Search your history for what you know now.
When a new indicator or rule appears, HUNT runs it over the data your tools already keep and tells you how far back it could look.
New intel applies to old data.
An indicator published today may have reached you last month. Searching back means a query per tool and a check on how much history each tool really holds.
How HUNT handles it
Sweep
IPs, domains, URLs, hashes and file names are cleaned of defanging and searched in every connected tool.
Look back
Each tool is searched over the history it actually keeps, and the window is stated in the result.
Explain
Matches are traced to a cause, and gaps are named as could not check.
Example
Retrohunt across three tools, all zero
- SentinelOne: a rule error, fixed and rerun. Not seen.
- Splunk: no process logs. Could not check.
- Elastic: control query returned data. Not seen.
FAQ
How far back can it search?
As far as each tool keeps data. HUNT checks the real retention and states it in the result.
Which indicator types does it sweep?
IPs, domains, URLs, file hashes and file names.
Can a retrohunt keep running?
Yes. Save it as a watch and it runs on a schedule over new data.
See HUNT on your own data.
You pick the threats and tools, we connect read-only, and we review the verdicts together. Success criteria are agreed before it starts.