hunt.md 0.7

Format (SPEC)

• §5.7 Prevalence and baseline — prevalence: {key, by, rare_below} and baseline: {window, compare}: the stack-count-and-compare pattern. A runtime capable of native first-seen or prior-window calculation executes them directly; others run the query as written. Both travel as named primitive_config keys. Quality profile warns when no query declares prevalence or aggregates.
• §3.7 Typed parameters and indicator provenance — type: supports scalar primitives (string, duration, cidr, regex, etc.) and typed lists list[<member>] (list[domain], list[ip], list[url], list[hash], list[path]). Volatile indicator lists declare from: {kind, ref, observed}. Quality profile warns on volatile indicators observed over 365 days ago.
• §5.8 Query role and paired portable form — role= info-string attribute (scoping, baseline, enrichment, triage, detection-candidate). A secondary fenced code block flagged portable (sigma, yara, yara-l, stix, suricata, snort) attaches as the query's portable twin rather than redefining the step. hunt.handoff: promote-to-detection without a detection-candidate query is an info note by default and a warning under quality.
• §3.8 Related hunts and series — series: {slug, index, total, title} for multi-part investigation chains, and related: [{hunt, relation, reason}] (precedes, follows, sibling, alternative, supersedes, superseded-by, out-of-scope-alternative). CLI --split -o <dir> splits multi-hypothesis MISP events into series-wired hunt files.
• §8.2 Agent context budget and citation demand — context: entries accept {step, rows} objects to bound evidence input tokens alongside bare step names; cite: required | optional states explicit citation demands at the step level.
• MISP hygiene (#11) — Stricter is_misp_event shape verification prevents non-event YAML/JSON from being misidentified. CLI --date argument (or created: frontmatter) pins the event date for reproducible, byte-stable fixtures. misp-galaxy:mitre-attack-pattern tags emitted from named ATT&CK references; workflow:state mirrors context status; sigma logsource target derivation replaces SIEM guesses; multi-event restSearch responses parsed and split cleanly.

Tooling & Compatibility

• Backward compatibility promise (0.6 → 0.7): Frozen copies of the 0.6 repo hunts added under tools/tests/fixtures/*-0.6.md; check.py asserts they lint with identical errors and warnings under format and huntbase profiles.
• JSON & CACAO export serialization: CLI convert passes default=str to json.dumps for --to cacao and --to json so datetime.date objects serialize without error.
• CLI --date flag: Wired through _cmd_convert to markdown_to_misp.
• Portable rule export/import: In MISP, portable twins export as standard sigma/yara objects linked tests → hypothesis and derived-from → the query step; re-import restores them as twins. In CACAO, twins ride in x_hunt_portable.

See CHANGELOG.md for complete details.