Insights Sec Hunter
Threat hunting over your edge's events: one-click filters, the SOC alert queue and real time, all in one place.
Query your logs with simple filters
Click a value to filter by it, or Alt-click to exclude it. IP, network (ASN), country, domain, endpoint, WAF signature and method become filters, and the whole query lives in the link you can share.
- Windows from 5 minutes to 90 days, within retention
- 23 widgets, from the raw log to the sources that pull the most data
- Editable layout and customizable widgets
- Open in Forensics with the filters and window ready
What needs attention first
The overview shows traffic with a normal band, alerts by severity and the HTTP status band. In Do now, critical alerts come with a shortcut to handle them.
The SOC alert queue
Alerts come from most to least urgent, with filters by period, source and acknowledgment, and the trend over the days.
What is happening now
Events arrive live, with breakdowns by status, WAF action, method, domain, country and network, and automatic refresh.
From finding to team
Alerts where your team is
Jira, Microsoft Teams, Slack, Discord, Telegram, Google Chat, PagerDuty, Opsgenie, ServiceNow, webhook and email.
To your SIEM
Delivery by Syslog in CEF or RFC 5424 with TLS, and to Splunk HEC.
Retention you define
You choose how many days to keep the index and the event body, and a size cap. When the cap is exceeded, the oldest day drops out and collection continues.
Full log with permission
Opening the full log requires the Operator role or higher, and every opening is logged.
Open in Forensics
In one click, the investigation goes to Forensic Analysis with the filters and window already set.
Any provider with events
Hunting reads the collected events from any connected provider that offers events.
Sec Hunter in 2 and a half minutes
What you need to use it
- Sec Hunter license.
- A connection with event collection enabled.
- The Open in Forensics button requires the Forensic Analysis license.
Risk Scenario in Brazil
in Brazil in 2026, up 3.5% from the previous year. Visibility and fast response reduce the impact before the incident spreads.
started with a supply chain compromise, tied with phishing as the most common entry point. Knowing which third-party APIs and integrations are exposed is the first step to reducing this risk.
Investigate what passes through your edge
Bring our team the question you need answered and see how Sec Hunter searches for it.
In the conversation, we see which sources get connected and which alerts go to your SIEM.
Talk to a specialist →