diff --git a/contrib/udfs/README.md b/contrib/udfs/README.md
index 6f6799d..f8e47b9 100644
--- a/contrib/udfs/README.md
+++ b/contrib/udfs/README.md
@@ -415,3 +415,14 @@
 ```
 
 The function returns an empty map if the row is `null`.
+
+# Threat Hunting Functions
+These functions are useful for doing threat hunting with Apache Drill.  These were inspired by huntlib.[1]
+
+The functions are: 
+* `punctuation_pattern(<string>)`:  Extracts the pattern of punctuation in text.
+* `entropy(<string>)`: This function calculates the Shannon Entropy of a given string of text.
+* `entropyPerByte(<string>)`: This function calculates the Shannon Entropy of a given string of text, normed for the string length.
+
+[1]: https://github.com/target/huntlib
+
diff --git a/contrib/udfs/src/main/java/org/apache/drill/exec/udfs/ThreatHuntingFunctions.java b/contrib/udfs/src/main/java/org/apache/drill/exec/udfs/ThreatHuntingFunctions.java
new file mode 100644
index 0000000..782ea53
--- /dev/null
+++ b/contrib/udfs/src/main/java/org/apache/drill/exec/udfs/ThreatHuntingFunctions.java
@@ -0,0 +1,179 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.drill.exec.udfs;
+
+import io.netty.buffer.DrillBuf;
+import org.apache.drill.exec.expr.DrillSimpleFunc;
+import org.apache.drill.exec.expr.annotations.FunctionTemplate;
+import org.apache.drill.exec.expr.annotations.Output;
+import org.apache.drill.exec.expr.annotations.Param;
+import org.apache.drill.exec.expr.holders.Float8Holder;
+import org.apache.drill.exec.expr.holders.VarCharHolder;
+
+import javax.inject.Inject;
+
+public class ThreatHuntingFunctions {
+  /**
+   * Punctuation pattern is useful for comparing log entries.  It extracts all the punctuation and returns
+   * that pattern.  Spaces are replaced with an underscore.
+   * <p>
+   * Usage: SELECT punctuation_pattern( string ) FROM...
+   */
+  @FunctionTemplate(names = {"punctuation_pattern", "punctuationPattern"},
+    scope = FunctionTemplate.FunctionScope.SIMPLE,
+    nulls = FunctionTemplate.NullHandling.NULL_IF_NULL)
+  public static class PunctuationPatternFunction implements DrillSimpleFunc {
+
+    @Param
+    VarCharHolder rawInput;
+
+    @Output
+    VarCharHolder out;
+
+    @Inject
+    DrillBuf buffer;
+
+    @Override
+    public void setup() {
+    }
+
+    @Override
+    public void eval() {
+
+      String input = org.apache.drill.exec.expr.fn.impl.StringFunctionHelpers.toStringFromUTF8(rawInput.start, rawInput.end, rawInput.buffer);
+
+      String punctuationPattern = input.replaceAll("[a-zA-Z0-9]", "");
+      punctuationPattern = punctuationPattern.replaceAll(" ", "_");
+
+      out.buffer = buffer;
+      out.start = 0;
+      out.end = punctuationPattern.getBytes(java.nio.charset.StandardCharsets.UTF_8).length;
+      buffer.setBytes(0, punctuationPattern.getBytes());
+    }
+  }
+
+  /**
+   * This function calculates the Shannon Entropy of a given string of text.
+   * See: https://en.wikipedia.org/wiki/Entropy_(information_theory) for full definition.
+   * <p>
+   * Usage:
+   * SELECT entropy(<varchar>) AS entropy FROM...
+   *
+   * Returns a double
+   */
+  @FunctionTemplate(name = "entropy",
+    scope = FunctionTemplate.FunctionScope.SIMPLE,
+    nulls = FunctionTemplate.NullHandling.NULL_IF_NULL)
+  public static class StringEntropyFunction implements DrillSimpleFunc {
+
+    @Param
+    VarCharHolder rawInput1;
+
+    @Output
+    Float8Holder out;
+
+    @Override
+    public void setup() {}
+
+    @Override
+    public void eval() {
+
+      String input = org.apache.drill.exec.expr.fn.impl.StringFunctionHelpers.toStringFromUTF8(rawInput1.start, rawInput1.end, rawInput1.buffer);
+      java.util.Set<Character> chars = new java.util.HashSet();
+
+      for (char ch : input.toCharArray()) {
+        chars.add(ch);
+      }
+
+      java.util.Map<Character, Double> probabilities = new java.util.HashMap();
+      int length = input.length();
+
+      // Get the probabilities
+      for (Character character : chars) {
+        double charCount = org.apache.commons.lang3.StringUtils.countMatches(input, character);
+        double probability = charCount / length;
+        probabilities.put(character, probability);
+      }
+
+      // Now get the entropy
+      double entropy = 0.0;
+      for (Double probability : probabilities.values()) {
+        entropy += (probability * java.lang.Math.log(probability) / java.lang.Math.log(2.0));
+      }
+      out.value = Math.abs(entropy);
+    }
+  }
+
+  /**
+   * This function calculates the Shannon Entropy of a given string of text, normed for the string length.
+   * See: https://en.wikipedia.org/wiki/Entropy_(information_theory) for full definition.
+   * <p>
+   * Usage:
+   * SELECT entropy_per_byte(<varchar>) AS entropy FROM...
+   *
+   * Returns a double
+   */
+  @FunctionTemplate(names = {"entropy_per_byte", "entropyPerByte"},
+    scope = FunctionTemplate.FunctionScope.SIMPLE,
+    nulls = FunctionTemplate.NullHandling.NULL_IF_NULL)
+
+  public static class NormedStringEntropyFunction implements DrillSimpleFunc {
+
+    @Param
+    VarCharHolder rawInput;
+
+    @Output
+    Float8Holder out;
+
+    @Override
+    public void setup() {}
+
+    @Override
+    public void eval() {
+
+      String input = org.apache.drill.exec.expr.fn.impl.StringFunctionHelpers.getStringFromVarCharHolder(rawInput);
+      java.util.Set<Character> chars = new java.util.HashSet();
+
+      for (char ch : input.toCharArray()) {
+        chars.add(ch);
+      }
+
+      java.util.Map<Character, Double> probabilities = new java.util.HashMap();
+      int length = input.length();
+
+      // Get the probabilities
+      for (Character character : chars) {
+        double charCount = org.apache.commons.lang3.StringUtils.countMatches(input, character);
+        double probability = charCount / length;
+        probabilities.put(character, probability);
+      }
+
+      // Now get the entropy
+      double entropy = 0.0;
+      for (Double probability : probabilities.values()) {
+        entropy += (probability * java.lang.Math.log(probability) / java.lang.Math.log(2.0));
+      }
+
+      if (input.length() == 0) {
+        out.value = 0.0;
+      } else {
+        out.value = (Math.abs(entropy) / input.length());
+      }
+    }
+  }
+}
diff --git a/contrib/udfs/src/test/java/org/apache/drill/exec/udfs/TestThreatHuntingFunctions.java b/contrib/udfs/src/test/java/org/apache/drill/exec/udfs/TestThreatHuntingFunctions.java
new file mode 100644
index 0000000..9e8f3d3
--- /dev/null
+++ b/contrib/udfs/src/test/java/org/apache/drill/exec/udfs/TestThreatHuntingFunctions.java
@@ -0,0 +1,107 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.drill.exec.udfs;
+
+import org.apache.drill.categories.SqlFunctionTest;
+import org.apache.drill.categories.UnlikelyTest;
+import org.apache.drill.test.ClusterFixture;
+import org.apache.drill.test.ClusterFixtureBuilder;
+import org.apache.drill.test.ClusterTest;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.junit.experimental.categories.Category;
+
+@Category({UnlikelyTest.class, SqlFunctionTest.class})
+public class TestThreatHuntingFunctions extends ClusterTest {
+
+  @BeforeClass
+  public static void setup() throws Exception {
+    ClusterFixtureBuilder builder = ClusterFixture.builder(dirTestWatcher);
+    startCluster(builder);
+  }
+
+  @Test
+  public void testPunctuationPattern() throws Exception {
+    String query = "SELECT punctuation_pattern('192.168.1.1 - - [10/Oct/2020:12:32:27 +0000] \"GET /some/web/app?param=test&param2=another_test\" 200 9987') AS pp FROM (VALUES" +
+      "(1))";
+    testBuilder()
+      .sqlQuery(query)
+      .ordered()
+      .baselineColumns("pp")
+      .baselineValues("..._-_-_[//:::_+]_\"_///?=&=_\"__")
+      .go();
+  }
+
+  @Test
+  public void testEmptyPunctuationPattern() throws Exception {
+    String query = "SELECT punctuation_pattern('') AS pp FROM (VALUES(1))";
+    testBuilder()
+      .sqlQuery(query)
+      .ordered()
+      .baselineColumns("pp")
+      .baselineValues("")
+      .go();
+  }
+
+  @Test
+  public void testEntropyFunction() throws Exception {
+    String query = "SELECT entropy('asdkjflkdsjlefjdc') AS entropy FROM (VALUES(1))";
+    testBuilder()
+      .sqlQuery(query)
+      .ordered()
+      .baselineColumns("entropy")
+      .baselineValues(3.057476076289932)
+      .go();
+  }
+
+  @Test
+  public void testEntropyFunctionWithEmptyString() throws Exception {
+    String query = "SELECT entropy('') AS entropy FROM (VALUES(1))";
+    testBuilder()
+      .sqlQuery(query)
+      .ordered()
+      .baselineColumns("entropy")
+      .baselineValues(0.0)
+      .go();
+  }
+
+  @Test
+  public void testNormedEntropyFunction() throws Exception {
+    String query = "SELECT entropy_per_byte('asdkjflkdsjlefjdc') AS entropy FROM (VALUES(1))";
+    testBuilder()
+      .sqlQuery(query)
+      .ordered()
+      .baselineColumns("entropy")
+      .baselineValues(0.17985153389940778)
+      .go();
+  }
+
+  @Test
+  public void testNormedEntropyFunctionWithEmptyString() throws Exception {
+    String query = "SELECT entropy_per_byte('') AS entropy FROM (VALUES(1))";
+    testBuilder()
+      .sqlQuery(query)
+      .ordered()
+      .baselineColumns("entropy")
+      .baselineValues(0.0)
+      .go();
+  }
+
+}
+