Threat reports
Threat reports turns a published threat report — a vendor blog post, a DFIR write-up, a partner bulletin or a plain list of indicators — into something you can act on. Huntbase reads the whole report, pulls out its indicators, techniques and vulnerabilities, checks them against your organization, and lets you hunt it in one click.
Threat reports are part of Intelligence, which is in beta. Access is by request, so it may not be enabled for your organization.
Open it from Threat intel › Threat reports in the new navigation, or from the Reports tab of Intelligence in the classic menu. The list shows each report with its TLP marking, status and the date it was added, newest first.
Add a report
There are two ways in:
- Select Add report. Choose Link and paste the Report link, or choose Paste text and paste the article or one indicator per line (defanged values such as
evil[.]comare fine). Pasted text is kept in your organization as TLP:AMBER unless you say otherwise. Select Read report. - Paste a report link into the ask box on Explorer. The intent line offers to "Read the whole report and check it against your organisation", and pressing Enter opens the report's card.
While Huntbase reads, the page says "Reading the report and checking it against your organisation…". If the page behind the link can't be read, you're offered Paste the text instead.
The Report card
Each report opens as a Report card: one page that says what the report is, whether it touches you, and what to do about it.
Header. The publisher, when it was added, Open source (the original page), the TLP marking and the status: New, Checked, Hunted, Watching or Not relevant. A line gives the size of what was read, for example "Read in full · 4,200 words · 38 indicators · 12 techniques". An excerpt from the report is labelled From the report · not checked against your data.
Actions. One row, with one filled button:
| Action | What it does |
|---|---|
| Hunt this | Starts a hunt from the report (see Hunt a report). Once the report has been hunted, Open hunt becomes the filled button and Hunt this starts another. |
| Look back | Opens Look back with the report's included indicators. |
| Watch for this | Creates a watch list named "Report: title" from the included indicators, at the report's TLP, so future sightings alert. It then reads Watching. |
| Ask Scout about this report | Asks Scout about the report in a chat. |
| ⋯ | Copy indicators (defanged), Mark not relevant (or Mark as relevant) and Delete report. |
Relevant to your organisation
What the report means for you, stated plainly:
- Whether any of its indicators were seen in your estate, for example "Seen in your estate: 2 of 38 indicators have sightings." A report with no sightings never reads as clear: it says "No sightings yet for these 38 indicators. Run Look back to search past telemetry."
- How many of its indicators your intel feeds already know.
- The products it names that you have connected, and the ones you haven't.
- What can't be checked, and why, for example "Can't check 15 domains: no DNS or proxy logs connected".
Built from this report
Hunt playbooks in your Library that cite the same report, with their place in a series ("Part 1 of 3 · …").
Indicators
The report's indicators, grouped by the section of the report they came from, with filter chips by kind (IPs, Domains, MD5, SHA-1, SHA-256). Each row shows:
- the intel verdict, linked to the indicator when your feeds know it (otherwise No intel);
- Seen ×N when it has sightings;
- Can check · N (hover for the connections that can search it) or Can't check here.
Untick a row to leave it out of the hunt, the look back and the watch list; the choice is saved with the report. Values from sections that are only possibly related are shown last and left out of the sweep.
Techniques and vulnerabilities
Techniques lists the ATT&CK techniques the report names or describes — techniques Huntbase inferred from the text are marked as such — with its coverage state (Watching, Hunted, Can see or Blind), gaps first. Each technique opens its technique page, and each row has Hunt this and Watch for this for that technique. Vulnerabilities lists the CVEs it mentions.
Hunt a report
Hunts are rolling out and may not be enabled for your organization yet.
Hunt this creates a hunt and opens it:
- It is titled after the report, and its description cites the report's link.
- Its hypothesis names the report, how many indicators it carries and the techniques it names, and it carries those ATT&CK techniques.
- It starts with one Indicator sweep cell that searches for any of the report's included indicators.
The hunt is linked back to the report, so the card shows Open hunt from then on. See Hunts.
Next steps
- Indicators — look back and watch lists in detail
- Threats — the actors and malware behind a report
- Hunt playbooks — reusable hunts built from reports