Hunters Pathfinder AI

No entries match these filters. Clear filters

1. updated seen Sep 7, 2026 · issue 067

   Hunters Pathfinder AI adds unified anomalous login detection, Windows password-change enrichment and scoring, and four new AXON threat hunting reports.

   └──▷ HOW TO FIND IT
   Review AXON threat hunting findings for multi-layer encoded command execution, anomalous SPN sign-ins, and cloud storage exposure after the new reports land in your tenant.
   📍In the Hunters platform, navigate to Axon Reports to view findings from the Multi-Layer Encoded Command Execution, Azure Service Principal Sign-In via an Anomalous User Agent, Suspicious User-Agent in Azure Non-Interactive/SPN Sign-In Activity, and Publicly Accessible Storage Resources campaigns.
   • Adds the Context Unified Anomalous Login detector, which evaluates successful anomalous logins across identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. applications, cloud platforms, VPNsVPNsA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection., and other integrated login sources using per-user behavioral baselines covering geolocation, IP address, and user agent category.
   • Introduces the Suspicious User-Agent Observed in Azure Non-Interactive/SPN Sign In Activity detector, identifying authentication activity from offensive-related distributions and tools including Kali Linux, Parrot Linux, BackBox Linux, BlackArch Linux, Scout Suite, TrailBlazer, and TruffleHog.
   • Adds a Windows Recent Password Change enrichment that queries Windows Security Event Logs for Event ID 4723 (self-initiated password change) and Event ID 4724 (privileged password reset), surfacing last change time, initiating user, and source computer as lead context.
   • Adds a Windows Recent Password Change Model scoring layer that applies a configurable confidence modifier to reduce noise from password-reset-triggered alerts and increase confidence when a password change may indicate account takeover.
   • Adds an AXON Threat Hunting Report for multi-layer Base64-encoded command execution covering defense evasion and obfuscation across Windows, Linux, and macOS process creation events.

   +2 more show less

   • Adds an AXON Threat Hunting Report for Azure Service Principal sign-ins via anomalous user agents, using a 45-day behavioral baseline and automatic suppression when a corresponding app registration update occurred within 24 hours of the anomalous sign-in.
   • Adds an AXON Threat Hunting Report for publicly accessible cloud storage resources across AWS S3, Azure Blob Storage, and Google Cloud Storage, identifying externally reachable buckets and containers with anonymous enumeration or access.

   7 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The following detectors are deprecated and will be removed on July 6, 2026, replaced by Context Unified Anomalous Login: CloudTrail anomalous console login, Anomalous login by an Azure account, Office365 anomalous login, Okta anomalous login, Okta successful login from host without an EDR agent, Okta successful administrative access from host without an EDR agent, Successful Duo authentication from host without an EDR agent, Successful Azure portal sign-in from machine without EDR agent, Successful Azure CLI sign-in from machine without EDR agent, Successful AWS console login from host without an EDR agent, Successful G Suite login from computer without EDR agent, G Suite successful authorization of token to GCP related interface without EDR agent.
2. updated seen Jul 13, 2026 · issue 014

   Hunters adds unified anomalous login detector, Windows password-change enrichment/scoring, and four new AXON threat hunt reports.

   └──▷ HOW TO FIND IT
   Review AXON proactive threat hunt findings for your environment after a new report campaign is published.
   📍In the Hunters platform, navigate to Axon Reports to view findings for the Multi-Layer Encoded Command Execution, Azure SPN Anomalous User Agent, Suspicious User-Agent in Non-Interactive/SPN Sign-In, and Publicly Accessible Storage Resources campaigns.
   • New detector: Context Unified Anomalous Login detects successful anomalous logins across identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. apps, cloud platforms, VPNsVPNsA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection., and other integrated login sources using per-user behavioral baselines spanning geolocation, IP, and user-agent signals.
   • New detector: Suspicious User-Agent Observed in Azure Non-Interactive/SPN Sign In Activity flags authentication activity from offensive tooling (Kali Linux, Parrot Linux, Scout Suite, TruffleHog, and others) in SPN and non-interactive sign-in flows.
   • New enrichment: Windows Recent Password Change queries Windows Security Event Logs (Event ID 4723 and 4724) to surface last password change time, initiating user, and source computer as lead context.
   • New scoring layer: Windows Recent Password Change Model applies a configurable confidence modifier to leads based on recency of password reset, reducing noise from post-reset behavior and boosting confidence in potential account-takeover scenarios.
   • New AXON Threat Hunt Report: Multi-Layer Encoded Command Execution — hunts for nested Base64 encoding/decoding chains in process creation events across Windows, Linux, and macOS as indicators of payload obfuscation.

   +4 more show less

   • New AXON Threat Hunt Report: Azure Service Principal Sign-In via Anomalous User Agent — baselines each SPN's User Agent over 45 days and suppresses false positives by correlating against Azure Audit logs for app registration changes within 24 hours.
   • New AXON Threat Hunt Report: Suspicious User-Agent in Azure Non-Interactive/SPN Sign-In Activity — extends prior interactive-login coverage to SPN and non-interactive sign-ins targeting high-privilege, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.-exempt identities.
   • New AXON Threat Hunt Report: Publicly Accessible Storage Resources — external exposure assessment discovers and validates publicly reachable AWS S3, Azure Blob Storage, and Google Cloud Storage resources using customer domains and org identifiers.
   • Breaking change: Twelve legacy anomalous-login detectors (including CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions., Azure, Office 365, Okta, Duo, AWS, and G Suite variants) will be deprecated on July 6, 2026, replaced by the new Context Unified Anomalous Login detector.

   9 details in Everything

3. June 2026 - #1 Jun 2026 · release notes

   Hunters Pathfinder AI June 2026 adds S3 data onboarding, Org Context UI, 5 new detectors and 10 integrations.

   • Adds pathfinder data onboarding capability to ingest custom S3 buckets with automatic OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. mapping
   • Adds organizational context creation via public preview UI for manual input
   • Adds Suspicious File Created in Windows Startup Folder detector
   • Adds Suspicious User-Agent Observed in Sign-In Activity detector
   • Adds Microsoft 365 Defender Copilot Prompt Injection 3rd Party Alert detector

   +12 more show less

   • Adds Azure Service Principal Sign-In via Unusual User Agent Category detector
   • Adds Suspicious User-Agent Observed in Azure Non-Interactive/SPN Sign In Activity detector
   • Adds Windows User Lock Status enrichment and scoring model
   • Adds Upguard Alerts SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. integration
   • Adds Upguard Cyberrisk Breaches logs integration
   • Adds Barracuda Sentinel logs integration
   • Adds Cloudflare Network Analytics integration
   • Adds E-Series integration
   • Adds IBM DB2 integration
   • Adds Cisco FMC integration
   • Adds Cohesity integration
   • Adds CyberArk Cloud Audit Logs integration

   17 details in Everything

4. Release Notes - June 2026 - #2 Jun 2026 · release notes

   Hunters Pathfinder AI adds Context Unified Anomalous Login detector, new threat hunts, and Windows Password Change enrichment

   • Adds Context Unified Anomalous Login detector for successful anomalous logins across unified authentication sources (identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally., cloud, VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection.)
   • Introduces multi-layer encoded command execution detection for process creation events with nested Base64 encoding/decoding on Windows, Linux, and macOS
   • Adds Azure Service Principal sign-in anomaly detection based on User Agent divergence from 45-day baseline with audit log correlation
   • Adds Suspicious User-Agent Observed in Azure Non-Interactive/SPN Sign In Activity detector for offensive tool signatures in SPN/non-interactive sign-ins
   • Adds publicly accessible storage resource discovery for AWS S3, Azure Blob Storage, and Google Cloud Storage via automated external exposure assessment

   +2 more show less

   • Adds Windows Recent Password Change enrichment querying Event ID 4723/4724 for password reset context
   • Adds Windows Recent Password Change Model scoring layer with configurable confidence modifier based on recent password resets

   7 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The following legacy detectors are deprecated and will stop functioning after July 6, 2026: CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. anomalous console login, Anomalous login by an Azure account, Office365 anomalous login, Okta anomalous login, Okta successful login from host without an EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. agent, Okta successful administrative access from host without an EDR agent, Successful Duo authentication from host without an EDR agent, Successful Azure portal sign-in from machine without EDR agent, Successful Azure CLI sign-in from machine without EDR agent, Successful AWS console login from host without an EDR agent, Successful G Suite login from computer without EDR agent, G Suite successful authorization of token to GCP related interface without EDR agent. They are replaced by Context Unified Anomalous Login.
5. May 2026 May 2026 · release notes

   New S3 data ingestion via Democratize Data preview; new cloud and MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. integrations.

   • Adds Democratize Data private preview allowing onboarding of custom data from S3 buckets with automatic OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. mapping
   • Adds Pathfinder organizational context private preview for manually creating context to enhance investigations
   • Adds direct Detector settings link in leads detail panel beside detector title
   • Adds Cloudflare Magic IDS, Zscaler Deception, BeyondTrust Privileged Remote Access, and multiple ServiceNow (System Logs, Outbound HTTP Logs, Incident Logs, System Events Logs, User Session Logs) integrations
   • Adds visibility of enrichment descriptions via the question mark button next to enrichment title

   5 details in Everything

6. April 2026 Apr 2026 · release notes

   New GitHub Public Repo Created dashboard, M365 guest user and infostealer enrichments, new S3/API integrations

   • Adds a GitHub Public Repo Created visibility dashboard to monitor newly created public repositories.
   • Adds M365 Guest User Operations enrichment to identify external users and their recent audit activity.
   • Adds Infostealer Download Flow Analysis enrichment to analyze potential infostealer infection sources and timelines.
   • Adds new integrations: Cisco IOS, Veeam, Halcyon, VMWare Horizon, Nutanix HCI, Extreme NAC via S3 ingestion; Tailscale, Azure Network Firewall, Trendmicro, Thales, Upwind stories via API or other methods.

   4 details in Everything

7. March 2026 Mar 2026 · release notes

   Adds SQL custom detectors in UI, user agent/HTTP enrichments, and 11 new integrations; retires CrowdStrike Incidents integration.

   • Adds SQL Custom Detectors capability with Auto (Continuous) and Scheduled (Cron) modes accessible via the portal UI
   • Adds User Agent History per User enrichment displaying first/last seen timestamps, usage counts, and derived browser/OS attributes
   • Adds User Agent Prevalence per Organization enrichment providing total usage count, distinct user count, and observation timestamps
   • Adds HTTP Requests (by Agent ID) enrichment analyzing EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. network telemetry for contacted domains, hosts, URLs, IPs, ports, and initiating processes
   • Adds HTTP Requests (by Process) enrichment filtering EDR HTTP events by specific agent and process ID

   +3 more show less

   • Adds support for 11 new S3 API integrations: Barracuda Incident Response Logs, Upwind Security Detections, Upwind Stories, Forescout Appliances Logs, Fortinet FortiManager, Palo Alto Strata Logging Service (with Snappy decompression), Cisco IOS, Veeam Backup and Replication logs, Halcyon, VMWare Horizon VDIVDIVirtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan., and Nutanix HCI
   • Adds support for Microsoft 365 Message Trace via the new Microsoft Graph APIMicrosoft Graph APIA unified REST API maintained by Microsoft that exposes data and actions across Microsoft 365 services, letting cyber tools query users, emails, files, and sign-in logs through a single authenticated endpoint. endpoints
   • Retires the CrowdStrike Incidents integration requiring migration to crowdstrike_alerts

   8 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The CrowdStrike Incidents integration is retired; users must migrate to the crowdstrike_alerts integration to avoid service interruptions.
8. February 2026 Feb 2026 · release notes

   Hunters Pathfinder AI adds cluster-context investigation and new Barracuda S3 integration.

   • Adds cluster-context investigation to Pathfinder AI, allowing leads to utilize context from similar clustered leads.
   • Adds S3 integration for Barracuda Incident Response Logs.
   • Adds managed device scoring layer for identity theft detectors, lowering confidence when failed logins originate from Azure/Okta managed devices.

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !CrowdStrike Incident logs integration is being retired; users must migrate to crowdstrike_alerts.
   • !Microsoft Message Trace legacy API endpoints are turning off in April 2026; migration to Microsoft Graph APIMicrosoft Graph APIA unified REST API maintained by Microsoft that exposes data and actions across Microsoft 365 services, letting cyber tools query users, emails, files, and sign-in logs through a single authenticated endpoint. is required.
9. January 2026 Jan 2026 · release notes

   Pathfinder AI moves to Open Beta with auto-investigation; new S3 replication detector, domain controller dashboard, and several S3 API integrations.

   • Pathfinder AI is now in Open Beta and will automatically run on all relevant alerts to deliver AI-driven investigations
   • New Domain Controller Reporting Status visibility dashboard added under Data -> Visibility to track Domain Controller log health
   • New detector S3 Bucket Replication to External AWS Account identifies cross-account replication configurations via PutBucketReplication events
   • New detector "Possible exfiltration of secrets from AWS Secrets Manager using BatchGetSecretValue API" flags multiple-secret retrieval attempts
   • New enrichment AWS S3 Bucket Activity shows recent object-level and configuration changes for a given bucket including CopyObject, GetObject, and PutBucketAcl

   +10 more show less

   • New enrichment Post Replication Activity identifies S3 objects replicated to external buckets within 12 hours of alert generation
   • New enrichment S3 Replication User Statistics retrieves data on S3 replication configurations performed by a user ARN in the last three months
   • New S3 integration for Netskope Borderless SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. Logs
   • New S3 integration for Wazuh Firewall and Server Logs (3 data types)
   • New S3 integration for Prolion CryptoSpike Logs
   • New S3 integration for VMware vCenter Logs
   • New S3 integration and API support for Github Enterprise audit logs
   • New S3 integration for Forcepoint Firewall Logs
   • New S3 integration and API support for Symantec Edge SWGSWGA Secure Web Gateway is a network proxy that inspects outbound web traffic, enforcing policy by blocking malicious sites, filtering content, and decrypting TLS — giving cyber tools a choke point for all user HTTP/S sessions. Logs
   • New S3 integration for Bluecat Networks Micetro Logs

   15 details in Everything

10. December 2025 - #2 Dec 2025 · release notes

    Hunters Pathfinder AI Open Beta, new IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support, and multiple integrations

    • Pathfinder AI moves to Open Beta on Jan 7, 2026, enabling automatic AI-driven investigations on all relevant alerts within the Hunters platform.
    • IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search now supports IPv6 addresses for indicator lookups.
    • Adds CrowdStrike Falcon 3rd party XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. detections via a new Alerts API endpoint integration.
    • Enrichments now display service operations made on an agent ID in the 24 hours prior to lead start time.
    • New integrations: Checkpoint EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. (S3), KnowBe4 PhishER (Webhook/S3), Netskope Network Events (API), Cerberus (S3), Windows DNS channel/debug logs (S3), GCP-V2 SCC Assets/Findings (API), Pan firewall Users (API), BeyondTrust PW safe On-Prem (S3 migration).

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !CrowdStrike Incident logs are being retired; users must migrate to the CrowdStrike Alerts (crowdstrike_alerts) integration before March 9, 2026.
    • !Microsoft Message Trace legacy tools and APIs will be turned off on March 18, 2026; users must migrate to Microsoft's Graph APIGraph APIMicrosoft's unified REST API for accessing data across Microsoft 365 services — mail, calendar, users, files — letting cyber tools query or monitor cloud environments through a single authenticated endpoint. endpoint for continued email log ingestion.
11. December 2025 - #1 Dec 2025 · release notes

    Hunters Pathfinder AI Dec 2025 adds Data Source pivot to Search and 8 new integrations.

    • Adds a Pivot to Search action on the Data Source page to run a 100-record query from the datalake
    • Adds Azure Sign-In Info from Correlation ID enrichment to create an Azure Sign-In Mega Entity based on azure_correlation_id
    • Adds M365 File Download App Usage Statistics enrichment displaying global and user-specific download stats
    • Adds 8 new integrations: Delinea-audit-logs (S3), FortiDLP-logs (API), Genesys-audit-logs (API), FastTrack (3 API endpoints), Vectra RUX Detection events (API), Sekoia Advanced Feed (API), PAN firewall URL-filtering (S3)
    • Improves Detector page UX to display the effective alert threshold by calculating Hunter default vs customer setting vs global alert threshold

    5 details in Everything

12. November 2025 - #1 Nov 2025 · release notes

    New detectors for SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. and Impacket execution; new EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. and AWS drilldowns; new integrations for Wiz, Zero Networks, Jamf Protect, and others.

    • Adds SMB Connection From an Abnormal Process detector that flags non-system processes initiating SMB connections via Windows event log 5156.
    • Adds Possible Execution of Impacket detector to identify potential lateral movement and credential theft via Impacket scripts.
    • Adds New-Browser User Agents Authenticating to OfficeHome detector for monitoring non-browser authentication to Microsoft 365.
    • Adds Microsoft 365 Abnormal Mail Access by Unusual ClientAppId detector for detecting mailbox access via atypical client applications.
    • Adds Suspicious Teams communication from foreign user detector filtering chats from commonly used domains.

    +12 more show less

    • Adds EDR Process ID to Registry Operations drilldown querying registry activity half an hour before and after lead inception.
    • Adds Process Connections from IP over Kerberos drilldown for identifying outbound KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. connections (port 88) by process.
    • Adds Destination IP to Process Connections drilldown mapping destination IPs to endpoint processes.
    • Adds AWS User Role Attachment Activities drilldown monitoring AttachRolePolicy, AttachGroupPolicy, and AttachUserPolicy events.
    • Adds Associated Microsoft Teams Activities and Complementary M365 audit logs drilldown for investigating Teams phishing success.
    • Adds SentinelOne Threat Raw Correlation drilldown providing context on alerts, processes, files, and network activity.
    • Adds new integration for Wiz Threats via Webhook/S3.
    • Adds new integration for Zero Networks Audit Activity Logs via API/S3.
    • Adds new integration for Jamf Protect Events via API/S3.
    • Adds new integration for Tanium audit logs (33 endpoints) via API/S3.
    • Adds new integration for Fastly WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. via S3.
    • Adds new integration for Check Point Email Events via S3.

    17 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The SOCKS proxy usage detector is deprecated and will stop triggering leads.
    • !The Process execution from remote network share detector is replaced by a scoring model in EDR-based detectors.
    • !The Suspicious execution from %ProgramData% detector is replaced by a scoring model in EDR-based detectors.
    • !The Possible use of a stolen or forged user ticket (TGT) detector is deprecated and will stop triggering leads.
13. November 2025 - #2 Nov 2025 · release notes

    Hunters Pathfinder AI adds AWS SESAWS SESAmazon's cloud email-sending service, used by tools that need to deliver alerts, reports, or notifications without running their own mail infrastructure. Enumeration detector, MOTW drilldown, and new webhook/API integrations for DataDog, Delinea, Beyondtrust, FortiDLP, and Genesys.

    • Adds Possible AWS SES Enumeration detector to identify attackers checking compromised account status via ListServiceQuotas, GetSendQuota, GetAccount, ListIdentities, GetIdentityVerificationAttributes, GetAccountSendingEnabled, and UpdateAccountSendingEnabled
    • Adds Potential download origin URL found drilldown enrichment for Crowdstrike MotwWritten events showing Referrer and Host URLs
    • Adds Microsoft 365 users who accessed mailbox owned by this user drilldown to identify shared mailboxes via non-owner access
    • Adds DataDog webhook integration for alerting
    • Adds Delinea-audit-logs S3 integration for Suite Cloud logs

    +3 more show less

    • Adds Beyondtrust-remote-support-session API integration
    • Adds FortiDLP-logs API integration
    • Adds Genesys-audit-logs API integration

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Execution of WHOAMI as local system detector is deprecated and planned for removal on Nov 27, 2025
14. August 2025 Aug 2025 · release notes

    LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-Assisted SQL Editor GA, public OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. mappings, and IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search API

    • Adds the LLM-assisted SQL Editor for natural language to SQL query conversion
    • Makes Hunters' OCSF mappings publicly available via a public repository
    • Adds IOC Search API access for programmatic IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. lookup

    3 details in Everything

15. July 2025 Jul 2025 · release notes

    Hunters Pathfinder AI July 2025 adds Response Actions, CSV export, Slack exfil detection, and CrowdStrike Alerts API support

    • Adds Response Actions with out-of-the-box templates, custom workflows, categorization, contextual listing, audit trails, and attribute-based automation to take action directly from a lead
    • Adds Export CSV capability across all search experiences to export results for offline analysis
    • Adds new detector for manual Slack workspace exports initiated via the admin console to identify potential data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels.
    • Adds integration with the CrowdStrike Alerts API endpoint, replacing the deprecated Detects endpoint

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !CrowdStrike Detects API endpoint is deprecated in September; users must switch to Alerts to continue streaming data.
16. May 2025 May 2025 · release notes

    Hunters Pathfinder AI May 2025 adds Health Notifications, Azure NSG ingestion, and integrations for Cloudflare, AWS, FortiEDR, Onapsis

    • Adds Data Source Health Notifications to monitor data source ingestion status via email alerts.
    • Supports log collection from Azure Block Storage for NSG flow logs.
    • Integrates Cloudflare Gateway DNS Requests Logs and Device Posture Results Logs.
    • Integrates AWS Network Firewall Flow Logs and Alert Logs.
    • Integrates Fortinet FortiEDR logs.

    +1 more show less

    • Integrates Onapsis logs.

    6 details in Everything

17. April 2025 Apr 2025 · release notes

    Hunters Pathfinder AI April 2025 adds Lead Timeline, On-Demand Auto-Investigation, OpenCTI & O365 integrations, and new RMM detector

    • Adds the Lead Timeline window showing lead progression from ingestion to auto-investigation activity.
    • Adds manual triggering of auto-investigations on individual leads via the UI with a limit of 3 runs and a 20-minute cooldown.
    • Adds OpenCTI integration for ingesting threat intelligence logs, mapping to IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search and Hunters schemas.
    • Adds Microsoft O365 Exchange Message Trace Reports integration for tracking email message flow and routing.
    • Adds new edr_new_rmm_tool_execution detector for identifying execution of unseen Remote Monitoring and Management (RMM) tools.

    +1 more show less

    • Adds deep-linking from the AI Assistant to specific investigation steps within a lead's view.

    6 details in Everything

18. March 2025 Mar 2025 · release notes

    Hunters Pathfinder AI adds programmatic detector updates, expanded Detectors API fields, Data Source tag management, and three new Windows/Azure detections.

    • Adds type, source parameters and type, data_types, possible_data_types, default_alerts_enabled, default_alerts_confidence_threshold response fields to the GET /detectors API endpoint
    • Adds new PUT /detectors/hunters/{detector_id} API request to programmatically update alerts_enabled and alerts_confidence_threshold for existing detectors
    • Adds description and dataTagsIds (with operationType) parameters to the PUT /data-sources/{dataflow_id} API request for programmatic tag management
    • Adds new GET /data-sources/tags API endpoint to retrieve available data flow tags with optional organization query parameter
    • Adds windows_event_abnormal_smb_connection detector ID for identifying abnormal SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. connections from non-system processes

    +2 more show less

    • Adds windows_event_user_added_to_local_admins detector ID for identifying users added to local administrators group via Event 4732
    • Adds azure_managed_identity_signin_unusual_token_type_requested detector ID for flagging anomalous token requests by Azure Managed Identities

    7 details in Everything

19. February 2025 Feb 2025 · release notes

    Hunters Pathfinder adds Normalyze, Lookout, NGINX, Cloudflare integrations; new Azure MI detectors and filtering

    • Adds Data Type filter to Leads, SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. Queue, Detectors, and Stories pages for refined result filtering.
    • New Normalyze integration with ingestion to data lake and IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search mapping.
    • New Lookout integration with ingestion to data lake and IOC Search mapping.
    • New NGINX integration with ingestion to data lake and IOC Search mapping.
    • New Cloudflare Access Requests, Audit Logs, and Gateway HTTP Requests integrations.

    +3 more show less

    • New Asset Tagging for Azure Managed Identities (UAMI/SAMI) based on Creation and Activity Events.
    • New azure_get_past_signin_ips_by_service_principal enrichment logic for Azure Managed Identities.
    • New detector azure_managed_identity_mass_token_types_requested for excessive distinct token type requests by MIs.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Detector azure_applications_secrets_update is disabled and no longer runs; use azure_credentials_added_to_service_principal instead.
20. January 2025 (2) Jan 2025 · release notes

    Hunters Pathfinder AI January 2025 (2): New Netskope V2 integration with two detectors and EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. detection logic.

    └──▷ HOW TO FIND IT
    Connect Netskope V2 to ingest findings as leads.
    📍Regenerate your Netskope API token as a V2 token. Edit the connection settings on Hunters to reflect the new token.
    • Adds Netskope Audit Events and Netskope Application Events detections via the updated Netskope V2 integration
    • Adds aws_unusual_amount_of_ec2_access detector to identify suspicious EC2 access patterns including password enumeration

    2 details in Everything

21. January 2025 (1) Jan 2025 · release notes

    Hunters Pathfinder AI adds multi-tenant SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. queue, new Fortinet/Zscaler integrations, custom scoring API, and AWS/gSuite detectors

    • Adds like wildcard operator for asset tagging rules and renames exact value to equals
    • Exposes the Leads Scoring API endpoint for programmatic creation of custom scoring rules
    • Integrates Fortinet FortiMail logs into the data lake with IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search mapping
    • Integrates Fortinet FortiAnalyzer logs into the data lake with IOC Search mapping
    • Integrates Zscaler Nanolog Streaming Service (NSS) logs into the data lake with Web Requests schema mapping

    +7 more show less

    • Adds edr_anomalous_ssm_startsession_command_execution detector for anomalous AWS SSMAWS SSMAWS Systems Manager, an Amazon service that lets operators manage EC2 instances and on-premises servers without opening inbound ports, replacing SSH with API-driven session and command execution. commands
    • Adds aws_console_login_by_federated_user detector for federated console logins
    • Adds edr_manual_credentials_gathering_using_aws_imds detector for manual IMDS credential harvesting
    • Adds gsuite_phishing_by_container_bound_script detector for Google Workspace phishing via container-bound scripts
    • Adds aws_access_key_compromised_policy_attatched detector for AWSCompromisedKeyQuarantine policy activation
    • Adds generic_password_spray_successful_model_v2 scoring layer for high-probability spray attacks
    • Adds Large number of failed logins custom rule with a 150-attempt threshold for brute force leads

    12 details in Everything

22. December 2024 Dec 2024 · release notes

    Hunters Pathfinder AI adds StrongDM and Microsoft Graph APIMicrosoft Graph APIA unified REST API maintained by Microsoft that exposes data and actions across Microsoft 365 services, letting cyber tools query users, emails, files, and sign-in logs through a single authenticated endpoint. integrations, updates CrowdStrike default stream, and enhances custom detector entity support.

    • Adds StrongDM integration with ingestion to data lake, IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search mapping, and Login Schema support
    • Adds Microsoft GraphMicrosoft GraphMicrosoft's unified REST API for accessing data and services across Microsoft 365, Azure AD, and related cloud products, giving cyber tools a single authenticated endpoint to query users, emails, files, and sign-in logs. API integration with ingestion to data lake, IOC Search mapping, and Web Requests Schema support
    • Enables automatic Investigation for Entities in custom detectors built on Hunters event sources
    • Adds HPE Aruba ClearPass alerts integration with ingestion to data lake, IOC Search mapping, and Login Schema support
    • Makes CrowdStrike Falcon Event Streams the recommended data type for CrowdStrike detections following API deprecation of crowdstrike_detects

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !CrowdStrike Detections data type (crowdstrike_detects) will be deprecated; users must connect CrowdStrike Falcon Event Stream (crowdstrike-falcon-event-streams) to avoid service interruptions.
23. November 2024 (2) Nov 2024 · release notes

    Hunters Pathfinder AI adds Juniper, OpenStack, Databricks, CloudSEK, Keycloak, Wiz EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. Runtime integrations and Nozomi detector.

    • Adds integration with Juniper Networks for Switch Logs and Firewall Logs, including ingestion to the data lake and mapping to IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search and Hunters Login Schema.
    • Adds integration with Microsoft Defender Advanced Hunting logs, replacing Defender for Endpoint and Defender XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Identity Query logs, with ingestion to the data lake and mapping to IOC Search.
    • Adds integration with OpenStack IaaS platform for log ingestion to the data lake and mapping to IOC Search.
    • Adds integration with Databricks cloud analytics platform for log ingestion to the data lake and mapping to IOC Search.
    • Adds integration with CloudSEK predictive threat intelligence for log ingestion to the data lake and mapping to IOC Search.

    +3 more show less

    • Adds integration with Keycloak IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. solution, including ingestion to the data lake, mapping to IOC Search, and mapping to Hunters Login Schema.
    • Adds integration with Wiz EKS Runtime logs for Amazon Elastic Kubernetes Service (EKS) workloads, including ingestion to the data lake and mapping to IOC Search.
    • Adds new nozomi_alerts detector for Nozomi alerts that filters out posture-like alerts and known vulnerability scanner noise.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Microsoft Defender Advanced Hunting logs replace the following: Some data types under Defender for Endpoint (see here) and Defender XDR Identity Query logs.
24. October 2024 Oct 2024 · release notes

    Adds Claroty xDome integration and new detectors for threat alerts and suspicious cmd.exe execution

    • Adds Claroty xDome integration supporting Devices, Alerts, Events, Sites, Device Alerts, and Device Vulnerabilities logs with IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search mapping
    • Adds claroty_xdome_threat_alerts detector to filter Claroty xDome alerts by Threat and Custom categories, reducing noise by ~90% and extracting source IP from alert names
    • Adds edr_cmd_suspicious_silent_execution_patterns detector to identify cmd.exe execution with the /Q (Echo Off) flag, indicating potential Impacket tool usage like Wmiexec

    3 details in Everything

25. September 2024 (2) Sep 2024 · release notes

    Hunters Pathfinder AI adds Azure Event Hub ingestion, Meraki/SAP integrations, new API timestamps, and detection logic

    • Adds support for ingesting Microsoft logs via Azure Event Hub
    • Adds new Meraki Auth Users integration for splash guest and RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. user data
    • Adds new SAP Security Audit Logs integration mapped to the Hunters Login Schema
    • Adds new SAP S/4HANA Security Audit Logs integration mapped to the Hunters Login Schema
    • Adds Azure Kubernetes Service integration mapped to the Hunters K8s Schema

    +6 more show less

    • Adds Azure Application Gateway WAF integration mapped to the Hunters Network Schema
    • Adds Microsoft Purview integration for data governance logs
    • Adds Microsoft Defender Identity Query integration for identity threat insights
    • Adds new detector aws_malicious_user_agents to identify API calls by known attacking tools via User-Agent field
    • Adds new detector edr_cmd_suspicious_silent_execution_patterns to find suspicious silent cmd.exe execution with the /Q flag
    • Adds two timestamp fields to the Get Leads API endpoint: event_end_time and ingestion_time

    11 details in Everything

26. September 2024 (1) Sep 2024 · release notes

    Hunters Pathfinder AI updates Azure AD, Defender for Office 365, and Proofpoint detector logic to reduce SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. noise

    • Adds risk_state filtering for Azure AD Identity Protection Risk Detections to limit SOC queue entries to specific risk states

    1 detail in Everything

27. August 2024 Aug 2024 · release notes

    Hunters Pathfinder AI adds Netscout Arbor, BlackBerry Cylance, and IIS W3C integrations plus new session management controls and real-time statistical detections.

    • Adds Netscout Arbor integration for DDoSDDoSDistributed Denial of Service: an attack that floods a target system with traffic from many sources simultaneously, exhausting its resources so legitimate requests cannot be served. data ingestion mapped to IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search.
    • Adds Blackberry Cylance integration with Login Schema mapping and IOC Search.
    • Adds IIS W3C log integration mapped to Web Requests Schema and IOC Search.
    • Enables configuring session management settings: Idle Session Timeout, Force Re-login, Maximum Concurrent Sessions, and Domain Restrictions in the Administration panel.

    4 details in Everything

28. July 2024 (2) Jul 2024 · release notes

    Hunters Pathfinder AI adds SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. Queue custom views, F5 Big IP WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. integration, and new Google/GCP threat detectors.

    • gsuite_drive_ownership_transferred detector
    • gsuite_domain_added_to_trusted_domains detector
    • gsuite_mfa_enforcement_disabled detector
    • gcp_audit_dm_privesc_using_sa_key_template detector
    • gsuite_external_user_added_to_group detector

    +4 more show less

    • gsuite_custom_admin_role_created detector
    • gsuite_admin_role_assignment detector
    • gsuite_email_route_created_or_modified detector
    • windows_event_machine_account_certificate_authentication confidence adjustments

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default confidence score for windows_event_machine_account_certificate_authentication is lowered to medium (from high) and no leads are entered into the SOC queue.
29. July 2024 (3) Jul 2024 · release notes

    New Netscaler AppFW and GitLab Audit Logs integrations, Snowflake situational awareness detector, and enhanced plain text password discovery.

    • Adds Netscaler Application Firewall integration with ingestion to the data lake, IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search mapping, and Hunters Web Requests Schema mapping.
    • Adds GitLab Audit Logs integration with ingestion to the data lake and IOC Search mapping.
    • Adds new detector snowflake_query_awareness_behavior for identifying multiple situational awareness database commands executed within a 30-minute window on Snowflake accounts.
    • Improves edr_plain_text_password_discovery detector by replacing Windows Sid field with username extracted from target_file_path, adding user_folder_name field to EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. file events, and filtering out PDFs and Ivanti processes.

    4 details in Everything

30. July 2024 (1) Jul 2024 · release notes

    Hunters Pathfinder AI July 2024 adds SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. Queue tabs, Detectors UI revamp, custom scoring API, SQL detectors, and new integrations.

    • Adds SOC Queue tabs to create customized, shareable views of the SOC Queue
    • Revamps the Detectors page UI with enhanced functionality to answer environment-specific detector questions
    • Introduces the Leads Scoring API endpoint for programmatic management of custom scoring rules
    • Enables SQL Custom Detectors (Raw SQL Auto and Scheduled) via the Detectors API
    • Improves lead view with collapse/expand all, default enrichment visibility, integrated Lead activity on Summary page, CSV export of activity, and quick-copy functionality

    +4 more show less

    • Adds new workflow triggers: Lead Was Managed, Story Was Managed, and New/Updated Comment for bi-directional ITSMITSMIT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows. sync
    • Adds Armis integration for IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search mapping and native alerts
    • Adds AWS Transit Gateway Flow Logs integration with network schema and IOC Search mapping
    • Adds Linux IP Tables (Shorewell) integration with network schema and IOC Search mapping

    9 details in Everything

31. June 2024 Jun 2024 · release notes

    Hunters Pathfinder AI June 2024 adds Lead Change Log API, Jumpcloud/MOVEit/Deep Security integrations, and refined detection logic

    • Adds Lead Change Log API endpoint for tracking lead actions including assignee changes, status updates, and classification adjustments.
    • Adds new integrations for JumpCloud Users, MOVEit Transfer, and Trend Micro Deep Security with data ingestion to the data lake and IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search mapping.
    • Improves Web application SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. attempt detector (web_server_sql_injection) by removing group-by logic to alert on individual attempts and allowing custom scoring on fields like request URI.
    • Modifies lead attributes for the Web application SQL injection attempt detector, removing attributes such as uri_queries_count and adding Server_port, response_win32_status, and http_method.
    • Improves Process execution through WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk. detector (edr_wmic_process_call_create_detector) to cover execution of XSL scripts using the /format flag.

    +2 more show less

    • Lowers default lead confidence level for the Process execution through WMI detector from High to Medium.
    • Deprecates detector aws_web_console_mfa_challenge_without_login (Incomplete MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. challenge to AWS console) due to low fidelity.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The lead attributes uri_queries_count, referrers_count, total_duration_sec, stem_target_paths_count, uri_stem_count, user_agents_count, successful_requests_count, grid_array, query_target_paths_count, and requests_count are removed from the Web application SQL injection attempt detector output.
    • !Detector aws_web_console_mfa_challenge_without_login is deprecated and will no longer generate leads.
32. May 2024 May 2024 · release notes

    Hunters Pathfinder AI adds Cofense, Meraki, Darktrace, Alibaba, Mimecast, Imperva integrations and new Kubernetes/EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. detections.

    • Adds integration for Cofense Threat Intel Feed and Cofense Reports with mapping to Login Schema and IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search
    • Adds integration for Cisco Meraki Syslog with mapping to Network Schema and IOC Search
    • Adds integration for Darktrace Model Breaches Details with mapping to IOC Search
    • Adds integration for Alibaba Bastion with mapping to Login Schema and IOC Search
    • Adds integration for Alibaba OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. with mapping to IOC Search

    +5 more show less

    • Adds integration for Mimecast Attachment TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. logs and Mimecast URL TTP logs with mapping to Email Activity Schema and IOC Search
    • Adds integration for Imperva Near Real Time SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. and Imperva Attack Analytics with mapping to Web Requests Schema or third-party alerts and IOC Search
    • Adds new detectors k8s_suspicious_high_privilege_rolebinding, k8s_sus_impersonation, and k8s_service_account_request_denied for Kubernetes security
    • Adds new detector edr_commandline_contains_base64_encoding_or_decoding_methods replacing deprecated base64 detection detectors
    • Updates detector okta_logs_potential_sso_hijack to Potential Okta session hijack using browser cookies and refocuses on SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. hijacking via browser cookies

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The detector edr_commandline_contains_echo_to_base64 is deprecated and removed
    • !The detector edr_certutil_uses_encode_or_decode_params is deprecated and removed
    • !The detector okta_logs_potential_sso_hijack has been renamed to Potential Okta session hijack using browser cookies
33. March 2024 Mar 2024 · release notes

    Hunters Pathfinder AI March 2024 adds asset tag filtering in SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. Queue, four new Kubernetes detectors, and NetIQ/Alibaba/Vectra/Nozomi integrations.

    • Adds asset tag filtering to the SOC Queue UI to prioritize alerts for specific assets
    • Integrates NetIQ eDirectory, including Login Schema and IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search mapping
    • Integrates Alibaba Cloud (RDS, Actiontrail, WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server., SLB, Security Center, Kubernetes audit/controller manager/API server logs)
    • Adds Vectra Stream integration, replacing the existing Zeek integration
    • Integrates Nozomi Networks OT/IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure./ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. alerts with IOC Search mapping

    +6 more show less

    • Adds windows_event_user_created_and_deleted detector for rapid user creation/deletion
    • Adds k8s_secret_enumeration detector to the Kubernetes Detection Pack
    • Adds k8s_creation_reverse_shell detector to the Kubernetes Detection Pack
    • Adds k8s_execution_in_kube_system detector to the Kubernetes Detection Pack
    • Adds k8s_creation_sensitive_hostpath_pod detector to the Kubernetes Detection Pack
    • Adds cb_platform_lead_events, cb_platform_threat_activity, and cb_alert_info enrichments for VMware Carbon Black

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The limit query parameter for get-stories and get-leads API calls is reduced to 10,000 (from 100,000), returning a 400 error if exceeded.
34. February 2024 (2) Feb 2024 · release notes

    Hunters Pathfinder AI adds Skyhigh SWGSWGA Secure Web Gateway is a network proxy that inspects outbound web traffic, enforcing policy by blocking malicious sites, filtering content, and decrypting TLS — giving cyber tools a choke point for all user HTTP/S sessions., MikroTik, pfSense, Kubernetes, and Imperva SecureSphere integrations plus SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. Queue UI enhancements.

    • Adds Skyhigh integration for secure web gateway log ingestion, proxy event mapping, and IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. search.
    • Adds MikroTik integration for network router and switch log ingestion to the data lake.
    • Adds pfSense integration including filter log ingestion, network schema mapping, and IOC search support.
    • Adds Kubernetes integration enabling audit log ingestion, Kubernetes schema mapping, and IOC search support.
    • Adds Imperva SecureSphere WAF integration for alert ingestion and IOC search mapping.

    +6 more show less

    • Introduces new SOC Queue filters to isolate unassigned Alerts, Leads, and Stories.
    • Relocates the threshold setting to a new Queue Configuration option at the top of the SOC Queue page.
    • Adds an expandable view mode in the SOC Queue by clicking Hide dashboard.
    • Adds detection for creation or modification of external facing Kubernetes NodePort Services (k8s_creation_or_modification_of_nodeport_service).
    • Adds O365_file_history enrichment to query SharePoint and OneDrive file access history.
    • Adds O365_threat_intel_file_info enrichment to fetch metadata and detection signatures for suspicious files.

    11 details in Everything

35. February 2024 (1) Feb 2024 · release notes

    Hunters Pathfinder AI adds data source tagging with lead/alert filtering, VMWare/Axis/Netography/Cisco/SilverPeak/SentinelOne/Island integrations, and new EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device./K8s detectors.

    • Adds data source tagging to allow adding business context tags to connected data flows for filtering leads, alerts, and stories.
    • Adds VMWare NSX Avi Logs integration including ingestion to the data lake, mapping to Web Requests schema, and IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search.
    • Adds Axis Security integration with ingestion to the data lake, mapping to DNS and Web Requests schemas, and IOC Search.
    • Adds Netography integration with ingestion to the data source, third-party alert generation, and mapping to IOC Search.
    • Adds Cisco ISE integration with ingestion to the data lake, mapping to login schema, and IOC Search.

    +7 more show less

    • Adds SilverPeak integration with S3 data ingestion to the data lake, mapping to Network Schema, and IOC Search.
    • Expands SentinelOne Custom Rules support to include all alerts raised from custom rules with third-party alert generation.
    • Adds Island Browser integration with 3 data type ingestion into the data lake and timeline log mapping to IOC Search.
    • Enhances detector export CSV to include a MITRE Technique ID column in addition to Technique name.
    • Adds new detector edr_directory_masquerading_using_colorcpl.exe for detecting masquerading via colorcpl.exe file parameters.
    • Adds new detector k8s_anonymous_authorized_request for Kubernetes API requests authorized by unauthenticated users.
    • Adds Kubernetes enrichments k8s_allowed_request_to_rolebinding_creation and ip_k8s_activity alongside the anonymous request detector.

    12 details in Everything

36. January 2024 Jan 2024 · release notes

    Hunters Pathfinder AI adds GCP bucket ingestion, new integrations for Cisco VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection., Meraki, Jamf, Abnormal, Imperva, Keeper, BeyondTrust, Zscaler, and new detectors

    • Adds self-service log ingestion from GCP buckets for GCP Audit logs and Palo Alto Network EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. Raw Logs, requiring a service account with Storage Object Viewer and Storage Insights Collector Service permissions
    • Adds Cisco VPN Auth logs ingestion (from AnyConnect) mapped to IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search and Login Schema
    • Adds Meraki Air Marshal log ingestion from on-prem appliances via AWS S3, enabling custom detections
    • Adds Jamf Server System Access Logs and System Change Management Logs ingestion with mapping to Login Unified Schema and IOC Search
    • Updates Abnormal Security integration to support self-service ingestion and native alerts written over data

    +8 more show less

    • Adds Imperva Incapsula Cloud WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. access and event log ingestion mapped to Web Requests Schema and IOC Search
    • Adds Keeper log ingestion for password management, secrets, and dark web monitoring mapped to Login schema and IOC Search
    • Adds BeyondTrust PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Events and Activity Audit log collection via API with mapping to EDR Process/Logon schemas and IOC Search
    • Adds Zscaler ZIA Audit logs integration for admin portal and API actions mapped to Login schema and IOC Search
    • Opens Snowflake data source access to all customers (previously Partner Connect only)
    • Adds new detector Potential Payload Retrieval from a New WebDAV Server (ID: proxy_new_webdav_payload_retrieval) for HTTP GET requests via WebDAV user agent
    • Adds new detector Suspicious Conhost.exe Indirect Execution (ID: edr_conhost_indirect_execution) for unusual conhost.exe loader activity
    • Improves Web Application SQL Injection (web_server_sql_injection) and Web Path Traversal Attempt (web_path_traversal) detectors by filtering for successful requests to reduce noise

    13 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The terms Analytic, Native alert, and Mega-entity will be renamed to Detector, 3rd party lead, and Entity respectively in the platform UI
    • !Web request detectors web_server_sql_injection, web_path_traversal, web_requests_excessive_unauthorized, and web_requests_excessive_internal_server_error no longer run on Zscaler Internet Access (ZIA), IBoss Web Activity, Cisco Umbrella Proxy, or Symantec Cloud SWGSWGA Secure Web Gateway is a network proxy that inspects outbound web traffic, enforcing policy by blocking malicious sites, filtering content, and decrypting TLS — giving cyber tools a choke point for all user HTTP/S sessions. data sources
37. December 2023 Dec 2023 · release notes

    Hunters Pathfinder AI adds new roles, Snowflake/Acalvio/CrowdStrike/Vicarius integrations, GET/leads API fields, and detection capabilities.

    • Adds Analyst, Advanced Analyst, Security Engineer, Data Engineer and MSSP Client user roles to control access levels for security team members
    • Integrates Acalvio Shadowplex Deception Incidents logs into the data lake and IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search
    • Connects Snowflake logs including snowflake-query-history, snowflake-login-history, snowflake-reader-account-query-history, and snowflake-reader-account-login-history data types
    • Supports Crowdstrike FileVantage data type collected via the CrowdStrike API and mapped to IOC Search
    • Adds integration with Vicarius Event logs, mapping them to the Vulnerability Management Findings unified schema

    +5 more show less

    • Enhances the GET/leads API response with new fields: is_alert, threat_description, classification, data_flow_tags, detector_title, and detector_id
    • Enables monitoring of data source health status, including issue reasons and mitigation steps on the Data Sources page
    • Adds detection for possible password sprayingpassword sprayingTrying a small number of common passwords across many accounts. Attackers spread attempts out to avoid the lockouts caused by repeatedly guessing one user's password. using Detector ID login_logs_password_spraying
    • Improves account navigation by restricting tenant visibility to only those explicitly invited to the user
    • Allows switching between workspaces for users invited to tenants across multiple workspaces

    10 details in Everything

38. November 2023 (1) Nov 2023 · release notes

    New Qualys Hosts and Box integrations; Web SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. and GCP function mod detectors; Linux AuditD self-service parsing

    • Adds Qualys Hosts data type integration with ASR and DNS enrichments
    • Adds new Box integration (Users, Groups, Events) mapped to login schema and IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search
    • Adds Linux Mail Logs ingestion from /var/log/maillog mapped to Email schema and IOC Search
    • Adds Linux AuditD integration upgrade with open self-service ingestion and full raw key-value parsing
    • Adds web_server_sql_injection detector for SQLi in web requests

    +2 more show less

    • Adds gcp_cloud_function_modified_from_storage detector for Cloud Function source modification via GCP Storage
    • Enhances edr_powershell_suspicious_flags detector to cover PS downgrade flags like -v 2 and -version 2

    7 details in Everything

39. November 2023 (2) Nov 2023 · release notes

    New user/role API, 5-min custom detection intervals, Cisco/AWS/MuleSoft integrations, and new EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. detectors

    • Adds a new API endpoint for managing users and roles, supporting operations such as listing users, organizations, and roles; creating users; assigning/unassigning roles; and removing users.
    • Reduces the custom detector execution interval from 10 minutes to 5 minutes.
    • Adds Cisco Switch log support with mapping to the Network Unified Schema and IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search.
    • Adds Cisco WLC syslog support for Wireless LAN Controllers.
    • Adds AWS Cloudwatch logs integration for monitoring Amazon EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware., CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions., and Route 53 sources.

    +8 more show less

    • Adds MuleSoft Application log support via transformation to the data lake.
    • Adds Claroty SRA log support with mapping to the Network Unified Schema and IOC Search.
    • Enables self-service configuration for Claroty CTD Events connections on the platform.
    • Maps Zerofox logs to native alerts to surface them as leads in Hunters.
    • Adds new detector web_requests_excessive_unauthorized (ID: web_requests_excessive_unauthorized) for high numbers of unauthorized HTTP requests.
    • Adds new detector edr_export_creds_via_wcm_wizard (ID: edr_export_creds_via_wcm_wizard) for credential export via Windows Credential Manager.
    • Adds new detector web_requests_excessive_internal_server_error (ID: web_requests_excessive_internal_server_error) for high numbers of internal server error HTTP requests.
    • Updates detector cs_execution_under_mounted_iso to detect scenarios where the ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. mount is initiated by dllhost.exe and execution by explorer.exe.

    13 details in Everything

40. October 2023 Oct 2023 · release notes

    New Custom Detectors and Asset Tagging APIs, Prisma SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. integration, expanded GET /leads filters

    • Adds Custom Detectors API endpoints (list, create, update, delete, test, dry run, bulk) for managing detections via the Hunters Detection Language.
    • Adds Asset tagging API for programmatically creating and maintaining asset tags and identifying rules in bulk.
    • Adds updated_since, updated_until, and investigation_state parameters to GET /leads API for filtering leads by investigation status timeframe.
    • Adds org_code parameter to all API endpoints as an alternative to the existing organization parameter for filtering by tenant code.
    • Adds new Prisma SaaS integration for visibility into user and file activity across sanctioned SaaS applications.

    +3 more show less

    • Adds new Mimecast Message Held Release Logs integration for tracking emails released from Mimecast's held queue.
    • Adds new detectors: office365_possible_file_exfiltration and office365_suspicious_ediscovery_usage.
    • Expands Detectors csv report columns to include Alert Settings (Default/Customer/Final Alerts Enabled/Threshold), Data Sources, and Identifier columns (ID, Open API ID).

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The detector o365_suspicious_app_impersonation renamed the attribute organization_server to originating_server, affecting API consumption of its leads.
41. September 2023 Sep 2023 · release notes

    Hunters Pathfinder AI adds Auth0 Logs, BitBucket Audit Logs, Linux SSHD, Crowdstrike Indicators, new detections, and API changes.

    • include_attributes parameter added to GET /leads API endpoint to return detailed lead attributes such as ip, os, device_type, and user_agent
    • inner_status parameter added to /GET data source status and health API response to show specific error types like Internal error or Configuration issue
    • New integration for Auth0 Log Events ingestion with mapping to Login Unified Schema and SOLUTIONS_STAGING_DB.RAW.AUTH_ZERO_LOG_EVENTS
    • New integration for Atlassian BitBucket Audit Logs with transformer and IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search mapping
    • New Lacework Agent Alerts capability generating third-party alerts in the system

    +8 more show less

    • New Linux SSHD log ingestion supporting /var/log/auth.log with Login Unified Schema and IOC Search mapping
    • New CrowdStrike Indicators integration providing threat intel IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. (URL, Hashes, domain) connected to threat_intel_ioc_lookup DrillDown
    • New detector login_logs_terminated_user_login for logins by users tagged terminated_user via Asset Tagging
    • New detector cloudtrail_ec2_instance_credentials_used_from_outside_aws for EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. credential usage outside AWS
    • New detector o365_suspicious_app_impersonation for application impersonation in O365 Exchange
    • New detector office365_over_permissive_access_granted_to_mailbox_folder detecting anonymous/default permissions on mailbox folders
    • Modified detector edr_new_device_with_rdp_connection with increased confidence from 2 to 3 and ~75% noise reduction
    • Modified detector cloudtrail_secrets_exfil converted to a time-series template looking only for GetSecret events

    13 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !error_details parameter deprecated and replaced by message in /GET data source status and health API response
42. August 2023 (2) Aug 2023 · release notes

    Hunters Pathfinder AI August 2023 introduces Threat Clustering, Seraphic/AWS RDS/Azure AD Identity Protection/Harness/VGS/SolarWinds integrations, Office 365 detection pack,

    • Official release of Threat Clustering to reduce triage time by grouping leads based on malicious intent and context
    • Adds IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Search support for 1Password, Microsoft 365 Defender, Agari, Azure AD Users, Atlassian Confluence/Jira, Mimecast, AWS Config/Inspector/WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server./GuardDuty/Route53/S3, Office365 Audit Logs, Cisco ASA/FTD, Okta, CrowdStrike, Orca, GCP Audit/Security Command Center, Wiz, Google Workspace, Zscaler, Meraki, and Gsuite directory users
    • Adds native integration with Seraphic Security browser security solution including puller for Events/Alerts endpoints and transformation to Snowflake
    • Adds native integration with AWS RDS Aurora data via transformer for RDS logs
    • Adds native integration with Azure AD Identity Protection risk detection reports via Graph APIGraph APIMicrosoft's unified REST API for accessing data across Microsoft 365 services — mail, calendar, users, files — letting cyber tools query or monitor cloud environments through a single authenticated endpoint. collection

    +6 more show less

    • Adds ingestion of Palo Alto Networks XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Raw Logs mapped to 8 unified schemas for AWS bucket exports
    • Adds native integration with Harness IO Audit Logs mapped to Login Unified Schema
    • Adds native integration with Very Good Security Events via transformer
    • Adds native integration with SolarWinds Orion logs mapped to Login Unified Schema
    • Adds Office 365 Detection Pack containing four new detectors: Suspicious Transport Rule Created, Hiding of Incoming Emails using Inbox Rule, Disablement of Exchange Audit Log, and Forwarding Rules Outside Organization
    • Adds GCP IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Roles Enumeration Using GetIAMPolicy time series detector to detect aggressive IAM policy enumeration via Get-IAM-Policy API calls

    11 details in Everything

43. July 2023 (4) Jul 2023 · release notes

    Hunters Pathfinder AI adds 9 new integrations (AWS S3/VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection./EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves., Infoblox, VMWare, Bricata, Crowdstrike Mobile, Ironscales, Malwarebytes) and a KerberoastingKerberoastingAn attack that obtains Kerberos service tickets and tries to crack their encrypted contents offline. Recovering a weak service-account password can give the attacker that account's access. detector.

    • Supports onboarding of AWS S3 Server Access Logs mapped to the web requests unified schema
    • Supports onboarding of AWS S3 Client VPN Connection Logs mapped to web requests and login unified schemas
    • Supports onboarding of AWS EKS Control Plane logs with 6 distinct transformations ingested to Snowflake
    • Supports onboarding of Infoblox Audit & DHCP logs including transformation for NIOS DHCP and Audit
    • Supports onboarding of VMWare AirWatch Workspace One UEM logs mapped to the Unified Login Schema

    +6 more show less

    • Integrates Bricata NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. with handling suffix pattern, log transformation, and third-party detection
    • Supports Crowdstrike Mobile Alerts via puller collection, transformation, and third-party detection
    • Integrates Ironscales Incidents via a new incidents endpoint puller, Snowflake transformation, and detection
    • Supports Malwarebytes Nebula Events and Detections via endpoints puller, Snowflake transformation, and investigation group
    • Adds Suspected Kerberoasting - Excessive Weakly Encrypted TGS Requests detector using Time Series Anomaly logic
    • Deprecates Office Application Loads WMI Module, Failed MFA Challenge without Successful Followup, and Login Attempt to a Locked Okta Account detectors

    11 details in Everything

44. July 2023 (2) Jul 2023 · release notes

    Hunters Pathfinder AI July 2023 release improves Threat Clustering UX with new Cluster Details panel and triage efficiency indicators.

    • Adds a revamped Cluster Details panel featuring status and classification statistics, reorganized cluster information, and an integrated lead grid for quick triage.
    • Adds a quick-link interface to inspect a sample lead from within the SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. Queue or Leads page for rapid specimen examination.
    • Introduces global and per-cluster triage booster indicators that quantify time and effort savings derived from using threat clustering.

    3 details in Everything

45. July 2023 (1) Jul 2023 · release notes

    New Databricks Partner Connect, STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form.-TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. connector, Salesforce Event Logs schema, and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. fatigue detector in July 2023 (1)

    • Adds Partner Connect option in the Databricks Partner Connect Store for quicker setup
    • Adds STIX-TAXII Connector integration for CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. ingestion
    • Adds support for Salesforce Event Logs schema with 60 event types via Salesforce API integration
    • Adds Detector source indication column on the Leads page to show detector origin (3rd party, Hunters, Custom)
    • Adds quick lead actions in the lead panel for assigning leads and clearing assignees

    5 details in Everything

46. July 2023 (3) Jul 2023 · release notes

    Threat Clustering GA adds Clustered view to SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. Queue and new Cluster Details panel with Triage Booster metrics

    • Clustered toggle in the SOC Queue switches the default lead view from unclustered to threat-based aggregation.
    • New Cluster Details panel provides status, classification statistics, lead grid, and quick actions for grouped leads.

    2 details in Everything

47. June 2023 Jun 2023 · release notes

    Hunters Pathfinder AI June 2023 adds Cyberhaven/SailPoint integrations, time series detectors, and Rclone detection.

    • Adds Cyberhaven integration to ingest data and triage alerts in the Hunters portal
    • Adds SailPoint IdentityNow integration to ingest user data and run OOTB detections
    • Adds support for VMWare ESXI logs as a new data source for search and security activity
    • Adds Microsoft Intune devices as asset tagging entities segmented by health state
    • Adds Time series detectors (UEBA) starting with SaaS Application Brute Force Attempt detector

    +2 more show less

    • Adds Impossible travel detection detector for anomalous SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. logins from different IPs
    • Adds Execution of Rclone Tool Characteristics detector to identify the binary and command line flags associated with Rclone

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The existing Impossible Travel Okta detector is deprecated on June 7th and will be replaced by the new Impossible travel detection detector
48. May 2023 May 2023 · release notes

    Hunters Pathfinder AI adds CrowdStrike Spotlight/Incident and Semperis DSP integrations, plus Ransomware detection pack detectors.

    • Adds integration with CrowdStrike Spotlight logs for real-time vulnerability exposure assessment
    • Adds integration with CrowdStrike Incident logs
    • Adds integration with Semperis DSP logs for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. activity monitoring
    • Adds ingestion of Aviatrix System Logs (syslog) and Aviatrix Auth Logs (auth.log)
    • Adds Plain Text Password Discovery detector to the Ransomware detection pack for EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. RAW logs

    +1 more show less

    • Adds Suspected Data Exfiltration Using Rclone detector to the Ransomware detection pack for Proxy data

    6 details in Everything

49. April 2023 Apr 2023 · release notes

    Hunters Pathfinder AI April 2023 adds GPT-assisted command line investigation, absolute date lead filtering, and new 1Password/Cisco integrations with detection rules.

    • Enables GPT-assisted investigations for EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device.-related data in the closed Beta to analyze command lines from Auto-Investigation drawers
    • Adds search for leads on an absolute date and time range filter to the SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. Queue with shareable URL functionality
    • Supports 1Password Audit Events logs to track changes to accounts, vaults, groups, and users
    • Integrates Cisco Firewall Impact Flag Logs with native alerts mapped to MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. techniques
    • Detects Azure Activity authentication and action IP mismatches to identify potential stolen access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions.

    5 details in Everything

50. March 2023 (1) Mar 2023 · release notes

    Hunters Pathfinder AI introduces IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. search GA, AWS Inspector/Vectra/Symantec/Zscaler integrations, Azure AD detection pack, and verbose audit logs.

    • Makes IOC search generally available, allowing direct search of raw data logs for known Indicators of Compromise without SQL queries
    • Adds support for AWS Inspector Findings as a new log source type
    • Adds Vectra NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. (formerly Cognito) network detection and responsenetwork detection and responseNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. logs to integrations
    • Supports Symantec Cloud Secure Web Gateway Audit Logs
    • Supports Zscaler ZIA DNS logs

    +1 more show less

    • Expands Hunters audit log records to include verbose details for Asset tag, Asset annotation, Custom rule, Custom analytic, and Data source edits

    6 details in Everything

51. March 2023 (2) Mar 2023 · release notes

    New custom detector operators, Watchguard Firebox/Slack/Cyera integrations, and an Azure service principal credential detector in March 2023 (2)

    • Adds additional logic operators to the Custom Detectors framework for advanced threat coverage.
    • Supports onboarding Watchguard Firebox Logs via AWS S3 intermediary.
    • Supports onboarding Cloudflare Area 1 email alerts via API.
    • Supports onboarding Zscaler ZIA Firewall logs via syslog/S3.
    • Supports onboarding Cisco ESA Consolidated Event Logs (CEFCEFCommon Event Format, an ArcSight (Micro Focus) log standard that defines a fixed header plus extensible key-value pairs so cyber tools can emit and ingest alerts in a predictable, parseable structure.) via AWS S3.

    +4 more show less

    • Supports onboarding Teleport Audit Events Logs via Fluentd/Logstash/S3.
    • Supports onboarding three Slack log types: Audit Logs, Users, and Files.
    • Supports onboarding Cyera Issues and Datastores logs for triaging.
    • Adds a new detection for "Addition of new credentials to a service principal on Azure Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments." in the Azure content pack.

    9 details in Everything

52. February 2023 Feb 2023 · release notes

    Hunters Pathfinder AI February 2023 adds clustering API fields, bulk lead action endpoints, and new integrations for Symantec DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., Armorblox, CrowdStrike IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., Exchange, BIND,

    • Get Leads API now accepts threat_uuid and context_uuid cluster filters.
    • Get Leads response schema includes new fields: Threat uuid, Threat attributes and value, Context uuid, Context attributes and value.
    • New Threats endpoint allows posting comments on a threat cluster.
    • New APIs support bulk setting of assignee, status, and classification for a list of lead UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide..
    • IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. search results can be shared via URL copy/paste to open in the portal.

    +12 more show less

    • Risk score defaults adjusted for 40+ Native Alerts detections to reduce false positives.
    • New integration: Symantec DLP Logs (Transformation + Native Alerts).
    • New integration: Armorblox (Incidents and Policies via API).
    • New integration: CrowdStrike IDP Falcon Identity Protection.
    • New integration: Microsoft Exchange Traffic Logs (CSV to Email Events).
    • New integration: BIND DNS (Raw TEXT to DNS schema).
    • New integration: F5 VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. BIG-IP logs.
    • New integration: ThreatX Audit Logs.
    • New integration: Cloudflare logs.
    • New integration: Apache2 logs.
    • New detection: Possible primary refresh token extraction for Azure Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments..
    • New detection: Azure Multiple VM Password Reset.

    17 details in Everything

53. January 2023 Jan 2023 · release notes

    Hunters Pathfinder AI introduces split Automatic Investigation with Rapid (minutes) and Advanced phases for faster triage.

    • Adds Rapid Automatic Investigation phase delivering near real-time results for fast scoping and triage
    • Introduces Advanced Automatic Investigation phase for deep analysis of threat evolution including execution trees and network connections

    2 details in Everything