help
CommandShow available THRUNT threat hunting commands and artifact layout
Add an idea to the backlog parking lot (999.x numbering)
name: thrunt:add-backlog description: Add an idea to the backlog parking lot (999.x numbering) argument-hint: <description> allowed-tools: - Read - Write - Bash
<objective> Add a backlog item to the huntmap using 999.x numbering. Backlog items are unsequenced ideas that aren't ready for active planning — they live outside the normal phase sequence and accumulate context over time. </objective>
<process>
1. **Read HUNTMAP.md** to find existing backlog entries:
cat .planning/HUNTMAP.md
2. **Find next backlog number:**
NEXT=$(node "$HOME/.claude/thrunt-god/bin/thrunt-tools.cjs" phase next-decimal 999 --raw)
If no 999.x phases exist, start at 999.1.
3. **Create the phase directory:**
SLUG=$(node "$HOME/.claude/thrunt-god/bin/thrunt-tools.cjs" generate-slug "$ARGUMENTS")
mkdir -p ".planning/phases/${NEXT}-${SLUG}"
touch ".planning/phases/${NEXT}-${SLUG}/.gitkeep"4. **Add to HUNTMAP.md** under a `## Backlog` section. If the section doesn't exist, create it at the end:
## Backlog
### Phase {NEXT}: {description} (BACKLOG)
**Goal:** [Captured for future planning]
**Hypotheses:** TBD
**Plans:** 0 plans
Plans:
- [ ] TBD (promote with /thrunt:review-backlog when ready)5. **Commit:**
node "$HOME/.claude/thrunt-god/bin/thrunt-tools.cjs" commit "docs: add backlog item ${NEXT} — ${ARGUMENTS}" --files .planning/HUNTMAP.md ".planning/phases/${NEXT}-${SLUG}/.gitkeep"6. **Report:**
## 📋 Backlog Item Added
Phase {NEXT}: {description}
Directory: .planning/phases/{NEXT}-{slug}/
This item lives in the backlog parking lot.
Use /hunt:shape-hypothesis {NEXT} to explore it further.
Use /thrunt:review-backlog to promote items to active milestone.</process>
<notes>
</notes>
Show available THRUNT threat hunting commands and artifact layout
Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Publish a hunt as a case report, escalation, detection promotion, or leadership summary
Audit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…
Check text against AGT prompt-injection, context-poisoning, and MCP threat detectors.
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…