Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
ATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.
| Date | Stars |
|---|---|
| 2026-07-31 | 347 |
| 2026-08-03 | 350 |
| 2026-08-06 | 350 |
Today
— stars today
This week
— stars this week
This month
— stars this month
Momentum
60.0
growth rate 0.00%/day
# Agentic Threat Hunting Framework (ATHF)  [](https://pypi.org/project/agentic-threat-hunting-framework/) [](https://pypi.org/project/agentic-threat-hunting-framework/) [](https://www.python.org/downloads/) [](https://github.com/Nebulock-Inc/agentic-threat-hunting-framework/blob/main/LICENSE) [](https://github.com/Nebulock-Inc/agentic-threat-hunting-framework/stargazers) **[Quick Start](#-quick-start)** • **[Installation](#installation)** • **[Documentation](#documentation)** • **[Examples](https://github.com/Nebulock-Inc/agentic-threat-hunting-framework/blob/main/SHOWCASE.md)** *Give your threat hunting program memory and agency.* The **Agentic Threat Hunting Framework (ATHF)** is the memory and automation layer for your threat hunting program. It gives your hunts structure, persistence, and context - making every past investigation accessible to both humans and AI. ATHF works with any hunting methodology (PEAK, TaHiTI, or your own process). It's not a replacement; it's the layer that makes your existing process AI-ready. ## What is ATHF? ATHF provides structure and persistence for threat hunting programs. It's a markdown-based framework that: - Documents hunts using the LOCK pattern (Learn → Observe → Check → Keep) - Maintains a searchable repository of past investigations - Enables AI assistants to reference your environment and previous work - Works with any SIEM/EDR platform - **NEW:** Includes AI-powered research and hypothesis generation agents (v0.3.0+) ## The Problem Most threat hunting programs lose valuable context once a hunt ends. Notes live in Slack or tickets, queries are written once and forgotten, and lessons learned exist only in analysts' heads. Even AI tools start from zero every time without access to your environment, your data, or your past hunts. ATHF changes that by giving your hunts structure, persistence, and context. **Read more:** [docs/why-athf.md](https://github.com/Nebulock-Inc/agentic-threat-hunting-framework/blob/main/docs/why-athf.md) ## The LOCK Pattern Every threat hunt follows the same basic loop: **Learn → Observe → Check → Keep**.  - **Learn:** Gather context from threat intel, alerts, or anomalies - **Observe:** Form a hypothesis about adversary behavior - **Check:** Test hypotheses with targeted queries - **Keep:** Record findings and lessons learned **Why LOCK?** It's small enough to use and strict enough for agents to interpret. By capturing every hunt in this format, ATHF makes it possible for AI assistants to recall prior work and suggest refined queries based on past results. **Read more:** [docs/lock-pattern.md](https://github.com/Nebulock-Inc/agentic-threat-hunting-framework/blob/main/docs/lock-pattern.md) ## The Five Levels of Agentic Hunting ATHF defines a simple maturity model. Each level builds on the previous one. **Most teams will live at Levels 1–2. Everything beyond that is optional maturity.**  | Level | Capability | What You Get | |-------|-----------|--------------| | **0** | Ad-hoc | Hunts exist in Slack, tickets, or analyst notes | | **1** | Documented | Persistent hunt records using LOCK | | **2** | Searchable | AI reads and recalls your hunts | | **3** | Generative | AI ex
Excerpt of 14,708 characters
Read on GitHubWould you bet a product on this? Bounded 0–100 and slow moving.
matched fp:121e2c204974b50b, topic:ai-agents, topic:agentic-ai, name:agentic