ADR-012: Hunting, threat intelligence, and platform health live in CHAD

Source of truth: docs/adr/012-chad-hunting-threat-intelligence-and-health.md (synced at build time — edit the original, not this copy). Status: Accepted (2026-09-06)

Decision owner: Danny

Amends: ADR-002 Decision 1 and Backlog

Context

ADR-002 planned a separate Prowl hunting module, followed by an evaluation of a threat-intelligence platform (TIP). It also placed OSCAR, an OpenSearch health module, in the backlog.

Those boundaries split one detection domain across several products. Hunts query CHAD Data Sources and turn results into CHAD alerts. Threat intelligence enriches CHAD alerts. OpenSearch health describes the storage and query service that CHAD operates against.

A separate module for each concern would add another identity boundary, deployment unit, navigation zone, and cross-product contract. It would not create a new authority.

Decision

CHAD owns threat hunting. Its hunting scope includes Explore queries, saved hunts, investigation timelines, entity views, and promotion into Sigma rules or alerts. A hunt can escalate to Warden, which remains the sole case and response authority.

The separate Prowl module is withdrawn. Veltro will not add a Prowl repository, compose profile, route zone, or identity grant.

Threat intelligence remains an integration concern inside CHAD. CHAD owns indicator matching and the source connections it needs: MISP today, plus the OpenCTI and TAXII 2.1 source types when they land. Veltro will not add a separate TIP module.

OpenSearch storage lifecycle and cluster health also live in CHAD. This scope includes index policies, snapshots, shards, disk watermarks, pending tasks, and operator actions. The separate OSCAR module is withdrawn.

VectorFlow still transports and normalizes telemetry. Warden still owns cases and response. This decision does not move those authorities into CHAD.

This ADR records ownership, not delivery evidence. Shipped under that ownership today: MISP-backed IOC detection with sighting writeback, proven in the portable golden path (docs/golden-paths.md §3, veltro#466), and CHAD operating the bundled OpenSearch store. Still to be delivered in a pinned suite release: the hunting console, the OpenCTI and TAXII 2.1 source types, and the storage-lifecycle and cluster-health surfaces (docs/program/veltro-1.0.md §4.5 for the hunting console, §4.7 for threat intelligence, §4.8 for storage lifecycle and cluster health). CHAD main has since built all three — backend/app/api/{explore,hunts,timelines}.py behind frontend/src/pages/{Explore,Hunts,Timelines}.tsx, TISourceType.TAXII21/OPENCTI in backend/app/models/ti_config.py, and backend/app/api/storage.py plus the /api/health/cluster routes — and none of it is in the pinned CHAD_VERSION=0.43.2 (a73e7b3b), so the remaining gap is the pin bump, not the build (docs/traceability-matrix.md, ADR-012 row). A surface becomes available only when its implementation, documentation, and release proof land.

Consequences

• Analysts keep detection, hunting, indicators, and OpenSearch evidence in one product.
• Hunt escalation crosses one existing boundary from CHAD to Warden.
• Veltro avoids three extra module, identity, deployment, and navigation surfaces.
• ADR-002’s general contract still applies to any future module.
• Old Prowl, TIP-module, and OSCAR-module references are historical after this ADR.

Rejected alternatives

1. Build Prowl as a separate module. This duplicates CHAD’s query scope and creates a new boundary for the same evidence.
2. Build a Veltro TIP. MISP, OpenCTI, and TAXII integrations provide the required source and exchange boundary.
3. Build OSCAR as a separate module. CHAD already owns the OpenSearch dependency and can present its health with detection context.