Cyber Threat Hunting

Status: **blocked**.

The violated guardrail is **cyber-authorization**: active collection/network operations require documented scope and runtime-proven controls before execution. Authorization cannot follow collection.

Stop the live-network activity. Restart only after verifying the engagement/scope reference, authorized entities and time window, collection purpose, controls, accountable owner, and evidence-preservation procedure.

Proceed using controlled synthetic/offline fixtures until then. Required evidence includes preserved raw telemetry, query/version, fixture or source provenance, retention and clock details, identity/access records, source limitations, and cited observations. Conclusions must remain bounded; missing telemetry is a **telemetry gap**, not evidence that the environment is clean.