New stats hunting skill

The SecOps platform has had a lot more mathematical analytics capabilities built into it but working with it has its own learning curve, I’ve found.  To help with that, I created a new “Stats Hunter” skill:

https://github.com/GooGKush/secops-statistical-hunter

I’ve tried to make the skill work with someone to find the right kind of search, guiding the users to methodologies and choices before generating a multi-stage YARA-L stats search.  It also tried to give you guidance on noise thresholds.  

For example:

> Using the stats hunter skill, can you help me identify low prevalence domains over the last month?


▸ Thought for 3s, 906 tokens
  Analyzing Query Approaches
  To identify low prevalence domains over the last month using the SecOps Statistical Hunter (secops-statistical-hunter) methodology, we model this threat hunting workflow around     
  Fleet-Wide Entity Prevalence (P ≤ 2 internal endpoints) and Query Volume Dispersion over raw telemetry (UDM_EVENTS).                                                                 
  ──────                                                                                                                                                                               
  ### 1. Threat Archetype & Statistical Model                                                                                                                                          

  • Threat Archetype: LOW_PREVALENCE_INFRASTRUCTURE / C2_STAGING_DETECTION                                                                                                             
  • Telemetry Source: UDM_EVENTS (NETWORK_DNS) (with optional pivot to NETWORK_HTTP / NETWORK_CONNECTION)                                                                              
  • Mathematical Primitive: Enterprise-wide unique host count P = count_distinct (principal.asset.ip) aggregated per domain over a rolling 30-day window.                              
  • Hypothesis: Legitimate services (CDNs, OS update servers, major SaaS tools) exhibit high enterprise prevalence (P gg 10 hosts). In contrast, targeted adversary infrastructure     
  (stealthy C2 callbacks, staged payloads, spear-phishing destinations) typically resolves on only 1–2 endpoints.                                                                      
  ──────                                                                                                                                                                               
  ### 2. Semantic Sensitivity Tiers                                                                                                                                                    

  Before running across 30 days of telemetry, select a sensitivity boundary that balances signal coverage against analyst triage capacity:                                             

   Tier                   │ Host Prevalence (P) │ Query Volume Floor / Ceiling │ Physical Interpretation & False Positive Profile
  ────────────────────────┼─────────────────────┼──────────────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────
   CONSERVATIVE           │ P = 1  host         │ 10 ≤ Queries ≤ 500           │ Single-Host Persistent Beaconing: Surfaces domains queried repeatedly by exactly one host. Filters
                          │                     │                              │ out ephemeral one-shot lookups and widespread SaaS.
   BALANCED (Recommended) │ P ≤ 2  hosts        │ 3 ≤ Queries ≤ 500            │ Targeted Infrastructure & Initial Access: Captures staging and C2 callbacks across isolated hosts
                          │                     │                              │ while filtering transient single-packet noise.
   AGGRESSIVE             │ P ≤ 5  hosts        │ Queries ≥ 1                  │ Broad Outlier Sweep: Surfaces every low-volume domain across the fleet. High analyst triage volume;
                          │                     │                              │ includes typos and ephemeral CDN nodes.
   ❌ NOISE CLIFF         │ P > 10  hosts       │ No volume floor              │ Normal enterprise web traffic. Do not hunt at this threshold.
  ──────                                                                                                                                        

Then it gave me some options - both multi-stage and “classic” YARA-L and asked what I wanted to do next.  I went with a test probe to help it calibrate

The Skill is designed to help filter out noise and you see it doing that and clustering types of findings: 

For the output I tried to come up with summary views by default:

Whereas if you’re using an MCP client that supports Javascript graphical renderings, it can generate charts like it did here for a different query:

 

I’ve had some interesting results with broad questions like “Can you help me identify shadow AI in my environment leveraging my EDR and Network logs?”

Please give it a try and let me know how it works out?