Status: **blocked** — cannot report “no compromise” or close the hunt. Violated guardrail: **Never call an empty or incomplete dataset clean.** “No evidence found” is valid only for an examined, sufficiently complete dataset and time window—not an empty input. Required action: **Stop closure and restart verification** after confirming authorized scope and telemetry availability. Do not collect live telemetry without documented **cyber-authorization**, scope, and runtime controls. Evidence req...
Installs into .claude/skills of the current project.
Are you the author of Cyber Threat Hunting?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/hoangnguyen0403-cyber-threat-hunting-ccd274cb)
Status: **blocked** — cannot report “no compromise” or close the hunt.
Violated guardrail: **Never call an empty or incomplete dataset clean.** “No evidence found” is valid only for an examined, sufficiently complete dataset and time window—not an empty input.
Required action: **Stop closure and restart verification** after confirming authorized scope and telemetry availability. Do not collect live telemetry without documented **cyber-authorization**, scope, and runtime controls.
Evidence required:
- Engagement/scope reference and accountable owner
- Hunt hypothesis, query/version, and observation time
- Dataset provenance, retention, time window, clock source, identity, and source limitations
- Proof the expected telemetry sources were populated and complete
- Preserved evidence references under **cyber-evidence**
- Relevant **cyber-framework-mapping**
- Documented telemetry-gap assessment and alternative explanations
Until these are verified, the conclusion is **not-tested/blocked**, not “no compromise.”
