| Table of Contents | ||||||
|---|---|---|---|---|---|---|
|
...
Apart from triaging suspicious alerts and defining investigations, there's one additional step that allows users to get deeper into an investigation. In the Hunting area of the application, users can perform a global search across the whole system and find the events that are related to a specific entity.
Click this icon 
in the top navigation bar to access the Hunting area.
...
Perform a threat hunting
Follow these steps to perform threat hunting:
| Rw ui steps macro | ||||||||
|---|---|---|---|---|---|---|---|---|
First, choose the time range you want to apply to your search by clicking the time selector at the top of the area. You can either choose an absolute time range selecting the start and end dates in the calendar or select a preset interval. You can also select a start date and activate the Now toggle to set the ending date to the current time. Click OK after choosing the time range. 
Then, enter the tables you want to search on in the Target tables field. It is possible to search in more than one table, which may be very useful to contrast different information in the same timeline, but also to see the behavior of the same entities in two different sources.
Add the required filter criteria. Open the Filter key dropdown list and select the column where you want to search for data. Open the Filter type dropdown list and select the required one. If you choose a general filter, simply enter the required value in the Filter value box that appears. If you select Lookup, you will be prompted to select the Lookup table you want to search on and the required fields. This can be done across multiple tables and using multiple filters to see results from more than one table.
Once your filter is defined, select the Add button. You can keep on adding as many filters as required before performing the threat hunting. Select Filter to get the results with the filters you applied. Click the entities that appear in the results if you want to keep on filtering the data. Using the clock icon next to the Filter button, you can also see the last queries run, and re-select the filter you need. |
...