Hunt: Keyword and IOC Search

To scan endpoints for keywords and indicators of compromise, you need to provide a configuration file and a keyword list to drive a script-based search. This surfaces matching endpoints across the network and produces structured results for downstream tooling.

You can search for indicators of compromise including IP addresses, SHA256 hashes, filenames, and custom string patterns. This flexible keyword and IOC search supports multi-keyword queries across all endpoints for threat intel enrichment.

Yes, running an IOC search requires a configuration file and a keywords list to drive the script-based search. These inputs define the search parameters and scope across all network endpoints.

The best way to use keyword searches for incident investigations is applying flexible, ad-hoc queries for custom string patterns and IOCs across all endpoints. This identifies and surfaces matching endpoints to support threat hunting workflows.

Yes, you can use this flexible hunting tool for ad-hoc investigations and threat intel enrichment. It applies custom keyword and IOC searches across all endpoints to produce structured results for downstream analysis.

Script-based endpoint searches for IOCs require a predefined configuration file and keyword list to function. They are designed for structured result output and downstream tooling integration, which may limit purely spontaneous, unstructured threat hunting.