reverse-skills-max/reverse-skill-repo/skills/threat-hunting/references/hunting-loop.md

狩猎环

Hypothesis → Data → Query → Investigate → Detect/Dismiss → Tune → Document

每轮输出：假说状态（confirmed/rejected/inconclusive）+ Evidence ID。