synos-threat-hunting — Threat hunting engine

tags: [general]

synos-threat-hunting — Threat hunting engine

Classification: PUBLIC
Crate: fruit/crates/synos-threat-hunting/
Milestone: v1+
License: MIT OR Apache-2.0
Version: v111.0.0 “Last Light”

What It Is

synos-threat-hunting is a comprehensive threat hunting platform for Syn_OS, providing YARA rule execution, Sigma detection, custom query language processing, IOC scanning, log ingestion, threat actor profiling, and timeline correlation analysis. It orchestrates multiple detection engines into a unified ThreatHuntingPlatform that manages hunt sessions, tracks findings with MITRE ATT&CK technique mapping, and produces evidence-backed hunt reports.

Architecture

Modules

Module	Purpose
yara_engine	YARA rule compilation and matching engine for file and memory artifact scanning
sigma_detection	Sigma rule engine for SIEM-style detection across log formats
sigma_yaml_loader	YAML parser for Sigma rule loading and validation
ioc_scanner	IOC scanner matching observed artifacts against known indicators
log_ingester	Log ingestion pipeline for JSON, CSV, and unstructured log formats
query_language	Custom HuntQueryEngine for ad-hoc hunt queries across ingested data
timeline_analysis	TimelineAnalyzer for chronological correlation of events across sources
threat_profiling	ThreatActorProfiler for TTP-based adversary behavior modeling

How It’s Wired

1. synos-threat-intel — The ioc_scanner consumes normalized IOCs from the threat intelligence feed, matching them against live log streams ingested by log_ingester.
2. synos-findings-store — HuntFinding records are emitted to the append-only JSONL sink, content-addressed by SHA-256 for deduplication across tools.
3. YARA + Sigma dual-engine — yara_engine and sigma_detection run in parallel across the same artifact set, with sigma_yaml_loader converting Sigma YAML rules into native detection logic.
4. Query language — HuntQueryEngine allows operators to write ad-hoc queries that combine IOCScanner results, YaraEngine matches, and TimelineAnalyzer correlations in a single session.
5. Threat actor profiling — ThreatActorProfiler builds behavioral models from HuntFinding evidence, mapping observed TTPs to MITRE ATT&CK techniques for campaign attribution.

Future Ideas

1. Add a synos-threat-hunting-sigma module for Sigma rule translation into YARA and synos-engine sandbox execution policies.
2. Implement timeline_analysis graph export to GraphML/CSV for visual investigation tools like Maltego.
3. Wire ThreatHuntingPlatform into synos-raas-api so MSSP clients can trigger automated hunt sessions as part of compliance assessments.