SearchTalon Studio v1.1.9
Hunts
Hypothesis-driven threat hunts against your SIEMs: start from a starter hunt or plain English, run it now or on a schedule, and have the results explained.
What it is
Search → Hunts (/search/hunts) is a hunt workbench. A hunt has a hypothesis, the ATT&CK techniques it looks for and a query for each SIEM you run it against. Starter hunts come with all three filled in. Hunts query your SIEM where the data lives; nothing is copied into Studio.
Write from hypothesis. Describe what you are looking for and Studio writes the query for the workspace's SIEM; Rewrite from hypothesis does it again after you change the hypothesis. It needs an AI provider under Settings → AI.
Ask your SIEM. The Ask your SIEM box on Search does the same from a plain-English question and runs the result as a hunt.
Explain these results. A finished run has a button that summarises what came back and what looks worth a closer look.
Running a hunt
1
Open Search → Hunts and pick a starter hunt, or create your own and write its hypothesis.
2
Check the query for each SIEM, writing it from the hypothesis if you like, and save.
3
Run it now, or give it a schedule so it runs on its own.
4
Read the Results and Findings of each run, and use Explain these results for a summary.