Threat Hunter

Use this on the first conversation after a Threat Hunter bot is imported: introduce the bot, ask the setup questions, then build the SIEM, hunts, teammate links, and schedules.

Use this when building a free single-node Wazuh SIEM (indexer, manager, dashboard, local agent, procmon) on the bot's own box without systemd or Docker.

Use this when building, testing, tuning, or running the Wazuh hunting suite for attacks on AI agents (malicious MCP servers, poisoned packages, config tampering, credential theft, persistence) on the bot's box.

Use this when a threat-hunter bot works with teammate security bots: pulling intel from a Threat Intel bot's OpenCTI, retro-hunting new IOCs, feeding honeypot hits into hunts, or handing confirmed findings back.

Use this when researching recent attacks on AI agents on X (Twitter) read-only and turning them into vetted IOCs, hunts, and Wazuh rules, including the weekly research sweep.

Fires every hour to run the quick agent-attack hunt and alert the owner only when a real medium-or-higher finding survives triage.

Fires each morning to run the deep daily hunt, sync threat intel, and send the owner a short security summary.