help
CommandShow available THRUNT threat hunting commands and artifact layout
Turn a signal into testable hunt hypotheses, scope, datasets, and success criteria
name: hunt:shape-hypothesis description: Turn a signal into testable hunt hypotheses, scope, datasets, and success criteria argument-hint: "[signal-or-phase]" allowed-tools: - Read - Bash - Write - AskUserQuestion - Task
<objective> Refine the active signal into testable hunt hypotheses.
`HYPOTHESES.md`, `SUCCESS_CRITERIA.md`, and `HUNTMAP.md` remain the source of truth.
**Updates:**
**After this command:** Run `/hunt:plan 1` or `/hunt:run 1` if plans already exist. </objective>
<execution_context> @~/.claude/thrunt-god/workflows/hunt-shape-hypothesis.md @~/.claude/thrunt-god/templates/hypotheses.md @~/.claude/thrunt-god/templates/success-criteria.md @~/.claude/thrunt-god/templates/huntmap.md </execution_context>
<process> Execute the hypothesis-shaping workflow from @~/.claude/thrunt-god/workflows/hunt-shape-hypothesis.md. Drive toward hypotheses that can be proven, disproven, or left explicitly inconclusive. </process>
Show available THRUNT threat hunting commands and artifact layout
Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Publish a hunt as a case report, escalation, detection promotion, or leadership summary
Audit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…
Check text against AGT prompt-injection, context-poisoning, and MCP threat detectors.
Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…