Evidence collections
An evidence collection is a template that gathers files and artefacts from endpoints: an osquery query whose results you keep, or a file collection (carve) that copies a file into your storage destination. You keep them in the Library under Evidence collections (/library?type=collection) and run them against your endpoint fleets.
Evidence collections are not a way to group Library content.
Create an evidence collection
- Open Library › Evidence collections.
- Click New evidence collection (the New button's default action on this page; it is also in the New menu everywhere else).
- Fill in the form:
| Field | What it is |
|---|---|
| Name | What the template is called in the Library, e.g. "macOS file system snapshot". |
| Framework | osquery for endpoint collections. |
| Collects | Query (an osquery query) or File (carve) (a file path to copy from the endpoint). |
| Content | The query, or the path to collect, e.g. /var/log/auth.log. |
- Click Create evidence collection.
Huntbase confirms with Evidence collection saved and opens the new template's panel. Nothing runs until you click Run collection.
New evidence collections show in the list straight away: on this page, Include templates without a connection is on by default, because a template you create isn't linked to a product. Turn it off to see only the templates linked to a connection in your scope.
Edit or delete one
Open the template's panel and use the ⋯ menu:
- Edit… opens the same form with the current values.
- Delete… asks you to confirm, then removes the template with its schedules and run history.
You can edit and delete the evidence collections you or your organisation own. The ones that ship with Huntbase are read-only and have no ⋯ menu.
Run an evidence collection
Click Run collection in the template's panel. The dialog only lists connections that can run it: for an osquery collection, your endpoint fleets (Endpoint Control connections). If you have one fleet, it is selected for you.
If no connection can run it, the dialog says No endpoints can run this collection yet, with Add endpoints, which opens Deploy. File collections also need a storage destination and a reason; see Collect files.