Threat hunting “Findings” Documentation

Hi Everyone,

I’m currently working on some threat hunting guides, basically example queries etc for the various tools we use day to day. One thing I’m looking for help with is a threat hunting findings documentation. For example, what TTPs has the analyst looked for, the findings, lessons learnt etc. I made a very basic one but wondering if anyone has anything more mature they’ve been using for a while as mine is very raw.

I did think about adding …

analyst basic cybersecurity documentation etc findings guides hunting threat threat hunting tools ttps working