📄️ Watchers
Watchers are standing rules over your estate. Each one describes a pattern and
📄️ Deploy a watcher to your SIEM or data lake
A Sigma watcher can run in more than one place. Huntbase checks the data it
📄️ Field mappings
A Sigma rule names fields such as CommandLine, ParentImage or Image.
📄️ Coverage
Coverage answers one question: where is each watcher actually running?
📄️ Query budgets
Every time Huntbase searches one of your stores on a schedule, it runs a query
📄️ Push rules into Splunk or Sentinel
A deployment usually means Huntbase searches your
📄️ Graph watchers: what feeds them
A Sigma watcher matches one event, so it runs wherever that event is: in
📄️ One detection, many stores
Your events often live in more than one place. The same Sysmon event can