Dfirtnt Huntable Cti Studio Rs

RS — Rescore All Articles

tomevault-io Updated

File contents

RS — Rescore All Articles

When the user says rs, run both rescore commands. Do not commit or push; this is data-only.

Commands (in order)

  1. Keyword/regex hunt scoresthreat_hunting_score in article metadata:

    ./run_cli.sh rescore --force
    
  2. ML hunt scoresml_hunt_score from chunk-level model predictions:

    ./run_cli.sh rescore-ml --force
    

When to use

  • After changing scoring rules (keyword rescore).
  • After retraining the ML model or changing aggregation (rescore-ml).
  • To backfill or refresh all article scores.

Optional scope

  • Single article: ./run_cli.sh rescore --article-id ID --force and ./run_cli.sh rescore-ml --article-id ID --force.
  • Dry run: add --dry-run to either command to preview without writing.

Out of scope

  • No git add / commit / push (use lg for that).

Converted and distributed by TomeVault — claim your Tome and manage your conversions.

tomevault-io/skills-registry/tree/main/dfirtnt--huntable-cti-studio--rs commit da781c54f0

Frequently asked questions

npx skillmds@latest add tomevault-io/dfirtnt-huntable-cti-studio-rs