Solutions · For IR teams
Scope the incident before the call ends.
Attacks spread before the ticket is raised. Query months of history, ask affected hosts directly, and contain them only when two people sign off.
Confirmed findings
- Initial access via KEV-listed service on SRV-0412lake
- Lateral movement to WKS-2231 over WMI as m.reyeslake
- Dropped loader still present on WKS-2231, collectedendpoint
Open questions
- Whether SRV-0412 was reached from outside the estate
- Two further hosts with the same parent process, not yet queried live
01A day with Huntbase
02:14
First question: how far did it get?
One KQL across your lake and live sources: every host that touched the indicator, stored and live, in one result.
Mid-morning
The host that stopped sending logs.
WKS-2231 dropped out of the SIEM a week ago. Ask it directly: live processes and the file itself, collected to your own bucket with its SHA-256 hash.
Before the bridge call
Contain it, then report it.
Isolate WKS-2231 with a signed Action once a second person approves; it stays reachable to Huntbase. Then export the report: findings, open questions, evidence.
02What does the work
What scopes the incident.
Scope
Huntbase scopes, investigates and, in Early access, contains: signed scripts and saved Actions such as host isolation, staged rollout, two-person approval by default, every step audited. Ticketing and case management stay in the tools you already run.
Scope it here.
Contain it with sign-off.
Search what you already have, ask the host when it was never collected, and approve every step Scout takes. Sign up and start on sample data today.
- 01Sign up
- 02Run a guided hunt on the sample workspace, no connector needed
- 03Connect your own sources when you're ready
