Watch Scout hunt

Watch Scout answer “were we hit?”

One example hunt, from question to evidence: you ask, Scout searches the tools you already run and asks the host, and nothing goes further until you approve.

Sign upBook a demo

  1. 01Ask

    Ask a question in plain English or KQL; history comes back from the SIEMs and lakes you already run.

    Hunt · New sign-in locations
    You · Which accounts signed in from a new country this week?
    authentication
| where time > ago(7d)
| where src_country !in (seen_30d)
| project time, user, src_ip, store

    KQL · searched 3 stores: Splunk, Sentinel, your lake

    • 08:12:40j.park198.51.100.23 · BRSplunk
    • 08:14:02j.park198.51.100.23 · BRSentinel
    • 11:30:19svc-backup203.0.113.41 · NLyour lake

    EXAMPLE DATA · EXAMPLE CORP SAMPLE WORKSPACE

  2. 02Ask the host

    Where the log was never collected, Scout asks your endpoints live (osquery under the hood) and adds the answers to one timeline.

    Timeline · WKS-0412
    LiveNo process logs collected for WKS-0412. Asking the host.
    SELECT name, path, parent FROM processes
WHERE path LIKE '%/Users/Public/%';

    Live query · 1 host answered

    1. 08:12:40j.park signs in from 198.51.100.23stored · Splunk
    2. 08:15:11j.park opens a session on WKS-0412stored · Sentinel
    3. 08:16:05rundll32.exe loads C:/Users/Public/cache.dlllive · endpoint · WKS-0412
    4. 08:16:07Outbound tcp/443 to 203.0.113.9live · endpoint · WKS-0412

    EXAMPLE DATA · EXAMPLE CORP SAMPLE WORKSPACE

  3. 03You decide

    Scout stops at your checkpoint, shows its evidence, and writes the report once you approve.

    Checkpoint · Hunt H-07
    ScoutWAITING FOR YOU
    j.park signed in from a new location[1], then an unsigned DLL ran on WKS-0412[2] and reached out to an unknown address[3]. This looks like a stolen session used to stage a payload.
    Not supported by evidence: how the session was stolen. No source covers it.

    EVIDENCE

    1. [1]Sign-in from 198.51.100.23, first seen this weekSplunk
    2. [2]cache.dll loaded by rundll32.exe, unsignedendpoint · WKS-0412
    3. [3]Outbound tcp/443 to 203.0.113.9 two seconds laterendpoint · WKS-0412

    CHECKPOINT · APPROVAL REQUIRED

    Write the incident report from this evidence.

    EXAMPLE DATA · EXAMPLE CORP SAMPLE WORKSPACE

Run your first hunt on sample data

Sign up and run guided hunts on the Example Corp sample workspace. No connector needed.

Sign upBook a demo