Before
Threat hunters likely had to review newly collected indicators, remove allowlisted values, search network and endpoint telemetry separately, and reconcile hits by asset. They then had to pass each asset to investigation, record what was hunted, and prepare the team update.
How it works
- Collect and qualify the last 24 hours of indicators by applying confidence, validity, allowlist, scan-exclusion, deduplication, prioritization, and volume rules.
- Search network and endpoint evidence, then merge matching events into a bounded list of affected assets while preparing eligible high-confidence indicators for prevention.
- Process each asset through investigation and duplicate checks, record the hunt, and publish the resulting statuses and summary to the SOC team.
Workflow details
- Collection window: The flow starts with the previous 24 hours of threat-intelligence indexes and establishes a retrospective search window of up to 30 days.
- Indicator selection: It deduplicates indicators, keeps valid values above the configured confidence threshold, excludes allowlisted and scan-related indicators, prioritizes stronger indicator types, and limits the hunt to 1,000 indicators. High-confidence command-and-control domains or URLs are also assembled into a preventive batch with a 14-day lifetime.
- Evidence search: Selected indicators are searched across network telemetry and endpoint alerts, using grouped queries and configured result limits to identify where the indicators appeared.
- Asset investigation: Network and endpoint matches are merged by asset, capped at 20 assets, and processed sequentially. Each asset is qualified, checked for prior handling, and handed to the investigation workflow; non-benign results can launch an asynchronous response workflow.
- Reporting and handoff: The hunt state is recorded, and an HTML summary reports selected indicators, searches, affected assets, investigation statuses, and preventive actions in the SOC team channel. In the supplied website demo, several integration responses are replayed locally.
What changed
A 24-hour intelligence collection now becomes a bounded asset-level worklist automatically, with eligibility checks, cross-source searches, asset grouping, duplicate handling, investigation handoff, hunt logging, and team reporting performed in one run. Non-benign investigation results can also launch the configured response workflow asynchronously instead of holding up other assets.
Work removed
Reviewing hourly intelligence indexes, filtering and deduplicating indicators, checking the allowlist and validity dates, running separate network and endpoint searches, grouping hits by asset, checking whether an asset was already handled, recording the hunt, and manually preparing the SOC summary.
Expected outcome
A repeatable daily hunt can process up to 1,000 selected indicators and group results into up to 20 assets per run, replacing manual cross-source reconciliation; these are configured limits, not measured customer results.
