Sec-Hunt playbook

sec-hunt run <playbook>

Executes a hunting playbook with Sec-Hunt, launching the repeatable hunts defined in the YAML file against the sources.

Use it when you want repeatable and shareable hunting: Sec-Hunt (by frack113) defines hunting playbooks in YAML — the hunt steps (queries against sources, filters, logic) — and the runner executes them against the data. It's hunting as code: the documented playbook (technique, steps) executed repeatably and shared with the team. In purple teaming and hunting, Sec-Hunt is the hunt playbook: the hunted technique with its versioned procedure — repeating the hunt without reinventing the steps.

Don't use it without the sources: playbooks run against logs (playbook queries) — without accessible data, the hunt has no material. And note: Sec-Hunt playbooks cover documented techniques from the repo — environment-specific hunts (custom applications) are written using the project's format. Execution generates results to review — the playbook flags, the analyst decides; results without context are false positive work. The project is community-driven (repo with playbooks): playbook quality should be reviewed before trusting. For full automation, the runner integrates with the environment's SIEM.