agentic-threat-hunting-framework 0.2.0__tar.gz → 0.2.1__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- {agentic_threat_hunting_framework-0.2.0/agentic_threat_hunting_framework.egg-info → agentic_threat_hunting_framework-0.2.1}/PKG-INFO +1 -1
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1/agentic_threat_hunting_framework.egg-info}/PKG-INFO +1 -1
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/athf/__version__.py +1 -1
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/athf/commands/env.py +2 -1
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/athf/commands/similar.py +2 -2
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/athf/core/attack_matrix.py +18 -3
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/docs/CHANGELOG.md +8 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/docs/CLI_REFERENCE.md +3 -3
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/pyproject.toml +1 -1
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/LICENSE +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/MANIFEST.in +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/README.md +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/USING_ATHF.md +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/agentic_threat_hunting_framework.egg-info/SOURCES.txt +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/agentic_threat_hunting_framework.egg-info/dependency_links.txt +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/agentic_threat_hunting_framework.egg-info/entry_points.txt +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/agentic_threat_hunting_framework.egg-info/requires.txt +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/agentic_threat_hunting_framework.egg-info/top_level.txt +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/assets/athf-cli-workflow.gif +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/assets/athf-level0.gif +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/assets/athf-level1.gif +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/assets/athf-level2.gif +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/assets/athf-level3.gif +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/assets/athf_fivelevels.png +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/assets/athf_level_3.png +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/assets/athf_lock.png +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/assets/athf_logo.png +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/assets/athf_manual_v_ai.png +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/athf/__init__.py +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/athf/cli.py +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/athf/commands/__init__.py +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/athf/commands/context.py +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/athf/commands/hunt.py +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/athf/commands/init.py +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/athf/commands/investigate.py +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/athf/core/__init__.py +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/athf/core/hunt_manager.py +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/athf/core/hunt_parser.py +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/athf/core/investigation_parser.py +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/athf/core/template_engine.py +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/athf/utils/__init__.py +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/docs/INSTALL.md +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/docs/README.md +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/docs/environment.md +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/docs/getting-started.md +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/docs/level4-agentic-workflows.md +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/docs/lock-pattern.md +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/docs/maturity-model.md +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/docs/why-athf.md +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/hunts/FORMAT_GUIDELINES.md +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/hunts/H-0001.md +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/hunts/H-0002.md +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/hunts/H-0003.md +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/hunts/README.md +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/integrations/MCP_CATALOG.md +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/integrations/README.md +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/integrations/quickstart/splunk.md +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/knowledge/hunting-knowledge.md +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/setup.cfg +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/setup.py +0 -0
- {agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/templates/HUNT_LOCK.md +0 -0
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.4
|
|
2
2
|
Name: agentic-threat-hunting-framework
|
|
3
|
-
Version: 0.2.
|
|
3
|
+
Version: 0.2.1
|
|
4
4
|
Summary: Agentic Threat Hunting Framework - Memory and AI for threat hunters
|
|
5
5
|
Author-email: Sydney Marrone <athf@nebulock.io>
|
|
6
6
|
Maintainer-email: Sydney Marrone <athf@nebulock.io>
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.4
|
|
2
2
|
Name: agentic-threat-hunting-framework
|
|
3
|
-
Version: 0.2.
|
|
3
|
+
Version: 0.2.1
|
|
4
4
|
Summary: Agentic Threat Hunting Framework - Memory and AI for threat hunters
|
|
5
5
|
Author-email: Sydney Marrone <athf@nebulock.io>
|
|
6
6
|
Maintainer-email: Sydney Marrone <athf@nebulock.io>
|
|
@@ -3,6 +3,7 @@
|
|
|
3
3
|
import subprocess # nosec B404
|
|
4
4
|
import sys
|
|
5
5
|
from pathlib import Path
|
|
6
|
+
from typing import Union
|
|
6
7
|
|
|
7
8
|
import click
|
|
8
9
|
from rich.console import Console
|
|
@@ -280,7 +281,7 @@ def info() -> None:
|
|
|
280
281
|
|
|
281
282
|
# Get installed packages count
|
|
282
283
|
pip_path = python_path.parent / "pip"
|
|
283
|
-
package_count: int
|
|
284
|
+
package_count: Union[int, str]
|
|
284
285
|
try:
|
|
285
286
|
result = subprocess.run(
|
|
286
287
|
[str(pip_path), "list", "--format", "freeze"],
|
|
@@ -132,8 +132,8 @@ def _find_similar_hunts(
|
|
|
132
132
|
) -> List[Dict[str, Any]]:
|
|
133
133
|
"""Find similar hunts using TF-IDF similarity."""
|
|
134
134
|
try:
|
|
135
|
-
from sklearn.feature_extraction.text import TfidfVectorizer
|
|
136
|
-
from sklearn.metrics.pairwise import cosine_similarity
|
|
135
|
+
from sklearn.feature_extraction.text import TfidfVectorizer
|
|
136
|
+
from sklearn.metrics.pairwise import cosine_similarity
|
|
137
137
|
except ImportError:
|
|
138
138
|
console.print("[red]Error: scikit-learn not installed[/red]")
|
|
139
139
|
console.print("[dim]Install with: pip install scikit-learn[/dim]")
|
|
@@ -4,9 +4,20 @@ This module contains reference data for the MITRE ATT&CK Enterprise matrix,
|
|
|
4
4
|
including tactic ordering and technique counts.
|
|
5
5
|
"""
|
|
6
6
|
|
|
7
|
+
from typing import Dict, TypedDict
|
|
8
|
+
|
|
9
|
+
|
|
10
|
+
class TacticInfo(TypedDict):
|
|
11
|
+
"""Type definition for tactic information."""
|
|
12
|
+
|
|
13
|
+
name: str
|
|
14
|
+
technique_count: int
|
|
15
|
+
order: int
|
|
16
|
+
|
|
17
|
+
|
|
7
18
|
# MITRE ATT&CK Enterprise Matrix v14 (January 2024)
|
|
8
19
|
# Approximate technique counts per tactic (includes sub-techniques)
|
|
9
|
-
ATTACK_TACTICS = {
|
|
20
|
+
ATTACK_TACTICS: Dict[str, TacticInfo] = {
|
|
10
21
|
"reconnaissance": {
|
|
11
22
|
"name": "Reconnaissance",
|
|
12
23
|
"technique_count": 10,
|
|
@@ -92,7 +103,9 @@ def get_tactic_display_name(tactic_key: str) -> str:
|
|
|
92
103
|
Returns:
|
|
93
104
|
Display name (e.g., "Credential Access")
|
|
94
105
|
"""
|
|
95
|
-
|
|
106
|
+
if tactic_key in ATTACK_TACTICS:
|
|
107
|
+
return ATTACK_TACTICS[tactic_key]["name"]
|
|
108
|
+
return tactic_key.replace("-", " ").title()
|
|
96
109
|
|
|
97
110
|
|
|
98
111
|
def get_tactic_technique_count(tactic_key: str) -> int:
|
|
@@ -104,7 +117,9 @@ def get_tactic_technique_count(tactic_key: str) -> int:
|
|
|
104
117
|
Returns:
|
|
105
118
|
Total technique count for the tactic
|
|
106
119
|
"""
|
|
107
|
-
|
|
120
|
+
if tactic_key in ATTACK_TACTICS:
|
|
121
|
+
return ATTACK_TACTICS[tactic_key]["technique_count"]
|
|
122
|
+
return 0
|
|
108
123
|
|
|
109
124
|
|
|
110
125
|
def get_sorted_tactics() -> list[str]:
|
{agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/docs/CHANGELOG.md
RENAMED
|
@@ -25,6 +25,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
25
25
|
### Security
|
|
26
26
|
- None
|
|
27
27
|
|
|
28
|
+
## [0.2.1] - 2024-12-17
|
|
29
|
+
|
|
30
|
+
### Fixed
|
|
31
|
+
- Type errors in `athf/core/attack_matrix.py` (added TypedDict for proper mypy checking)
|
|
32
|
+
- Python 3.8 compatibility in `athf/commands/env.py` (Union syntax)
|
|
33
|
+
- Removed unused type ignore comments in `athf/commands/similar.py`
|
|
34
|
+
- CI/CD pipeline mypy errors blocking builds
|
|
35
|
+
|
|
28
36
|
## [0.2.0] - 2024-12-17
|
|
29
37
|
|
|
30
38
|
### Added
|
|
@@ -148,7 +148,7 @@ edr: crowdstrike
|
|
|
148
148
|
hunt_prefix: H
|
|
149
149
|
retention_days: 90
|
|
150
150
|
initialized: 2025-12-02T14:30:00
|
|
151
|
-
version: 0.2.
|
|
151
|
+
version: 0.2.1
|
|
152
152
|
```
|
|
153
153
|
|
|
154
154
|
### Exit Codes
|
|
@@ -237,7 +237,7 @@ Virtual Environment Info:
|
|
|
237
237
|
Location: /path/to/.venv
|
|
238
238
|
Python: Python 3.11.5
|
|
239
239
|
Packages: 42 installed
|
|
240
|
-
athf: ✓ Installed (version 0.2.
|
|
240
|
+
athf: ✓ Installed (version 0.2.1)
|
|
241
241
|
scikit-learn: ✓ Installed (required for athf similar)
|
|
242
242
|
```
|
|
243
243
|
|
|
@@ -1658,7 +1658,7 @@ retention_days: 90
|
|
|
1658
1658
|
|
|
1659
1659
|
# Metadata (auto-generated)
|
|
1660
1660
|
initialized: 2025-12-02T14:30:00
|
|
1661
|
-
version: 0.2.
|
|
1661
|
+
version: 0.2.1
|
|
1662
1662
|
```
|
|
1663
1663
|
|
|
1664
1664
|
### Environment Variables
|
{agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/pyproject.toml
RENAMED
|
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
|
|
|
4
4
|
|
|
5
5
|
[project]
|
|
6
6
|
name = "agentic-threat-hunting-framework"
|
|
7
|
-
version = "0.2.
|
|
7
|
+
version = "0.2.1"
|
|
8
8
|
description = "Agentic Threat Hunting Framework - Memory and AI for threat hunters"
|
|
9
9
|
readme = {file = "README.md", content-type = "text/markdown"}
|
|
10
10
|
requires-python = ">=3.8"
|
|
File without changes
|
{agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/MANIFEST.in
RENAMED
|
File without changes
|
|
File without changes
|
{agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/USING_ATHF.md
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
{agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/athf/__init__.py
RENAMED
|
File without changes
|
{agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/athf/cli.py
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
{agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/docs/INSTALL.md
RENAMED
|
File without changes
|
{agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/docs/README.md
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
{agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/docs/why-athf.md
RENAMED
|
File without changes
|
|
File without changes
|
{agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/hunts/H-0001.md
RENAMED
|
File without changes
|
{agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/hunts/H-0002.md
RENAMED
|
File without changes
|
{agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/hunts/H-0003.md
RENAMED
|
File without changes
|
{agentic_threat_hunting_framework-0.2.0 → agentic_threat_hunting_framework-0.2.1}/hunts/README.md
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|