SOC Workbench

Threat HuntingNew

A structured threat hunting module with 7 preset hunts spanning network detections, endpoint anomalies, UBA signals, cloud security events, and AD misconfigurations — enabling analysts to proactively surface threats that evade automated detection.

Get a Demo Login to App

Threat Hunting

Proactive threat hunting across your entire environment

What it does

Key capabilities

7 Preset Hunts

Pre-built hunt queries across HakObserver, FortiGate, Netskope, UBA, and Microsoft Defender — ready to run immediately without query authoring.

Multi-Source Coverage

Hunt hypotheses span network traffic anomalies, endpoint process anomalies, insider threat signals, cloud DLP events, and AD lateral movement paths.

Hunt Parameters

Each preset includes configurable parameters — time range, severity threshold, entity filters — for scoped, targeted investigation.

Investigation Integration

Hunt findings can be escalated directly into the Investigations module with evidence pre-attached and IOCs pre-populated.

Hunt Results Dashboard

Results are displayed in a structured panel with severity, entity, timestamp, and raw evidence — drill into any finding for full context.

Hunt Library

Analysts can save custom hunt parameters and results for repeat execution — building an institutional hunt library over time.

Highlights

Why Threat Hunting?

  • 7 prebuilt hunts across HakObserver, FortiGate, Netskope, UBA, and Defender
  • No query language required — parameter-driven hunting
  • Direct escalation from hunt findings to Investigations
  • Covers network, endpoint, identity, and cloud hunt hypotheses
  • Hunt library for repeatable, systematic threat hunting programmes
Request Demo Talk to us
Included in OneView

Threat Hunting is part of the Hakware OneView platform. All findings, events, and data from this module flow into your central dashboard alongside every other security signal in your environment.

24/7 Support Available
Phone: +27 060 984 1210
FAQs

Frequently asked questions

The seven prebuilt hunts cover: HakObserver process anomalies (unexpected process executions on monitored VMs), FortiGate traffic anomalies (unusual firewall traffic patterns), Netskope cloud DLP events (potential data exfiltration via cloud services), UBA insider threat signals (high-risk user behaviour patterns), Microsoft Defender endpoint anomalies, and Active Directory lateral movement path indicators.

No. All seven preset hunts are parameter-driven — analysts configure time range, severity threshold, and entity filters through form inputs. No SIEM query language, Kusto, or Splunk SPL knowledge is required. This makes structured threat hunting accessible to analysts at all experience levels, not just those with SIEM query expertise.

From any hunt results panel, individual findings can be escalated to the Investigations module with a single click. The escalation creates a new investigation case pre-populated with the hunt context — the hunt type, parameters used, the finding evidence, and any relevant IOCs — so analysts can transition immediately from hunting to structured case management.

The hunt library lets analysts save specific hunt configurations — the preset used, parameters applied, and any notes about the hypothesis being tested — for repeat execution. This enables a structured, repeatable threat hunting programme where the same hypotheses are tested systematically on a weekly or monthly cadence, building an institutional hunting record over time.

Related modules

Alert Triage QueueNew

Unified analyst inbox for every security alert

Learn more

False Positive ManagementNew

Suppress alert noise. Amplify real signal.

Learn more

Asset Security ViewNew

Per-device security posture at a glance

Learn more

See Threat Hunting in action

Request a personalised demo and we'll show you exactly how Threat Hunting works within your environment.

Request Free Demo All Modules