help
CommandShow available THRUNT threat hunting commands and artifact layout
Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots
name: hunt:map-environment description: Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots allowed-tools: - Read - Bash - Write - AskUserQuestion - Task
<objective> Create or refresh the environment map for this hunt program or case.
**Creates or updates:**
Unknown tenants, tools, retention windows, access paths, and blind spots must remain `TBD` until the operator confirms them. Confirmed environment facts should replace existing `TBD` markers immediately; only unresolved fields should stay `TBD`.
**After this command:** Run `/hunt:shape-hypothesis` or `/hunt:plan 1`. </objective>
<execution_context> @~/.claude/thrunt-god/workflows/hunt-map-environment.md @~/.claude/thrunt-god/templates/environment-map.md </execution_context>
<process> Execute the environment-mapping workflow from @~/.claude/thrunt-god/workflows/hunt-map-environment.md. Prefer concrete environment facts over generic best practices. Preserve existing analyst notes. Default behavior is to preserve confirmed facts and leave unknown values as `TBD` rather than populating simulated environment details. Replace `TBD` only where live workspace evidence or direct operator input confirms the fact. </process>
Show available THRUNT threat hunting commands and artifact layout
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Publish a hunt as a case report, escalation, detection promotion, or leadership summary
Execute a hunt phase with parallel telemetry work, query logging, receipt generation, and optional wave targeting
Audit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…
Check text against AGT prompt-injection, context-poisoning, and MCP threat detectors.
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…