Deploy a watcher to your SIEM or data lake
A Sigma watcher can run in more than one place. Huntbase checks the data it receives as it arrives. If some of your events stay in a SIEM or log store, such as Splunk, Microsoft Sentinel, Defender, Elastic or Axiom, you can also deploy the watcher there. Huntbase then converts the rule for that store, searches it on a schedule, and raises a detection for each match.
Each place a watcher runs is a deployment. One rule can have many deployments, and they all stay on the same version of the rule.
If a watcher's Deploy tab shows only Runs in: Huntbase only, deploying to stores isn't switched on for your organisation yet.
Open the Deploy tab
Open a watcher and select the Deploy tab. It has two parts:
- Runs in lists where the watcher runs: one row per deployment.
- Response holds what the watcher does when it matches in this organisation: its state (Off, Shadow, On), When this fires, the severity floor and the hunt mode. These used to be on the Tuning tab.
Graph watchers show their Feeds here instead. See Graph watchers: what feeds them.
The stores list
Each row shows:
| Part | What it shows |
|---|---|
| Where | Huntbase (in-stream, on the data Huntbase receives), or a connection with its dataset, for example Axiom (prod) · Dataset edr-logs. A connection you can't see reads A connection you can't see. |
| Status | A chip. See Statuses. |
| Version | v4, current, v3, behind v4, or Not converted yet. |
| Schedule | For a store, how often it is searched, for example Every hour, 2 h window. |
| Last run | When the store was last searched, or Not run yet. In-stream rows say Checks each event as it arrives. |
| Matches | How many rows matched in the last run, or Matches: not recorded. |
| Store verdict | Shown when Huntbase can't re-check the rows this store returns. See One detection, many stores. |
If nothing is listed yet, the watcher still runs on the data Huntbase receives while it is Shadow or On. The list says so; it never claims the watcher runs nowhere.
Select Show removed to see deployments you removed. Their history is kept.
Add a deployment
- On the Deploy tab, select Add a deployment.
- Under Where, choose Huntbase (in-stream) or one of your organisation's connections. Connections that can't take a deployment are greyed out and say why, for example Not supported yet or Switched off. Connections that only receive scheduled results are not listed; the dialog says how many.
- Choose a Dataset: the index, dataset or table that holds the events. Some stores need one. For others you can leave it empty.
- Choose a Mode: Shadow (the default) or On. A deployment is never more On than the watcher itself in your organisation.
- Read the Converted query preview and any warnings. Check it can run checks access, language and credentials. It doesn't search your data.
- Select Add deployment.
The row shows Setting up while Huntbase converts the rule and checks it. It then shows Running or Shadow, or Can't run here with the reason.
You need permission to manage watchers, and permission to use the connection.
Suggested stores
Below the list, Could also run on lists stores whose field mapping covers the rule:
- When Huntbase doesn't receive this rule's events, the store is suggested: it is the only place the rule can see them.
- When Huntbase already receives them, the store is optional. Add it only to cover data that isn't forwarded to Huntbase.
Select Deploy on a row to add it in Shadow. Nothing is deployed until you press Deploy. Can't run on lists stores whose mapping can't express the rule, with the reason, for example Can't run on Sentinel: missing ScriptBlockText.
Statuses
| Status | What it means |
|---|---|
| Setting up | Added, but not converted and checked yet. It is not running until it shows Running or Shadow. |
| Running | Converted at this version and running. |
| Shadow | Running in shadow: matches go to the daily digest and nobody is notified. |
| Off | Set to Off here, so it doesn't run. |
| Behind (v3 → v4) | The rule or its field mapping changed. The old query keeps running until the new one is ready. |
| Can't run here: missing X | The store has no column for a field the rule needs, or its language can't express part of the rule. It is not running here. See Field mappings. |
| Failing | The last runs failed. The row shows the last error. The next good run puts it back to Running. |
| Paused: budget | This connection used its queries for the hour. It starts again by itself when the hour resets. See Query budgets. |
| Paused | Paused by a person. It doesn't run until someone resumes it. |
| Removed | It no longer runs here. Its history is kept. |
| Unknown | A state this page doesn't recognise. Treat it as not running. |
Change a deployment
- Update to vN appears when a row is behind. It converts the current version now, instead of waiting.
- Pause stops a deployment until you Resume it.
- Remove stops the watcher running there. For a store, Huntbase removes the query it manages there. Detections already raised stay in your Inbox.
When you edit a rule, every deployment shows Behind for a short time, then updates by itself. You don't need to convert anything by hand.
Run now
Run now runs the watcher once, both in Huntbase and on every store it is deployed to. Each half reports what it did, for example:
- In Huntbase: 2 matches in the last day.
- On stores: 1 search started. Matches arrive as detections.
A half that didn't run says why, so it never reads as zero matches.
Scheduled runs work differently. When Huntbase already receives a rule's events, deployments that Huntbase or a content pack added for you hold back and the rule runs in-stream only. Deployments you added yourself always run.
Copy as… or Deploy instead
The Convert tab still turns a rule into SPL, KQL, ES|QL or APL for you to copy. A copy you paste into your SIEM runs there, not in Huntbase. Its matches stay in your SIEM and raise no detections here.
To have Huntbase run the rule on a store, keep it up to date and raise detections, select Deploy instead. It opens Add a deployment on the Deploy tab, with the connection and dataset you chose in Convert already filled in.
Ask Scout
Scout can list where a watcher runs, explain why it can't run on a store, and suggest stores to deploy it to. A suggestion arrives as a card. Nothing is deployed until you confirm it, and confirmed deployments start in Shadow.
Next steps
- Field mappings: why a rule can't run on a store
- Coverage: every watcher against every store
- Push rules into Splunk or Sentinel
- One detection, many stores