Intelligence
Intelligence is where your threat intel lives in Huntbase. It brings together where your intel comes from, how you search it, how it drives detection, and how well your detections cover the threats that matter to you.
Intelligence is in beta, and access is by request. It may not be enabled for your organization. When it isn't, Intelligence is missing from the menu and links to it open the home page instead. If your organization doesn't have access, the page tells you so and offers Request access.
Open Intelligence
Select Intelligence in the main menu, between Telemetry and Connections. The page has one tab per question:
| Tab | What it answers |
|---|---|
| Overview | What in my environment matches intel right now? Is my intel healthy, and is it relevant to me? |
| Indicators | Search, filter and bulk look up indicators (IPs, domains, URLs, hashes). See where each one was sighted and hunt back over recent data. |
| Threats | Actors, malware, campaigns and reports, each with a relevance score for your organization. |
| Feeds | Shared feeds you can subscribe to, and your organization's private TAXII and MISP feeds, with health and volume for each. |
| Detections | Your detection content: SIGMA and graph rules, with test status, noise rate and whether each rule is live, in shadow or off. |
| Coverage | An ATT&CK heatmap of your live detections and hunts, compared with the techniques of the threats relevant to you. |
Selecting an indicator opens its own page, with its sources, sightings, related threats and detections. The Indicators tab stays selected while you're there.
Filters are kept in the page address, so you can bookmark a filtered view or share a link to it, and the browser's back button returns to the previous view.
Who can see what
Intelligence follows the organization or workspace selected in the scope selector.
- Shared feeds are fetched once by Huntbase and are available to every organization that subscribes to them.
- Private feeds that your organization connects are visible only to your organization. Their indicators are never shared with anyone else.
- Viewing Intelligence needs permission to list watchers. Changing subscriptions, watch lists and detection tests needs permission to manage watchers.
Intelligence and Watchers
Intelligence and Watchers read the same rules. Use Intelligence › Detections to write, test and measure detection content. Use Watchers to see what is enabled, what fired and how each rule is tuned.
Intelligence and Scout
Scout can look up indicators and threats, explain why a threat is relevant to you, propose watch lists and retro-hunts for you to confirm, and brief you on newly relevant threats. See Using Scout with Intelligence.