Threat Hunt Console

Three workspaces in one console

The console header switches between three tabs:

• Query Console — write and run hunt queries and browse the returned records.
• Hypotheses — track structured hunt hypotheses, attach evidence, move them through a workflow, and escalate confirmed threats.
• Hunt Library — five pre-built hunt playbooks you can load into the console with one click.

What a query actually searches

When you run a hunt, the console calls POST /api/hunt/query. The endpoint searches three stores of data that already belong to your organization, over a time window (default: the last 24 hours):

• SIEM events — the query string is substring-matched against each event's message, source IP, host, and user.
• Alerts — matched against the alert's raw payload and source.
• EDR telemetry — matched against the event data (JSON) of endpoint agents in your org.

Every returned record is scoped to your organization only; there is no cross-tenant visibility.

Write and run a query

1. Open the Query Console tab.
2. Pick a data-source label. The console offers nine: EDR Telemetry, Firewall Logs, DNS Logs, Web Proxy, Auth Logs, Sysmon Events, NetFlow Data, Email Gateway, and Cloud Trail.
3. Type your query in the text area and either press Ctrl+Enter (or Cmd+Enter) or click the Hunt button.

AI Query Translator CoPilot

Above the query box is a translator helper. Describe what you are looking for in plain English (for example, "credential dumping from lsass") and click Translate to auto-fill the query box. The translator recognises keyword themes — LSASS / credential dumping, PsExec / lateral movement / SMB, DNS tunneling / exfiltration, scheduled task / persistence / cron, and beaconing / jitter — and inserts a matching preset query for that theme; anything else is turned into a simple AND-joined term list. It fills in query text for you to review and run.

Reading results

Matching records render as a scrollable list. Each row shows the record's timestamp, its source (for EDR rows, the reporting agent's hostname), an optional severity chip, a MATCH badge, and the full record data as formatted JSON. When you have a hypothesis selected, an Add to Hypothesis button appears so you can capture the top results of the current query as an evidence item on that hypothesis.

Query history

Your recent queries (up to the last 10) are listed below the results. Click any entry to reload its query text and data source back into the console.

Create a hypothesis

On the Hypotheses tab, click New Hypothesis and fill in a title, a description of what you think is happening and why, and a comma-separated list of MITRE technique IDs (for example T1003.001). New hypotheses are created in the Draft state. The first time an organization opens this tab with no hypotheses, the console pre-populates the list with example hypotheses to illustrate the workflow.

Work a hypothesis in the inspector

Selecting a hypothesis opens the inspector on the right, which shows the hypothesis description, its MITRE tactics, the collected evidence log, and a workflow status control with four states:

Evidence items are added from the Query Console using Add to Hypothesis. Each item records its type, a description, the captured data, and a timestamp.

Escalate and export

• Escalate to Case — available once a hypothesis is set to Validated Threat. It opens an incident case (severity High, category "Threat Hunt") from the hypothesis and reports the resulting case number.
• Export Findings — downloads a Markdown findings report containing the hypothesis title, status, MITRE techniques, description, and the evidence log.

Hunt Library playbooks

The Hunt Library tab lists five pre-built playbooks, each with a hypothesis, MITRE mapping, and example queries. Use Load to send a playbook's query into the console, or the play icon next to any individual query to load that specific query.

All endpoints require an authenticated session and operate only on your own organization's data.

Run a query

Request fields:

curl -X POST https://portal.guardfoxsecurity.com/api/hunt/query \
  -H 'Content-Type: application/json' \
  -d '{"query":"lsass","timeRange":24,"sources":["edr","siem"]}'

The response is { total, results }. Each result carries a timestamp, a source label, a severity (defaults to info), a matched flag, and the record data. Results are capped at 500. When nothing matches, the response is { "total": 0, "results": [] }.

Create a hypothesis

curl -X POST https://portal.guardfoxsecurity.com/api/hunt/hypotheses \
  -H 'Content-Type: application/json' \
  -d '{"title":"LSASS credential access","description":"Non-standard tool reading lsass memory","mitre":"T1003.001"}'

Listing hypotheses returns objects with id, title, description, mitreTechniques (parsed from the comma-separated MITRE IDs), status, createdAt, an evidence array, and findings.

Update status or add evidence

To change a hypothesis's workflow state, PATCH /api/hunt/hypotheses with the id and new status (it also accepts findings and results). To append evidence, POST to the per-hypothesis evidence endpoint:

curl -X POST https://portal.guardfoxsecurity.com/api/hunt/hypotheses/HYP_ID/evidence \
  -H 'Content-Type: application/json' \
  -d '{"type":"log","description":"lsass access from unsigned binary","data":{}}'

Each evidence item is stored with a generated id, its type (defaults to log), description, data, and an addedAt timestamp.