documenting hypothesis-driven hunts against pre-recorded datasets using Jupyter notebooks organized by MITRE ATT&CK
Safe Use	Entirely defensive: designed for authorized security teams, blue teams and researchers hunting in their own environments or against public datasets; no offensive capability
Telemetry Note	Not an agent — leaves no footprint on endpoints; it consumes telemetry such as Sysmon logs and public security datasets, so defenders see nothing from the tool itself

The ThreatHunter-Playbook from the Open Threat Research community (OTRF) is one of those rare security projects that is purely defensive by construction, which makes it a pleasant change of pace for this blog. Rather than a scanner or an exploit framework, it is a structured knowledge base — a collection of hunt documents expressed as interactive Jupyter notebooks that capture how threat hunters think, plan and reason across the full lifecycle of a hunt. Every notebook is organized against the MITRE ATT&CK framework, grouping post-compromise adversary behavior into tactical categories so that a hunter can move from technique to telemetry to detection logic without losing the thread of intent. At roughly 4664 stars and written primarily in Python under an MIT license, it is one of the most mature open source references in the detection engineering space.

The core architectural insight of the project is that hunts should be executable documents, not ad hoc shell sessions that evaporate when the analyst closes the terminal. Each Jupyter notebook in the playbook combines markdown narrative, analytics, datasets and validation queries in a single artifact, which means the reasoning behind a hypothesis, the query that tested it and the results are all preserved together. The README is explicit that this preserves intent and reasoning, not just results — a distinction that matters enormously when a hunt is handed off, audited months later, or reused as a template for a new environment. The notebooks can run locally or remotely against pre-recorded security datasets hosted at securitydatasets.com, and the project ships a Binder badge so that anyone can launch the environment in a browser without installing anything.

What elevates the project beyond a static wiki is its explicit hunting framework, which the README breaks into three stages: Plan, Execute and Report. The Plan stage is where the hunter builds analytic intent — defining the behavior being hunted, the assumptions being made, the expected activity, and how that behavior should manifest in telemetry such as Sysmon events. The Execute stage applies that plan through queries and iterative analysis as assumptions are tested and refined. The Report stage captures outcomes regardless of whether anything was found, including false positives, visibility gaps and follow-on actions. Treating a null result as a documented deliverable is a disciplined practice that most teams skip, and the playbook institutionalizes it.

It is worth noting candidly where the repository currently concentrates its effort. The README states plainly that while the framework spans the full lifecycle, the work in the repo today focuses on formalizing the planning stage — the phase where intent, assumptions and analytic structure are established before execution begins. This is a deliberate architectural choice rather than a gap: planning is the highest-leverage and least standardized part of threat hunting, and the project treats it as the foundation on which execution and reporting artifacts will be built. Practitioners evaluating the repo should expect deep, well-structured planning content and progressively less scaffolding toward the later stages.

The most current development, and arguably the most interesting, is the project's transformation phase around Generative AI. Rather than positioning AI as a replacement for hunters, the README describes augmenting hunting workflows across planning, execution and reporting with human oversight as an explicit design constraint. The first concrete implementation is the integration of Agent Skills, a mechanism for packaging hunting knowledge as explicit workflows with ordered steps, templates and references that both humans and AI agents can follow consistently. In practice, these skills walk through researching system internals and adversary tradecraft, defining a focused hunt hypothesis, identifying relevant data sources, developing analytics that model adversary behavior, and assembling a complete hunt blueprint ready for execution.

That Agent Skills workflow deserves attention from anyone building detection programs in 2026. The traditional failure mode of AI-assisted hunting is that a model produces plausible-sounding queries with no documented assumptions, no data-source validation and no falsifiability — the opposite of hypothesis-driven work. By encoding the workflow as an ordered, testable sequence — from tradecraft research to hypothesis definition to data source identification to analytics development to final blueprint — the playbook forces broad natural-language inputs to be refined into structured, testable hunt artifacts. The authors, Roberto Rodriguez (@Cyb3rWard0g) and Jose Luis Rodriguez (@Cyb3rPandaH), both long-standing names in the Sysmon and ATT&CK research community, document this evolution in a companion blog post on blog.openthreatresearch.com.

From an operational standpoint, everything in the repository is safely consumable. The datasets used for validation are pre-recorded captures, not live environments, so a defender can experiment with detection logic against known-bad telemetry without touching production systems. The topics list — dfir, hunter, hunting, hunting-campaigns, hypothesis, mitre, mitre-attack-db, sysmon, threat-hunting — reads as a faithful summary of the content: this is hypothesis-driven hunting material grounded in endpoint telemetry, primarily the Sysmon canonical event model that the OTR community has championed for years. For teams building a hunt program from scratch, the notebooks double as training material, since each one demonstrates how to translate an ATT&CK technique into concrete event IDs and query patterns.

The telemetry story is also worth a defensive note, precisely because the tool itself is invisible on the wire. ThreatHunter-Playbook deploys no agents, beacons or collectors; it is a consumer of telemetry, not a producer. Its relevance to defenders is the opposite of the usual IOCs-and-hashes conversation: it teaches you what your own Sysmon deployment should be recording, which events matter for which ATT&CK techniques, and where your visibility gaps are — the Report stage makes gap documentation a first-class output. Teams that run the hunts against their own log stores effectively get a coverage assessment as a byproduct of the hunting process.

In terms of adoption workflow, the project docs live at threathunterplaybook.com, published as a Jupyter Book, which gives the whole corpus a readable, navigable form that works equally well as reference material and as an onboarding curriculum for new analysts. The Binder/BinderHub integration means the barrier to entry is essentially zero: a junior analyst can execute a real hunt notebook in a browser session, see the queries run against pre-recorded data, and internalize the hypothesis-driven methodology without needing a lab or a data pipeline first. That combination of executable content and zero-install execution is still unusual in defensive tooling and is a large part of why the project has sustained community traction.

For the authorized professional evaluating whether to invest time here, the honest assessment is that this is methodology infrastructure rather than a turnkey product. You will not point it at a network and get alerts; you will internalize its structure, adapt its notebooks and skills to your own telemetry, and end up with a hunting program that is repeatable, documented and increasingly AI-augmentable. Given the current momentum around Agent Skills and the explicit roadmap toward AI-assisted planning, execution and reporting under human oversight, OTRF/ThreatHunter-Playbook is well positioned to remain the reference model for what structured, community-driven threat hunting looks like.

Official project repository for OTRF/ThreatHunter-Playbook.

Download Tool

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.

Related coverage

• Security Onion for threat hunting and enterprise security monitoring