From 1f8df21eb46ae3e20fb691bed5d7d333315fb127 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 5 Jan 2026 00:17:34 +0100
Subject: [PATCH] python313Packages.agentic-threat-hunting-framework: init at
 0.2.2

Framework for agentic threat hunting

https://github.com/Nebulock-Inc/agentic-threat-hunting-framework
---
 .../default.nix                               | 54 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  4 ++
 2 files changed, 58 insertions(+)
 create mode 100644 pkgs/development/python-modules/agentic-threat-hunting-framework/default.nix

diff --git a/pkgs/development/python-modules/agentic-threat-hunting-framework/default.nix b/pkgs/development/python-modules/agentic-threat-hunting-framework/default.nix
new file mode 100644
index 000000000000..c9b661eee919
--- /dev/null
+++ b/pkgs/development/python-modules/agentic-threat-hunting-framework/default.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  click,
+  jinja2,
+  pyyaml,
+  rich,
+  pytest-cov-stub,
+  pytestCheckHook,
+  scikit-learn,
+}:
+
+buildPythonPackage rec {
+  pname = "agentic-threat-hunting-framework";
+  version = "0.2.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Nebulock-Inc";
+    repo = "agentic-threat-hunting-framework";
+    tag = "v${version}";
+    hash = "sha256-rt7WmBCbSqoZBpwGi7dzh8QDw8Iby3LSdavnCot1Hr0=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    click
+    jinja2
+    pyyaml
+    rich
+  ];
+
+  optional-dependencies = {
+    similarity = [ scikit-learn ];
+  };
+
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "athf" ];
+
+  meta = {
+    description = "Framework for agentic threat hunting";
+    homepage = "https://github.com/Nebulock-Inc/agentic-threat-hunting-framework";
+    changelog = "https://github.com/Nebulock-Inc/agentic-threat-hunting-framework/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4f7351e54f61..d55a8a44d846 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -142,6 +142,10 @@ self: super: with self; {
 
   agent-py = callPackage ../development/python-modules/agent-py { };
 
+  agentic-threat-hunting-framework =
+    callPackage ../development/python-modules/agentic-threat-hunting-framework
+      { };
+
   aggdraw = callPackage ../development/python-modules/aggdraw { };
 
   aggregate6 = callPackage ../development/python-modules/aggregate6 { };