Files
ThreatHunt/SKILLS/00-operating-model.md
mblanke 9b98ab9614 feat: interactive network map, IOC highlighting, AUP hunt selector, type filters
- NetworkMap: hunt-scoped force-directed graph with click-to-inspect popover
- NetworkMap: zoom/pan (wheel, drag, buttons), viewport transform
- NetworkMap: clickable IP/Host/Domain/URL legend chips to filter node types
- NetworkMap: brighter colors, 20% smaller nodes
- DatasetViewer: IOC columns highlighted with colored headers + cell tinting
- AUPScanner: hunt dropdown replacing dataset checkboxes, auto-select all
- Rename 'Social Media (Personal)' theme to 'Social Media' with DB migration
- Fix /api/hunts timeout: Dataset.rows lazy='noload' (was selectin cascade)
- Add OS column mapping to normalizer
- Full backend services, DB models, alembic migrations, new routes
- New components: Dashboard, HuntManager, FileUpload, NetworkMap, etc.
- Docker Compose deployment with nginx reverse proxy
2026-02-19 15:41:15 -05:00

641 B

Operating Model

Default cadence

  • Prefer iterative progress over big bangs.
  • Keep diffs small: target ≤ 300 changed lines per PR unless justified.
  • Update tests/docs as part of the same change when possible.

Working agreement

  • Start with a PLAN for non-trivial tasks.
  • Implement the smallest slice that satisfies acceptance criteria.
  • Verify via DoD.
  • Write a crisp PR summary: what changed, why, and how verified.

Stop conditions (plan first)

Stop and produce a PLAN (do not code yet) if:

  • scope is unclear
  • more than 3 files will change
  • data model changes
  • auth/security boundaries
  • performance-critical paths