Skip to main content

Watcher health

The Watcher health tab (Intelligence › Watcher health) is the operational view of your organization's watchers. It lists every watcher your organization can run, with whether its tests pass, whether it can fire, how much it fires, how often it's right, and where it is in quarantine or rollout. Use it to test and measure watchers. Use Watchers to switch watchers on and off and tune them.

The watchers themselves are templates in the Library. Browse them, enable one for your organization, customize one into your own watcher or fetch SigmaHQ rules in Library › Watchers. The link at the top of this tab takes you there.

Beta

Watcher health is part of Intelligence, which is in beta. Access is by request, so it may not be enabled for your organization.

The watchers table​

Watcher health follows the organization selected in the scope selector. Under a personal scope the tab asks you to choose an organization.

ColumnWhat it shows
RuleThe watcher's name, where it comes from (SigmaHQ, Hub, Custom for your own, or Huntbase) and its identifier.
BackingHow the watcher is written (Sigma, Cypher or Builder) and the plane it runs on (Stream, Graph, Correlation or Intel).
ATT&CKThe techniques the watcher covers. Select a technique to show only watchers for it.
TestsPassed tests out of the total, No tests, or Error if the last run errored.
ReadinessWhether the watcher can fire: Armed, Needs data (the data it needs isn't arriving) or Check unavailable. Hover for the detail.
ModeOn, Shadow or Off in this organization. Quarantined appears when the watcher is being held in shadow because it fired far too often (see Quarantine). Promote appears when a shadow watcher looks ready to switch on.
RolloutFor a watcher going through automated rollout, the stage it's at, such as Shadow or Canary, plus the status when it isn't simply moving along (for example Blocked or Paused).
7d volumeHow many times the watcher fired in the last 7 days. For a shadow watcher, hover to see how much of that went to the daily digest.
PrecisionThe share of the watcher's hunts that were confirmed rather than marked false positive over 90 days. It shows — until there are at least 3 verdicts.
Last firedWhen the watcher last fired, or Never.

The list loads 50 watchers at a time. Select Load more at the bottom for the next page.

Filters​

  • The search box matches watcher names and identifiers.
  • Source, Mode, Rollout, Tests and Plane narrow the list. Each option shows how many watchers it matches. Mode › Quarantined lists the watchers that are quarantined in this organization.
  • Noisy shows watchers that fire a lot.
  • Not ready shows watchers that can't fire because the data they need isn't arriving.
  • A technique you selected in the ATT&CK column shows as a chip. Select it to clear it.
  • Clear filters removes everything except the open watcher.
  • Platform administrators also see an Unpublished switch next to the filters, which includes unpublished catalog watchers in the table.

Filters are kept in the page address, so you can bookmark or share a filtered list. Other Intelligence tabs link here pre-filtered. For example, a threat's uncovered techniques open the watchers for that technique.

A watcher's details​

Select a watcher's name to open its details. Open in Watchers takes you to the same watcher on the Watchers page, where you switch it on or off and tune it. Template opens the watcher in Library › Watchers, where you can read its rule and customize it.

Overview​

  • Fires, fires in shadow and hunts opened over the last 30 days, with a daily bar chart. Lighter bars are days when every firing went to the digest.

  • Precision over 90 days, with the numbers of confirmed and false-positive verdicts behind it. Verdicts come from the hunts the watcher opened.

  • Ready to promote to On when a shadow watcher has been in shadow long enough, fires rarely enough, isn't imprecise and has no failing tests. Otherwise the reason it isn't ready yet. Promoting is still your decision: switch it to On from the watcher's Tuning tab in Watchers.

  • If the watcher is quarantined, a banner at the top explains why. See Quarantine.

Tests​

A watcher's tests are example events it must match and events it must not match. Running them passes each event through the same matching logic the live watcher uses, so a passing test means the watcher really does fire on that event.

  • Run tests runs every test and records the run. The line above the tests shows the last run's result, the rule version it ran against and when.
  • Each test shows Pass, or Fail with what happened instead (matched or did not match), or Error with the reason. Expand Event to see the test's event.
  • For your own (Custom) watchers, Edit tests lets you add, change and remove tests, then Save tests. Each test needs a unique name, an expectation, and an event written as a JSON object of field names and values. Surface is optional and names the data type the event belongs to, such as hb_process_activity.
  • Tests for Huntbase and SigmaHQ watchers are read-only.
tip

Give every watcher at least one must-not-match test. It's what catches a watcher that fires on everything.

Backtest​

Runs the watcher over your telemetry for the last 1, 7, 14 or 30 days without switching anything on. You get two numbers:

  • HKQL count is fast, but only approximates regular expressions and IP ranges.
  • Exact predicate (estimated) runs the live matching logic over a sample of your data and scales it up. The line under it says how many sampled rows matched.

When the two diverge, the page says which one is higher. Expect live volume to be closer to the exact estimate. Sample matches are listed underneath.

Only stream watchers can be backtested. Graph, correlation and intel watchers run over live state, so there's no history to replay.

Convert​

Translates a watcher's Sigma rule into a SIEM query language, for data that stays in your SIEM:

TargetLanguage
SplunkSPL
Microsoft Sentinel / DefenderKQL
ElasticES|QL
QRadarAQL (coming soon)

Choose the target and select Convert. Copy the query, and read any warnings shown under it. If the rule uses something the target can't express, the page names it instead of showing a query. If your organization has a connection that runs that language, Open in Explorer opens the query in a new Explorer tab against that connection. Nothing runs until you run it.

Only watchers built from a Sigma rule can be converted.

Rollout​

The Rollout tab shows where a watcher is in its automated rollout. See Quarantine and rollout.

SigmaHQ rules​

SigmaHQ rules are never shipped by Huntbase. An organization admin fetches them into the organization, after accepting the Detection Rule License (DRL) 1.1, from the SigmaHQ rules card in Library › Watchers. Each fetched rule becomes a watcher and shows here with source SigmaHQ.

Next steps​