Automated Threat Hunting: Turning Threat Intelligence into Executable Hunt Plans

This Rapid7 collection covers multiple high-impact security developments: an automated threat-hunting pipeline that uses LLMs to extract adversary behaviors, map to MITRE ATT&CK, and generate analyst-ready hunt plans; two critical Ivanti Sentry vulnerabilities (CVE-2026-10520 — OS command injection RCE, CVSS 10.0, and CVE-2026-10523 — authentication bypass, CVSS 9.9) allowing unauthenticated remote root/RCE and administrative account creation; an actively exploited Check Point VPN zero-day (CVE-2026-50751, CVSS 9.3) enabling VPN authentication bypass with observed exploitation since May (ties‑