Show available THRUNT threat hunting commands and artifact layout

Map available telemetry, query surfaces, tenants, retention windows, and investigation blind spots

Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs

Publish a hunt as a case report, escalation, detection promotion, or leadership summary

Execute a hunt phase with parallel telemetry work, query logging, receipt generation, and optional wave targeting

Add phase to end of current milestone in huntmap

Generate tests for a completed phase based on Evidence Review criteria and implementation

Capture idea or task as todo from current conversation context

Cross-phase audit of all outstanding Evidence Review and findings validation items

Audit milestone completion against original intent before archiving

List pending todos and select one to work on

Archive accumulated phase directories from completed milestones

Archive completed milestone and prepare for next version

Systematic debugging with persistent state across context resets

Diagnose planning directory health and optionally repair issues

Show available THRUNT commands and usage guide

Insert urgent work as decimal phase (e.g., 72.1) between existing phases

Find the current THRUNT community channels

Surface the agent's assumptions about a phase approach before planning