threat hunting

Practical, Bash-first guide to AI-assisted threat hunting on Linux: install Zeek, Suricata, TShark, jq, and Python via apt/dnf/zypper; collect and normalize logs; engineer features; run IsolationForest to surface odd flows; detect DGAs and beaconing with explainable heuristics; probe rare process trees with auditd; then automate hunts with systemd/cron, tune thresholds, and feed findings to your SIEM.

Turn Linux logs into actionable security signals with a local, Bash-friendly AI toolkit: install Python/pip/venv and jq, then use an Isolation Forest to flag anomalous SSH IPs, Drain3 to collapse noisy patterns, and simple Bash+curl+jq to push alerts (Slack/webhooks). Includes distro-specific installs, journald/file support, tuning tips, and optional Ollama summaries—no SIEM or cloud required.