Threat Analysis

Retrohunt

A retrohunt searches past data with something you learned today: a new indicator, a new behavior, or a rule you just wrote. It answers whether the activity happened before anyone was looking for it.

How a retrohunt works

The hunter picks a time window, runs the search in every tool that holds the relevant data, and records how far back each tool could actually look. A result is only as complete as the shortest retention among the tools searched.

What a retrohunt can miss

Logs that were never collected, fields that were never filled, and data older than the tool keeps. A good retrohunt names these gaps next to its result.

FourCore HUNT runs hunts like this inside your SIEM and EDR/XDR. See how it works →

Related reading