Hunt each new campaign that targets you.
HUNT reads new campaign reports, keeps the ones that match your industry, region and threat actors, and hunts for them in your SIEM and EDR/XDR.
New reports arrive faster than hunts get written.
Each campaign needs someone to decide if it matters, pull out the behaviors and indicators, and write queries for every tool. Many reports never get past that first step.
How HUNT handles it
Filter
Campaigns are matched to your industry, region and the actors you track.
Hunt
Behaviors become Sigma rules translated per tool, and indicators are swept across every source.
Report
Each campaign ends as Not seen, Needs follow-up or Can't check, with the searches attached.
Example
Ransomware campaign report
- 5 behaviors, 9 indicators
- 79 searches across Splunk and Elastic, last 30 days
- Not seen. One SIEM keeps no process logs, so process behaviors couldn't be checked there.
FAQ
Where do the campaigns come from?
From FourCore's emerging threat feed. You can also hunt from a report you share as a PDF, link or text.
Does HUNT hunt the same campaign twice?
No. A campaign is hunted once per schedule.
What happens when there's a match?
HUNT investigates it and emails your team when something needs a person.
See HUNT on your own data.
You pick the threats and tools, we connect read-only, and we review the verdicts together. Success criteria are agreed before it starts.