🎣

Threat Hunter's Cookbook

Enter your server token to connect

Invalid token. Please check and try again.

Stored in session only · Never sent externally

🎣
Threat Hunter's
Cookbook
Built on PEAK Framework
Threat Analyzer
Enter a CVE, malware name, threat actor, or paste threat intel to generate Splunk hunting queries
Try:
🔒 Only public threat intelligence is used. No internal data is ever sent to AI. All SPL are templates requiring analyst review.
🎯
Ready to Hunt
Enter a threat above to generate hunting queries, threat intelligence, and technical analysis
Analysing threat intelligence...
Generating SPL queries and threat summary

Type
First Seen
Threat Actors
Affected Systems
Overview

MITRE ATT&CK Coverage
Tactics
Techniques
⚠️ Template queries only. Adapt index names, sourcetypes, and field names to your Splunk environment before running.
How It Works

Attack Chain
Key Observable Behaviours
⚠️ IOCs from public threat intelligence only. Verify before operationalising.
SPL Builder
Build Splunk hunting queries using Threat Hunter's Cookbook methods
Optional: add specific field=value conditions
⚗️
SPL Builder
Fill in the form and click Generate to build a Splunk hunting query
Building SPL query...
Generated SPL
⚠️ Template Only
Method Rationale

Query Breakdown
✅ True Positive Indicators
    ⚠️ False Positive Considerations
      🔧 Tuning Tips
        🔗 Related Hunts
          The Cookbook
          Quick reference for all seven Threat Hunter's Cookbook methods