backbay-labs

Show available THRUNT threat hunting commands and artifact layout

Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots

Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion

Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories

Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs

Publish a hunt as a case report, escalation, detection promotion, or leadership summary

Execute a hunt phase with parallel telemetry work, query logging, receipt generation, and optional wave targeting

Turn a signal into testable hunt hypotheses, scope, datasets, and success criteria

A simple skill demonstrating clawdstrike security