THORCollective/HEARTH is a curated, open-source library of 300+ threat hunting hypotheses organized around the PEAK framework, with an AI pipeline that converts CTI reports into hunt drafts for authorized defenders.
| Tool | THORCollective/HEARTH — Hunting Exchange and Research Threat Hub, a community library of threat hunting hypotheses |
| Category | Threat hunting knowledge base and detection engineering platform |
| Primary Use | Browsing, adapting, and contributing hunt hypotheses categorized via the PEAK framework and mapped to MITRE ATT&CK techniques during authorized defensive operations |
| Safe Use | Entirely defensive: designed for blue teams, SOC analysts, and authorized security staff hunting in environments they are chartered to defend |
| Telemetry Note | Pure knowledge resource — leaves no artifacts on any network; defenders benefit directly from its ATT&CK coverage gaps heatmap when prioritizing hunts |
The problem HEARTH attacks is one every detection team knows intimately: you have logs, you have a fresh CTI report, and you have no time to turn either into a structured hunt. The README from THORCollective/HEARTH frames it bluntly — analysts stare at telemetry wondering where to start, or read threat intel thinking someone should hunt for this, but writing the hypothesis is the friction point. HEARTH's answer is a community-curated library of 300+ threat hunting hypotheses that teams can use, adapt, fork, and extend, hosted as a GitHub repository with a live searchable front end on GitHub Pages.
What separates HEARTH from a generic list of detection ideas is its methodological spine. Every hunt is categorized using the PEAK Threat Hunting Framework, which the README links to Splunk's published methodology. This matters because PEAK imposes structure: a hunt entry is not a vague tip but a hypothesis with an approach type, references, and ATT&CK mappings. For teams that struggle to graduate from alert tuning to genuine proactive hunting, the framework scaffolding is arguably the most valuable part of the repository.
The taxonomy splits into three categories, and the naming is memorable. Flames/ holds 250+ hypothesis-driven hunts — the classic model where you have a theory about adversary behavior, such as DLL side-loading for persistence via a legitimate application, and go looking for evidence. Embers/ contains 30+ baselining and exploration hunts focused on understanding what normal looks like before an incident, establishing the reference states that make later anomaly detection meaningful. Alchemy/ rounds it out with 25+ model-assisted hunts using statistical analysis, clustering, and ML techniques that let the data surface threats a human analyst might never hypothesize. The proportions are telling: the community still leans heavily on hypothesis-driven work, leaving the data-driven tier comparatively thin — a genuine contribution opportunity for statisticians in detection engineering roles.
The contribution workflow is where the project gets technically interesting. The recommended path is AI-powered CTI submission: you open a CTI submission issue, paste a threat intel report URL and your name for attribution, and a bot reads the report, drafts a complete hunt, checks for duplicates, and opens a pull request for human review. Manual submission is also supported through a hunt template where contributors supply the hypothesis, tactic, and references directly. Maintainers can re-roll AI-generated drafts by applying a regenerate label, iterating until the output meets editorial standards. This human-in-the-loop design — AI drafts, humans approve — is the right pattern for a curated corpus, and it keeps attribution honest via an automated contributor leaderboard tracked in Keepers/Contributors.md.
Architecturally, the repository is refreshingly transparent. Markdown files in Flames/, Embers/, and Alchemy/ are declared the source of truth, version-controlled through standard Git workflows, with each hunt file carrying YAML frontmatter defined in docs/HUNT-SCHEMA.md. Alongside that sits a SQLite database at database/hunts.db, automatically rebuilt when hunt files change, serving as a queryable index for reporting and ad-hoc queries. Notably, the duplicate detection pipeline reads hunt files directly rather than the index, which avoids consistency drift between the corpus and the derived database — a design decision worth respecting.
The CTI ingestion layer is more sophisticated than the simple bot story suggests. The pipeline handles compression via Brotli, Zstandard, and Gzip, falls back to readability-lxml rendering for JavaScript-heavy sites, and parses HTML, PDF, and DOCX source formats with smart extraction of article content from common blog and report layouts. That range matters because vendor threat reports are notoriously inconsistent — some are static PDFs, some are JS-rendered marketing pages — and an ingestion pipeline that chokes on either would bottleneck the whole community contribution model.
MITRE ATT&CK integration is deep rather than decorative. The README states the full Enterprise framework — 691 techniques — is indexed, with real-time validation of technique IDs against MITRE data and a claimed 99% validation accuracy. Confidence scoring uses a multi-tier fallback chain from MITRE data to table lookups to keywords, which is a sensible degradation strategy when AI-generated mappings are ambiguous. For reviewers, this validation layer is the quality gate that keeps the corpus ATT&CK-consistent instead of accumulating hand-wavy mappings.
The standout visualization is the coverage heatmap at coverage-heatmap.html, which renders the full MITRE ATT&CK matrix colored by how many community hunts cover each technique, with click-through to the underlying hunts or, importantly, to the gap. It lives alongside a graph-based coverage map under a dedicated coverage hub. This turns the library from a lookup resource into a strategic instrument: a blue team lead can glance at the heatmap, identify techniques with zero community coverage, and either hunt there themselves or contribute the first hypothesis. Crowd-sourced gap analysis is a quietly powerful defensive primitive.
The automation stack runs on GitHub Actions managing the full submission lifecycle from draft to PR to merge, including duplicate detection via vector embeddings — similarity analysis flags potential duplicates before merge, ranked by closeness with per-candidate explanations — plus TTP diversity analysis and content validation. The stack section lists a deliberately boring frontend of HTML5, CSS3, and vanilla JavaScript, with Python, the Claude (Anthropic) API, the OpenAI API, and SQLite doing backend work. Configuration for self-hosters is environment-driven: AI_PROVIDER selects claude or openai, with ANTHROPIC_API_KEY or OPENAI_API_KEY required accordingly and CLAUDE_MODEL defaulting to claude-sonnet-5.
For practitioners who want to run hunts rather than just read them, the Kindling/ directory ships working templates: PEAK-Template.md for planning, executing, and documenting a hunt end to end, Hunt-Review.md for post-hunt findings write-ups, Hunt-Template.md defining the frontmatter format for submissions, and Resources.md for further reading. Reviewer process documentation lives in Keepers/Review-Process.md. This is the difference between a link dump and an operational methodology — the templates make the repo usable as a training artifact for junior hunters on an authorized defensive team.
At 346 stars with 38+ contributors and active issue-based workflows, the project shows the engagement profile of a healthy early-stage community resource rather than a abandoned link list. There is no license badge value populated in the metadata beyond the referenced LICENSE file, so teams adopting it institutionally should verify licensing terms before redistributing derived hunt libraries internally or externally. The HTML primary-language tag also signals this is fundamentally a content-plus-static-site project, not an installable tool.
In an authorized workflow, HEARTH slots neatly into proactive detection programs: pull a hypothesis from Flames/ mapped to a technique your threat model cares about, adapt the data sources to your SIEM, document with Kindling/ templates, and contribute the refined hunt back. Because it touches nothing outside your own logging estate, the risk surface is essentially zero — this is defensive tradecraft infrastructure, and the more analysts feed it, the more the heatmap becomes a genuine map of where the community is collectively blind.
THORCollective/HEARTH.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.