菜单
Insert urgent work as decimal phase (e.g., 72.1) between existing phases
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Show available THRUNT threat hunting commands and artifact layout
Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots
Initialize a threat hunting case from a signal, detection, intel lead, or analyst suspicion
Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Publish a hunt as a case report, escalation, detection promotion, or leadership summary
基于 SOC 职业分类
| name | thrunt-insert-phase |
| description | Insert urgent work as decimal phase (e.g., 72.1) between existing phases |
| argument-hint | <after> <description> |
| allowed-tools | Read, Write, Bash |
Uses decimal numbering (72.1, 72.2, etc.) to preserve the logical sequence of planned phases while accommodating urgent insertions.
Purpose: Handle urgent work discovered during execution without renumbering entire huntmap.
<execution_context> @.github/thrunt-god/workflows/insert-phase.md </execution_context>
Arguments: $ARGUMENTS (format: )Huntmap and state are resolved in-workflow via init phase-op and targeted tool calls.
