Every commit scored for change-risk against this repo's own history, so 'elevated' means elevated here rather than on some global curve.
Needs review
51 commits sit in this repo's top risk tercile, which is 34% of the 152scored. The cut is drawn against this codebase's own history rather than a global curve, so a quiet repo still fills its top band, and here it starts at 7.6 out of 10. What pushes a commit up is size and spread together: a large change confined to one area scores below a smaller one scattered across a dozen files.
Commit categories over time, read off the subject line. Fixes carry the accent because that is the series this chart exists to show.
Began other-led, now leaning feature.
Ranked by change-risk, highest first. Priority is a tercile of this repo's own distribution, so a quiet repo still fills its top band.
| # | Commit | Author | When | Lines | Risk | Top driver |
|---|---|---|---|---|---|---|
| 1 | 2b4639cdRelease v0.4.0: Splunk integration and documentation expansion | Sydney Marrone | 6mo ago | +14.9K -1.5K | 100%Elevated | more lines added than baseline |
| 2 | 98c0c513docs: add agentic capabilities implementation plan | Ubuntuclaudeagent | 5mo ago | +2.9K -0 | 98%Elevated | more lines added than baseline |
| 3 | 7e8b7a64Release v0.3.0: Research agent framework | Sydney Marrone | 6mo ago | +4.1K -981 | 98%Elevated | more lines added than baseline |
| 4 | 6da0afd5Release v0.2.0: Add context, env, investigate, and similar commands | Sydney Marrone | 7mo ago | +3.9K -596 | 98%Elevated | more lines added than baseline |
| 5 | 66ba783bAdd CI/CD, testing infrastructure, and PyPI packaging setup | Sydney Marrone | 8mo ago | +5.6K -13 | 98%Elevated | more lines added than baseline |
| 6 | cae3fb9cAdd Level 2 AI agent integration for hypothesis generation | Sydney Marrone | 9mo ago | +3.7K -0 | 98%Elevated | more lines added than baseline |
| 7 | 2d8f070ffeat: model-agnostic LLM provider abstraction replacing hardcoded Bedrock | Sydney Marroneclaudeassisted | 4mo ago | +2.5K -459 | 95%Elevated | more lines added than baseline |
| 8 | 4111e4cacleaned up readme and added yaml frontmatter for hunts | Sydney Marrone | 8mo ago | +2.4K -493 | 95%Elevated | more lines added than baseline |
| 9 | 14fa32c6documentation consolidation and added back visual enchancements | Sydney Marrone | 8mo ago | +2.1K -4.9K | 95%Elevated | more lines added than baseline |
| 10 | aed275bcInitial commit | Sydney Marrone | 9mo ago | +2.0K -0 | 95%Elevated | more lines added than baseline |
| 11 | 9298827ffeat(metrics): add hunting metrics module with auto-instrumentation | Sydney Marrone | 1mo ago | +2.5K -104 | 92%Elevated | more lines added than baseline |
| 12 | 003d2b4bfeat: add ATHF MCP server exposing hunting operations as tools | Sydney Marroneclaudeassisted | 4mo ago | +1.2K -1 | 92%Elevated | more lines added than baseline |
| 13 | 48d1612aupdated cli documentation and incorporated it into ai assistant workflow to improve efficiency | Sydney Marrone | 7mo ago | +2.3K -43 | 92%Elevated | more lines added than baseline |
| 14 | 37937727added hunting-knowledge.md and updated files with references | Sydney Marrone | 8mo ago | +2.3K -22 | 92%Elevated | more lines added than baseline |
| 15 | c67458abupdated level 3 with support for mcp server. included example mcp server to use - . additional linting was also performed | Sydney Marrone | 8mo ago | +2.1K -614 | 92%Elevated | more lines added than baseline |
| 16 | d78cf270feat: add STIX-backed ATT&CK data provider with fallback and athf attack command | Sydney Marroneclaudeassisted | 4mo ago | +1.1K -15 | 89%Elevated | more lines added than baseline |
| 17 | 661e8667updated docs | Sydney Marrone | 7mo ago | +1.0K -146 | 89%Elevated | more lines added than baseline |
| 18 | db4618b0Implemented environmental context tracking per feedback. Added environments.md, vulnerabilities.md, and AGENTS.md. | Sydney Marrone | 9mo ago | +1.0K -1 | 89%Elevated | more lines added than baseline |
| 19 | b86297f6feat: add GitHub Issues automation loop | Sydney Marroneclaudeassisted | 3mo ago | +666 -0 | 87%Elevated | more lines added than baseline |
| 20 | ef6d3e1afeat: add hunt promote, research linking, and investigation list improvements (closes #12, #13, #14, #15) | Sydney Marroneclaudeassisted | 4mo ago | +796 -153 | 87%Elevated | more lines added than baseline |
| 21 | a6ab13a8updated testing for commands | Sydney Marrone | 7mo ago | +1.1K -745 | 87%Elevated | more lines added than baseline |
| 22 | 3b7a78cfRemove CVE hunting workflows, focus on behavior-based threat hunting | Sydney Marrone | 8mo ago | +948 -2.9K | 87%Elevated | more lines added than baseline |
| 23 | 57cccae5docs: add agentic capabilities design document | Ubuntuclaudeagent | 5mo ago | +374 -0 | 85%Elevated | more lines added than baseline |
| 24 | ab7c893bfixed images | Sydney Marrone | 7mo ago | +579 -1 | 85%Elevated | more lines added than baseline |
| 25 | a7862b09adding final updates | Sydney Marrone | 7mo ago | +840 -2.5K | 85%Elevated | more lines added than baseline |
| 26 | 92c10cc1chore(docker): harden container + scrub personal paths | Sydney Marrone | 1mo ago | +535 -4 | 83%Elevated | more lines added than baseline |
| 27 | bb7eaab2redid example hunts and updated level 4 to agentic | Sydney Marrone | 8mo ago | +574 -1.1K | 83%Elevated | more lines added than baseline |
| 28 | 4dc4f687created knowledge folder with threat hunter brain | Sydney Marrone | 8mo ago | +886 -15 | 83%Elevated | more lines added than baseline |
| 29 | 96b2865bfeat(mcp): adopt envelope-reduction response contract | Sydney Marrone | 2mo ago | +484 -3 | 81%Elevated | more lines added than baseline |
| 30 | aaf09219Add CI/CD, testing infrastructure, and PyPI packaging setup | Sydney Marrone | 8mo ago | +434 -0 | 81%Elevated | more lines added than baseline |
| 31 | ee9c6387multiple updates to make docs more concise | Sydney Marrone | 8mo ago | +375 -35 | 80%Elevated | more lines added than baseline |
| 32 | 6e17e4c2feat(similar): fold session logs into hunt similarity scores | Ubuntuclaudeassisted | 5mo ago | +213 -40 | 79%Elevated | more lines added than baseline |
| 33 | f22412e2feat: implement hierarchical hunt directory organization (v0.7.0) | Sydney Marroneclaudeassisted | 5mo ago | +405 -741 | 79%Elevated | more lines added than baseline |
| 34 | 94e08f3bfeat(mcp): persist generated hypotheses onto research docs | Sydney Marrone | 2mo ago | +288 -6 | 77%Elevated | more lines added than baseline |
| 35 | d77e5084docs(level4): add Baseline Profiling and Adversary Simulation Validation agents | Sydney Marroneclaudeassisted | 4mo ago | +182 -2 | 77%Elevated | more lines added than baseline |
| 36 | d37bfbb4Sync version to 0.2.4, migrate bundled data to athf/data/ | Sydney Marrone | 6mo ago | +532 -82 | 77%Elevated | more lines added than baseline |
| 37 | 7c83c296docs: add ATT&CK STIX integration to CLI reference, CHANGELOG, AGENTS, and README | Sydney Marroneclaudeassisted | 4mo ago | +261 -12 | 76%Elevated | more lines added than baseline |
| 38 | a4281855Redesign maturity model: Collapse to 5 levels (0-4) focused on AI integration. | Sydney Marrone | 9mo ago | +277 -286 | 76%Elevated | more lines added than baseline |
| 39 | c5cb448adocs: add MCP server to CHANGELOG, MCP_CATALOG, and README | Sydney Marroneclaudeassisted | 4mo ago | +183 -27 | 74%Elevated | more lines added than baseline |
| 40 | 96f3a3b9feat(similar): add _extract_session_text for session log parsing | Ubuntuclaudeassisted | 5mo ago | +138 -1 | 74%Elevated | more lines added than baseline |
| 41 | e7b97115style: fix flake8 and isort linting issues | Sydney Marroneclaudeassisted | 6mo ago | +163 -9 | 74%Elevated | more lines added than baseline |
| 42 | 9309b852feat(metrics): address CodeRabbit review | Sydney Marrone | 1mo ago | +197 -57 | 71%Elevated | more lines added than baseline |
| 43 | 131de9f7fix(hunt): auto-derive tactics from technique when --tactic is omitted | Yevhen | 3mo ago | +119 -3 | 71%Elevated | more lines added than baseline |
| 44 | 06a12cf2feat: add hypothesis generation duration tracking | Sydney Marroneclaudeassisted | 3mo ago | +160 -2 | 71%Elevated | more lines added than baseline |
| 45 | 96e4dc15feat(similar): add --sessions flag with session row display | Ubuntuclaudeassisted | 5mo ago | +123 -24 | 71%Elevated | more lines added than baseline |
| 46 | 521c57baupdates to readme flow | Sydney Marrone | 9mo ago | +109 -109 | 71%Elevated | more lines added than baseline |
| 47 | 4fc68af4feat(mcp): add athf_research_new tool | Sydney Marrone | 2mo ago | +98 -0 | 69%Elevated | more lines added than baseline |
| 48 | 4fac8239updated docs for python CLI | Sydney Marrone | 7mo ago | +142 -293 | 68%Elevated | more lines added than baseline |
| 49 | ff44eb1bImprove documentation clarity and consistency across all README files | Sydney Marrone | 9mo ago | +105 -52 | 68%Elevated | more lines added than baseline |
| 50 | 388344bafix(attack): sanitize STIX bundle and fix CI test for attack update | Sydney Marroneclaudeassisted | 3mo ago | +107 -4 | 67%Elevated | more lines added than baseline |
Two views of the same model: where the cuts fall, and what commit shape lands you above them.
Every scored commit, binned on the raw 0 to 10 score rather than the percentile. Percentile ranks are uniform by construction, so that axis has no shape to draw. The dashed lines are the tercile cuts behind each row's priority pill.
The 152 most recent commits, on their own recency sample rather than the feed above: that defaults to risk-sorted, so reusing it would plot only the top tercile and call it the spread. Big and scattered is what the model penalises. Click a dot to open it.
nebulock-inc/agentic-threat-hunting-framework has 164 commits in its history from 7 contributors, the first of them Oct 27, 2025. In the last 90 days 29 files were touched, 57 times in total, most often __version__.py. Every commit is scored for change risk from its size, spread and the history of the files it touches.
