Something I've been working on just landed upstream in MISP: HUNT-EX and four companion threat-hunt-* objects. First open standard for sharing threat hunts between organisations. Not just what the hunt turned up. The hunt itself.

Example. A peer shares a hunt for suspicious OAuth consent grants against Entra. You filter your MISP for: telemetry="identity" AND outcome="hypothesis-confirmed-malicious" AND query-language="sigma" Every hunt in your community you can actually run, in one query.