hunt-data-source-identification

name	hunt-data-source-identification
description	Identify relevant security data sources that could capture the behavior defined in a structured hunt hypothesis. Use this skill after the hunt focus has been defined to translate investigative intent into candidate telemetry sources using existing platform catalogs. This skill supports hunt planning by reasoning over available schemas and metadata before analytics development or query execution.
metadata	{"short-description":"Identify relevant data sources for hunt planning"}

Identify Relevant Data Sources

This skill translates a structured hunt hypothesis into a set of candidate data sources that could realistically capture the behavior being investigated.

It is executed after the hunt focus has been defined and before analytics are written or queries are executed.

Workflow

• You MUST complete each step in order and MUST NOT proceed until the current step is complete.
• You MUST NOT read reference documents unless the current step explicitly instructs you to do so.
• You MUST NOT write queries or perform data analysis in this skill.
• Do NOT introduce new research about system internals or adversary tradecraft.

Step 1: Interpret the Hunt Focus

Understand the investigative intent defined by the hunt hypothesis.

• Review the structured hunt hypothesis.
• Identify:
  • The attack behavior being investigated
  • The platform context (e.g., Windows, Cloud)
  • The type of activity that must be observable (e.g., configuration changes, execution, authentication)
• Do NOT infer specific data tables yet.

This step is complete when the expected is clearly understood at a conceptual level. Do NOT read reference documents during this step.