# Dnr Hunt

Proactive threat hunt over web/application logs, no alert in hand.

- Repository: https://github.com/anthropics/defending-code-reference-harness (7690 stars)
- Category: Security
- License: see repository
- Last updated: 2026-08-06
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add anthropics/defending-code-reference-harness --skill dnr-hunt -g -a claude-code -y`
Codex: `npx skills add anthropics/defending-code-reference-harness --skill dnr-hunt -g -a codex -y`
Cursor: `npx skills add anthropics/defending-code-reference-harness --skill dnr-hunt -g -a cursor -y`
Gemini CLI: `npx skills add anthropics/defending-code-reference-harness --skill dnr-hunt -g -a gemini-cli -y`

## Description

Proactive threat hunt over web/application logs, no alert in hand. Profiles the corpus, runs a hypothesis-driven hunt loop with a mandatory written ledger, confirms suspects in source, detonates a local PoC, and writes INCIDENTS.json + INCIDENT_REPORT.md. Use when asked to "hunt the logs", "find the campaign", "look for signs of compromise", or "run dnr-hunt". The no-alert entry to the detection & response track; /dnr-respond is the lead-in-hand entry.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# dnr-hunt

Proactive threat hunt: logs and source in, incidents out. You start with
**no alert**, the question is "is there anything in here that shouldn't
be?" The method is the deliverable as much as the findings: baseline first,
then hypothesis → query → pivot, every step in writing, every suspicion
confirmed in source and by detonation before it's called real.

Invoke with `/dnr-hunt [target-or-logs-dir] [--repo path] [--fresh]`.

**Arguments:**
- `$1` = a dnr target directory (contains `config.yaml` with `kind: dnr`,
  e.g. `targets/dnrcanary`), or a bare directory of log files. Defaults to
  `targets/dnrcanary` if it exists, else cwd.
- `--repo` = source tree of the application that produced the logs. For a
  dnr target this defaults to its `app/` directory. Without source, no
  finding can rise above `suspected` (see the hard rules).
- `--fresh` = ignore any checkpoint in the run dir's `.dnr-hunt-state/` and
  mint a new run dir.

## Hard rules (these are the skill, do not relax them)

The rest: https://github.com/anthropics/defending-code-reference-harness/blob/HEAD/.claude/skills/dnr-hunt/SKILL.md