Graph watchers: what feeds them
A Sigma watcher matches one event, so it runs wherever that event is: in Huntbase or in a store. A graph watcher connects several things over time, such as a user, the host they signed in to and a process it ran. It runs once, in Huntbase's entity graph, on facts from all your sources.
So a graph watcher has no stores list. Instead it shows what it needs from the graph, which of your sources feed each need, and the gaps.
Graph watchers are written and published by Huntbase.
What it needs
On a graph watcher's Looks for tab, What it needs from the graph lists the kinds of entity and relationship the rule reads, for example Users marked privileged or Processes resolving domains. Each has a chip:
| Chip | Meaning |
|---|---|
| Fed | Facts of this kind reached the graph in the last 7 days. |
| Stale | Facts arrived before, but not in the last 7 days. |
| Not fed | Nothing sends this to the graph. The watcher can't fire. |
| From Huntbase | Huntbase supplies it, for example vulnerability and public threat intel. |
| Mapped | A scheduled query is set up to send it. Huntbase can't measure how fresh relationships are. |
| Can't tell | Huntbase couldn't check just now. It is never shown as fed. |
Feeds are matched on the kind of entity only. Property filters, such as "privileged", aren't checked, and the list says so.
Feeds and gaps
On the Deploy tab, Feeds lists each need with the sources sending it, how and how recently, for example:
Okta via Splunk · entity extraction · hourly · 12 min ago · 120 in 24 h
A feed can be:
- entity extraction from a scheduled query's results;
- detections: matches from Sigma watchers, on any store, become graph facts;
- endpoint results;
- intel sightings;
- Huntbase public data.
A scheduled query that is set up but hasn't sent anything yet reads set up, nothing sent yet.
Gaps are pinned at the top in plain words, for example Can't fire: nothing sends users marked privileged to the graph.
Add a feed
Select Add a feed on a gap. Huntbase lists query templates that could send that kind of fact, from the products you have connected. Each shows the connection, the schedule and what it sends.
Select Open in Explorer to open the query there, then schedule it. Nothing is created from the watcher itself. A scheduled feed counts against the connection's query budget.
Load and limits
The Load line shows how the watcher runs in the graph: Running, Not running, Paused: graph load (paused for every organisation because it put too much load on the graph) or Held in shadow.
An organisation can have a limited number of graph watchers on at once. The Deploy tab shows how many are on, for example 4 of 10 graph watchers on for this organisation. Turning on one more past the limit is refused, and the message says why.