Dnr Hunt
Proactive threat hunt over web/application logs, no alert in hand.
Install
npx skills add anthropics/defending-code-reference-harness --skill dnr-hunt -g -a claude-code -y- Repository
- anthropics/defending-code-reference-harness7.7k
- Category
- Security
- Updated
- 3mo ago
- License
- See repository
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Proactive threat hunt over web/application logs, no alert in hand. Profiles the corpus, runs a hypothesis-driven hunt loop with a mandatory written ledger, confirms suspects in source, detonates a local PoC, and writes INCIDENTS.json + INCIDENT_REPORT.md. Use when asked to "hunt the logs", "find the campaign", "look for signs of compromise", or "run dnr-hunt". The no-alert entry to the detection & response track; /dnr-respond is the lead-in-hand entry.
dnr-hunt
Proactive threat hunt: logs and source in, incidents out. You start with no alert, the question is "is there anything in here that shouldn't be?" The method is the deliverable as much as the findings: baseline first, then hypothesis → query → pivot, every step in writing, every suspicion confirmed in source and by detonation before it's called real.
Invoke with /dnr-hunt [target-or-logs-dir] [--repo path] [--fresh].
Arguments:
$1= a dnr target directory (containsconfig.yamlwithkind: dnr, e.g.targets/dnrcanary), or a bare directory of log files. Defaults totargets/dnrcanaryif it exists, else cwd.--repo= source tree of the application that produced the logs. For a dnr target this defaults to itsapp/directory. Without source, no finding can rise abovesuspected(see the hard rules).--fresh= ignore any checkpoint in the run dir's.dnr-hunt-state/and mint a new run dir.
