Search broadly
The main search checks every field in every hypothesis. Search for a technique ID, process, event ID, cloud service, log source, IOC, platform, or phrase.
FIELD GUIDE / 01
From a lead to a
defensible hunt.
HUNTGRID turns a wide spreadsheet into an analyst-focused catalog. Use the library to discover hypotheses, confirm telemetry readiness, adapt detection logic, and structure an investigation.
Narrow deliberately
Use tactic, severity, platform, and priority filters to create a manageable queue. Filters combine with the global keyword search.
Check readiness
Open a record and review prerequisites, required log sources, event IDs, and platform telemetry before launching the hunt.
Operationalize
Copy a platform query as a starting point, validate your field mappings, and use the investigation and confirmation criteria to drive triage.
SEARCH SHORTCUT
Press / anywhere in the catalog.
Use with analyst judgment
The queries and rule suggestions are starting points, not production-ready detections. Confirm log schemas, tune baselines, review false-positive scenarios, and preserve evidence before containment changes system state.