Search telemetry
Search shows the raw events your log shippers send to Huntbase. Type a value or a field:value filter, or click values in the results to filter by them. Huntbase writes the search as a query, so you can see the exact query behind what you see, edit and run it, save it, add it to a hunt or schedule it. Search and Query share one frame: switching between them changes the input, not the page.
Search is a query language, Search (Huntbase Lake). It reads the telemetry that arrives through telemetry ingest keys, which all send to the Huntbase data lake. A view can also include your own lakes, which Huntbase reads but never sends to. It needs no connection. In a query tab, a Search / Query toggle at the left of the bar switches between the search and the query it compiles to. The Telemetry page's Search events and View events open it. See From the Telemetry page.
This feature is currently rolling out and may not be enabled for your organization.
Start a search
| From | How |
|---|---|
| The ask box | On Explorer or in a new tab, type a single value such as an IP, hash or host, or text with field:value filters. The line under the box says what Enter will do, for example ↵ will look up this IP: is it known bad, where it was seen, and its telemetry. For one value the button reads Look up. While it starts, the line reads Searching… the results open in a new tab. You can also pick Treat as ▾ › Query and choose Search (Huntbase Lake), the first entry in the language pill, or type /search or /browse and a space at the start of the input. |
| The ▾ next to + | Choose Search telemetry. Without new tabs, the tab bar's + menu has the same entry, and it opens on every source for the last 24 hours. |
| The command palette | Press ⌘K / Ctrl+K and type a value. Where threat intelligence is on, pick Look up …: it opens the same Search with the answer for that value on top, as the ask box does. Otherwise pick Search telemetry for …. Both search every source over the last 24 hours. |
| A query tab | Click Search in the mode toggle at the left of the bar. |
| Telemetry | Click Search events in the page header, View events on a source or an issue, or Browse on a destination. These open a Search tab in the Explorer, filtered to that source where there is one. See From the Telemetry page. Browse on one of your lakes includes your lakes in the view. |
| A Scout chat | Click Open in Search on a telemetry result, or Apply filters on a view Scout suggests. See Scout and your telemetry. |
| A hunt | Click Open in Search on a telemetry view cell. Where available, the tab stays linked to the cell, and Update step saves your changed view back to it. See Telemetry view cells. |
| A saved view | Open a query saved with Save view. It opens in Search, not Query mode. |
Each of these, except Telemetry, opens a tab named Search telemetry, or named after what you searched for. From a new tab, that tab turns into the search in place. A link carries the view, so the tab opens with the same sources, time range and filters. The older /explorer?new=browse links still work and open Query on Search. Search used to be called Browse.
Write a search
In a new tab, Search (Huntbase Lake) has its own pills: Scope, a time range (Last 24 hours by default), sources (All sources by default) and Live tail. Type your search and press Enter, or click Run search. An empty search shows every event in the time range.
Enter searches the Huntbase data lake only. If you have lakes of your own in federation, a stores pill follows the time range: it reads Lake, or Lake + N when your lakes are included. Pick Huntbase Lake only or Huntbase Lake + your lakes there, or press ⌘/Ctrl+Enter to search them too for this run. The line under the input says what Enter will read, for example Search Huntbase Lake · ⌘↵ also search followed by your lake's name. Searching your lake scans your bucket, so it counts against your organization's daily scan budget.
| You type | It matches |
|---|---|
beacon "cmd.exe /c" | Events that contain every word and quoted phrase. |
-svchost | Leaves out events that contain the word. |
host:WKST-4471 | Events where the field has that value. Quote a value with spaces: process:"cmd.exe /c". |
-user:svc_backup | Leaves out events where the field has that value. |
parent_process:* | Events that have the field. |
-parent_process:* | Events that don't have the field. |
host:web-01 host:web-02 | Repeating a field matches either value. |
10.0.0.5 OR 10.0.0.6 OR "evil.example" | Events that contain any of the words or phrases. Write OR in capitals; lower-case or is just a word. |
@host: @source: @event_type: | The same as host:, source: and event_type:, so a mention works as a filter. |
Everything in a search must match, except a repeated field, which matches either value, and words or phrases joined with OR, which match any of them. OR can't sit next to a field:value or a - exclusion: repeat the field instead. A value that starts with / or : is plain text, not a filter, so IPv6 addresses, URLs and times like 12:30:01 search as you'd expect.
The filters you type appear as chips under the text, so you can check them before you run. If Huntbase can't read the search, the reason appears under the input and nothing runs. Switching to another language keeps your text.
To run the search on a schedule, pick a schedule from the ▾ next to Run search. The button then reads Schedule. See Schedules.
A search is a query
A search you start from a new tab is saved as a query, like any other. So it gets what a query run gets:
- The run list, to step back through earlier runs.
- Add to hunt, next to Save view, which adds the search to a hunt as a step. See Add work to a hunt.
- A schedule.
In the tab, the words and filters you typed show as the search and filter tokens. Query ▸ shows the KQL (Huntbase Lake) query the search compiles to. See See the query behind a search.
The bar in a Search tab
In a query tab, the bar in Search mode has the same layout as in Query mode. The language and connection pills are replaced with a source picker, and the editor with a search box.
| Control | What it does |
|---|---|
| Scope | The same scope pill as Query mode. Search shows sources from the organizations in your scope. |
| Sources | All sources · N by default. Open it to pick one or more sources, or Every source. Each source has a status dot. |
| Time range | Last 15 minutes, Last 1 hour, Last 4 hours, Last 24 hours (the default), Last 7 days, Last 30 days, or Custom range…. |
| Search | Type any value and press Enter to keep only the events that contain it anywhere. |
| Ask Scout | Next to the search box. When you've typed a question in the search box, it sends the question to Scout along with the view. Otherwise it asks Scout about the view as it stands. |
| Live tail | Streams new events into the view as they arrive. See Live tail. |
Under the bar is a line that says what the search read, and what it didn't, for example Searched Huntbase Lake only · 9 connected tools not searched. The number of ingest sources and their current rate (~N events/min) follow it when they aren't zero. Save view and Query ▸ are at the right of that line.
Search reads your telemetry, not your connected tools such as a SIEM or EDR. So that "nothing here" never reads as "nothing anywhere", the line names the tools it didn't search and offers to search them. See Search your connected tools too.
Look up one value
When you search for a single IP address, domain, hash, URL or email address, and threat intelligence is on in your scope, an answer for that value sits above the results. It's there whether or not your telemetry holds the value, so Enter always tells you something.
The answer has:
- A one-line verdict that combines threat intel with where the value was seen. It never says "clean":
| Verdict | Meaning |
|---|---|
| Known bad, and seen in your estate | Threat intel lists it as malicious, and it has been seen in your data. Suspicious, and seen in your estate when intel rates it suspicious. |
| Known bad · not seen in what was checked | Threat intel lists it, but nothing that was checked holds it. |
| Seen in your estate · listed by threat intel in the past | An intel entry for it has expired or been revoked: treat it as history, not a current listing. |
| Seen in your estate · no threat intel on it | It's in your data, but no feed lists it. |
| Nothing known · not seen in what was checked | No feed lists it, and nothing that was checked holds it. |
- The threat intel line: which feed lists the value, or that none does, with Open indicator. An expired entry reads, for example, Listed by MISP (demo) · expired 22 Oct — treat as historical. If threat intel couldn't be checked, the line says so instead of reporting that no feed lists it.
- Where it was seen: Seen N× in your estate over all time, with when it was last seen, and chips for the endpoints and users it was seen with. This is separate from the event count for the search's own window (for example 0 events in Huntbase Lake, last 24 hours), so the two don't contradict each other.
- What was checked: for example Searched threat intel, sightings and Huntbase Lake only · 7 connected tools not searched, with the button to search them.
- Actions: Open hunt when a hunt already has the value, then Ask Scout, Add to hunt, Look back and Watch for this. Open profile opens the value's page.
Search your connected tools too
Search reads the Huntbase data lake (and your own lakes when you include them). Your connected tools, such as a SIEM or EDR, aren't searched. The line under the bar, the answer for a value, and the empty state all say how many weren't, with a button that searches them:
| Button | When |
|---|---|
| Search all N | Every connected tool can take the search. |
| Search the N that can | Only some of them can. |
| Query them | The search is free text, which can't be sent to them as a search. It opens a query on them instead, for you to write and run. |
Search all N and Search the N that can run straight away in the same tab. Huntbase turns the value into one STIX pattern, bounded by the search's time range, and sends it to each connected tool that can take STIX. It skips sample and simulated connections, connections that are switched off or failing, and connections whose key has expired. Each tool answers or fails on its own, and a notice names any that failed. The run is a query, so its results use the query view. Search on the toggle brings back your filters.
Filter by clicking
A filter is created every time you click a value, and it applies at once. The token is solid, and there's nothing to apply. (In a query on one of your connections, clicked filters wait for Apply instead, because each run goes to the connection. See Filters wait for Apply.)
- Fields tab: the + and − next to a top value include or exclude it. Clicking the value itself includes it.
- An expanded event: the + (Include) and − (Exclude) next to each field.
- Table view: click a cell to keep only events with that value.
Each filter appears as a token under the bar. Include is shown as field = value and exclude as field ≠ value. Has field and Missing filters read field exists and field missing. When you include a second value for the same field, it's added to the existing token (host = web-01, web-02), so the token matches either value. Including a value that you'd excluded moves it rather than contradicting the exclusion.
On each token:
- ⇄ (Switch include / exclude) flips the filter between include and exclude.
- × removes the filter.
Clear all removes every filter, the search and any zoom. It keeps your sources and time range. When there are no filters, the row reads No filters. Click a value in Fields or in an event to add one.
The Fields tab
The Fields tab in the side panel lists every field in the current view. Each field shows its coverage, which is the share of events in the view that have it. Fields are ordered by coverage. Use Find a field… to narrow the list.
Click a field to see its top values with their counts and an estimate of how many distinct values it has (~N distinct). host and event_type are open by default. A field that not every event has also offers Has field, and every open field offers Missing.
The counts cover the whole view, not just the events on screen. For a large view, the field list and coverage are worked out from a sample of the most recent events. The note at the bottom of the tab then says sampled and gives the sample size, and so does each open field until its exact counts load. Opening a field always counts its top values over the whole view.
The volume strip
Above the events, Volume charts the view over its time range, stacked by source. Beyond the top few, the remaining sources are grouped under Other sources.
Click a bar to zoom the view to that slice of time. A time token appears with the filters, and Back appears on the strip. Either one returns you to the range you had before. Picking a new range in the bar also clears the zoom.
Events and table
The results header shows the number of events that match the whole view. A number that starts with ~ is an estimate. More events load as you scroll.
| View | Shows |
|---|---|
| Events | One line per event, newest first. Click a line to expand it. |
| Table | One column per field. Click a cell to filter to that value. Right-click a row to add a note to it or to one of its cells, or Add to timeline…. Rows can't be tagged here. See Tags and notes. |
Each line in Events shows the event's time, host and a short summary. For events in the OCSF schema, including those read from your own lake, the summary is chosen by the event's class:
| Class | Summary shows |
|---|---|
| Authentication | The activity, the outcome (Failure in red, Success in green), the user, the source and destination addresses and port, and the protocol |
| Network Activity | The activity, direction, source and destination addresses and ports, and the protocol |
| DNS Activity | The queried name and type, the answers, the response code and the asking address |
| Process Activity | The activity, the process name and command line, the user, the parent process, the PID and the file path |
When you searched for a value, the field it matched is highlighted, or shown first if it wasn't already in the summary. Schema bookkeeping such as metadata.* and class ids stays in the expanded event. The severity chip shows the severity the source sent.
Search offers Events and Table only, because it shows raw events. A query run adds Map and Graph when its results support them: use Edit as query and Run, or start a hunt.
In Table, clicking a row opens the event beside the results, in the same row panel a query run's rows open in. Filter on this field there adds a Search filter. Clicking a cell still filters to that value.
Act on one event
An expanded event lists every field with Include and Exclude, followed by these actions:
| Action | What it does |
|---|---|
| Show surrounding events | Changes the time range to 5 minutes either side of the event and keeps your filters. Remove the time token to go back. |
| Start a hunt | Creates a hunt named after the event and pins the 5 minutes either side of it, with your current filters, as a telemetry view cell titled Events around the starting event. |
| Ask Scout about this event | Opens Scout in the dock with the event and the view attached, and asks what the event is, whether it's suspicious, and what to look at next. |
| Copy JSON | Copies the event as it was stored. |
Built-in fields
Whatever your shipper sends, every event has four built-in fields that you can filter on:
| Field | Where it comes from |
|---|---|
| source | The ingest key the event arrived on, shown by the key's source label. You can't set it from the shipper. |
| host | The first of these in the event: host (a string, or an object with name or hostname), hostname, host.name, computer. |
| event_type | The first of these in the event: event_type, eventType, eventName, event.action, action, type, EventID. |
| time | The event's own timestamp, from the first of time, timestamp, @timestamp, ts, eventTime that can be read as a time. ISO 8601 and epoch seconds, milliseconds, microseconds or nanoseconds all work. If none of them can be read, it's the time Huntbase received the event. |
All other fields keep the names they were sent with. Nested objects are flattened to dot paths, so a filter on process.parent.name matches both a nested object and a literal process.parent.name key.
The time range, the volume strip and the paging all use the time Huntbase received each event, not the event's own timestamp. The two are usually seconds apart. If a shipper sends a backlog late, those events appear in the window in which they arrived.
See the query behind a search
Query ▸, at the right of the line under the bar, opens the query your view compiles to, in place, under that line. Nothing else moves: the answer for a value, the results, Fields and your filters stay where they were. The query uses KQL (Huntbase Lake) and runs over the time range in the bar. Search reads its events with that same query, so the text you see is the text that runs.
The query is laid out one stage per line so you can read it. The first stages, which add Search's built-in columns (source, host, event_type, time), are folded away: Show them shows them. Copy copies the whole query, and × hides it again.
Edit as query
Edit as query, next to Copy, puts the query in the editor. Query on the Search / Query toggle does the same, and never opens an empty editor. The page keeps its frame: the editor replaces the search box, and the results, answer, Fields, filters and volume strip stay. A line under the bar says This search as a query. The results below are its results; edit and Run to change them. The query doesn't run again on its own, because the rows on screen are already its rows. The time range moves to the editor's time-range pill, and the run reads the same stores as the search.
Once you edit, the line reads Edited. The results below are still the search’s — Run to see this query’s own. Run then shows the query's own results, with run history, export and everything else a query run has. See Query workspace.
Search on the toggle returns to the same filters, and your edits wait in Query for the next time you switch. A query can't be turned back into filters.
Save a view
Save view asks for a Name, which defaults to a summary of the view, and adds the view to your saved queries. The saved query holds both the view and the query it compiles to:
- Opening it returns you to this view in Search.
- Anything that uses saved queries, such as Schedules, uses the compiled query.
Live tail
Click Live tail to stream new events into the view as they arrive, with your filters applied. New events are highlighted at the top of the list, and the button shows Live. While tailing:
- The results header shows ● Streaming. If more than 50 events a second match, some aren't shown, and the header says how many were dropped. Narrow the view to see them all.
- A tail pauses while its tab is hidden (Paused) and picks up again when you come back. If the connection drops, it shows Reconnecting….
Live tail has two limits:
- Huntbase data lake only. Your own lakes can't be tailed. While the view includes them, the button turns off and explains why.
- One tail per person. If a tail is already open in another tab or window, close it and try again.
A tail keeps checking that you may still see what it streams. If you lose access to an organization it covers, or are removed from it, the tail ends.
When Search can't show everything
Search doesn't let an incomplete view pass as complete. When something is missing, a notice appears above the events:
| Notice | What it means | What to do |
|---|---|---|
| Store name isn't in these results / N lake stores aren't in these results | A lake of your own that the view includes is excluded from federation, for the reason listed. Its events are missing from the counts and the rows. | Fix in Connections opens the store's connection page (with several stores, the Telemetry Overview, which lists each). See In federation, or excluded. |
| This view would scan too much of your lake | Reading the view from your own lake would go over today's scan budget. | Narrow to the last hour, or pick fewer sources. An admin sets the budget; see Capabilities. |
| The data lake didn't answer in time | The lake timed out or is briefly unavailable. | Try again, or narrow the time range to make the read smaller. |
| You can't browse telemetry in this scope | Browsing needs permission to list ingest keys. | Ask an admin, or switch scope. |
If nothing matches, Search checks the last 30 days for the same search. When it finds some, it says how many (14,634 matches in the last 30 days.) and Show 14,634 matches widens the time range to them; otherwise it offers Clear filters.
When you searched for a value and nothing else, an empty result never reads as "clear". The state reads Not found in Huntbase Lake, with the view's own window (for example Not found in Huntbase Lake, last 24 hours), says what was searched, adds Nothing in the last 30 days either. when the 30-day check also came back empty, and names what wasn't checked, for example Searched Huntbase Lake only, the last 30 days. Your 9 connected tools and threat intel weren't checked. It offers Look up in entities & intel, Search N connected tools, Ask Scout and Clear search. When the answer for a value is already on top, it has checked threat intel, so the empty state doesn't offer that again. If nothing arrived in the window, it offers Look at the last 24 hours. With no sources at all, Set up a source takes you to Telemetry › Sources.
From the Telemetry page
Search is one place: a Search tab in the Explorer. The Telemetry page checks
that your sources are sending; to look at the events, Search events in its
header opens Search on every source, and View events on a source opens it
on that source. Old links to /telemetry/browse open the same Search tab, with
their view.
Every way into Search opens on the same window, the last 24 hours: a new Search tab, the command palette, and the Telemetry page's links.
On a phone, the search box takes the whole first line of the bar, and the time range, Ask Scout and Live tail sit on the line below.
Search test data
The source picker also lists public attack recordings and baselines from the test lake, in a Test lake group. Pick a dataset, or click Open in Explorer on its page, to search it like your own telemetry, on the dataset's own clock. A view reads either test datasets or your own sources, never both, and a Test data banner shows above the events. See Open a dataset in Explorer.
Next steps
- Telemetry: check that each source is sending, and fix the ones that aren't
- Data lake: mint an ingest key and configure your shipper
- Scout and your telemetry: ask Scout about the view you're looking at
- Hunts: pin a view to a hunt as evidence