Building ThreatLens: An Offline Threat Hunting CLI That Maps Logs to MITRE ATT&CK

Most blue team tooling assumes you have a SIEM, a budget, and a network connection. That's a fine assumption for an enterprise SOC, but it kills the feedback loop for students, home-labbers, IR consultants who land in air-gapped environments, and anyone who just wants to triage a dump of logs without spinning up infrastructure. That's the gap I built ThreatLens to fill: a single Python CLI that ingests EVTX, JSON, Syslog, and CEF logs, runs Sigma rules plus a set of opinionated detectors, correl