Coverage
Coverage answers one question: where is each watcher actually running? It is a matrix of your organisation's Sigma watchers against Huntbase and each store Huntbase can search. A watcher only counts as covered when it runs somewhere, not because it exists in the Library.
Open Content library › Watchers and select the Coverage tab, next to Running, All watchers and Catalog.
For an ATT&CK view of your live watchers and hunts, see Intelligence › Coverage.
Read the matrix
- Rows are your Sigma watchers, on or off.
- Columns are Huntbase (in-stream) and each store connection, split by dataset where a deployment or mapping names one.
- Covered says Runs somewhere, Not running anywhere or Not known.
- The last column counts detections over the last 7 days.
- Each column header totals its cells, for example 4 running · 2 can't run.
Connections that only receive scheduled results are never searched, so they have no column. A note above the matrix says how many are left out.
Cells
| Chip | Meaning |
|---|---|
| Running | Deployed and running. |
| Shadow | Deployed in shadow. |
| Setting up | Added, not checked yet. Never counted as running. |
| Behind (v3 → v4) | The rule changed; the store is still on the old version for now. |
| Can't run: missing X | The store's field mapping lacks a field the rule needs. |
| Failing | The last runs failed. |
| Paused: budget | The connection used its queries for the hour. See Query budgets. |
| Paused | Paused by a person. |
| Off | Deployed, but set to Off. |
| Could run here | Not deployed, but the store's mapping covers the rule. |
| — | Not deployed. |
| Unknown | Huntbase couldn't tell. |
Hover a cell for why it has that status, its last run and matches, and its detections in that store over 7 days. Until Huntbase has recorded where your detections came from, that count reads not known yet, never 0.
Act from the matrix
- Select a cell to open the watcher on its Deploy tab.
- Select Could run here, then Deploy here, to add that store in Shadow. Huntbase converts and checks the rule before it runs.
Filter
Search by name or ATT&CK technique, and filter by state, log source, ATT&CK tactic, store and status. The list shows 100 watchers a page.
On a phone, the matrix becomes a list: one card per watcher, one line per store.
Graph watchers
Graph watchers run once, in the graph, fed by all your data. They have their own group under the matrix, with Fed, a number of gaps, or Unknown, and how many of their needs are fed. Fed means every need reached the graph in the last 7 days. Select one to see its feeds. See Graph watchers: what feeds them.
Readiness and coverage
A watcher's readiness chip (Can it fire?) now counts two things: data Huntbase receives, and stores where the watcher runs with a field mapping for its log source. A watcher whose events live only in Splunk is Armed once it runs on Splunk. A deployment that is setting up, can't run, is failing or is paused doesn't count.