The EDR solution provides an advanced Threat Hunting and Query Management capability that enables security analysts to proactively search endpoint telemetry and identify suspicious processes, files, network connections, threat indicators, and other security events.
The Threat Hunting module provides a flexible query builder, reusable threat indicators, query preview, saved queries, and query history to support efficient and repeatable security investigations.
1. Threat Indicator-Based Hunting
The EDR solution allows analysts to select one or more threat indicators and use them to create threat hunting queries.
Supported indicators can include:
- Process Name
- File Name
- File Hash
- IP Address
- Domain
- URL
- Registry Key
- User
- Port
- Parent Process
- Command Line
- Other supported endpoint telemetry attributes
For example, an analyst can search for:
Process Name = "putty.exe"
The analyst can also combine multiple indicators using logical operators:
Process Name = "putty.exe" AND Local IP = "11.22.33.44"
This allows analysts to perform focused searches using multiple conditions.
2. Reuse of Threat Indicators
The solution allows the same threat indicator to be used multiple times within a single query.
For example:
Process Name = "putty.exe" AND Parent Process Name = "putty.exe"
This provides flexibility when creating complex threat hunting queries.
3. Query Criteria Management
The query builder allows analysts to manage individual search criteria while creating a query.
Analysts can:
- Add a new search criterion
- Edit an existing criterion
- Remove a selected criterion
- Change logical operators
- Modify indicator values
- Modify comparison operators
- Add multiple conditions
This allows analysts to refine queries without recreating them from the beginning.
4. Clear Search Criteria
The solution provides an option to clear the complete search criteria.
Using this option, analysts can remove all currently configured conditions and start creating a new threat hunting query.
5. Query Preview
The Threat Hunting module provides a real-time preview of the search query while the analyst creates or modifies it.
For example:
Process Name = "putty.exe" AND Local IP = "11.22.33.44"
The preview helps analysts verify the query logic and conditions before executing the search.
6. Analyst-Specific Saved Query List
Each analyst has an individual Saved Query List, similar to a bookmark or favorites list in a web browser.
Analysts can save frequently used threat hunting queries and access them later without recreating the query.
Saved queries can include:
- Query Name
- Query Criteria
- Query Description
- Created Date/Time
- Last Modified Date/Time
- Last Execution Information
This provides analysts with a personal library of frequently used threat hunting queries.
7. Threat Hunting Query History
The EDR solution automatically maintains a history of executed threat hunting queries.
Analysts can review previously executed queries and their associated information, such as:
- Query criteria
- Execution date and time
- Search status
- Search results/status
- Analyst information, where applicable
This provides visibility into previous threat hunting activities.
8. Reuse Queries from History
Analysts can reuse queries directly from the Threat Hunting History.
A previously executed query can be opened, reviewed, modified, and executed again.
For example, an analyst previously searched:
Process Name = "putty.exe" AND Local IP = "11.22.33.44"
The analyst can retrieve the same query from history and modify it to:
Process Name = "putty.exe" AND Local IP = "11.22.33.55"
without creating the complete query again.
9. Efficient Threat Hunting Workflow
The Threat Hunting module provides a streamlined workflow:
Select Threat Indicator → Add Conditions → Apply Logical Operators → Preview Query → Execute Search → Analyze Results → Save Query / Reuse from History
This enables analysts to perform both ad-hoc threat investigations and repeatable threat hunting activities efficiently.
10. Key Benefits
The EDR Threat Hunting and Query Management capability provides:
- Flexible indicator-based threat hunting
- Multiple threat indicators in a single query
- Reuse of the same indicator multiple times
- Easy addition, modification, and removal of query criteria
- Option to clear complete search criteria
- Real-time query preview
- Personal saved query/bookmark list for each analyst
- Automatic threat hunting query history
- Ability to reuse and modify historical queries
- Faster investigation of recurring threats
- Consistent and repeatable threat hunting workflows
The solution enables security analysts to create, execute, save, review, modify, and reuse threat hunting queries from a centralized EDR investigation interface.
