Automated Threat Hunting: Turning Threat Intelligence into Executable Hunt Plans

This Rapid7 collection covers multiple high-impact security topics: Rapid7 built an automated threat-hunting pipeline that uses LLMs to extract adversary behaviors, map to MITRE ATT&CK, and generate tool queries to produce analyst-ready hunt plans quickly. Ivanti Sentry has two critical vulnerabilities (CVE-2026-10520: unauthenticated OS command injection leading to RCE as root; CVE-2026-10523: authentication bypass enabling creation of administrative accounts) with CVSS scores of 10.0 and 9.9 respectively. A critical Check Point VPN zero-day (CVE-2026-50751, CVSS 9.3) is being actively abused