One detection, many stores
Your events often live in more than one place. The same Sysmon event can reach Huntbase, Splunk and Axiom. When a watcher runs in all three, you still get one detection for that event, not three.
How it works
Huntbase identifies an event by what describes the event itself, not by where it was read. For example:
- a Windows event by its computer, channel and record number;
- a Sysmon process event by its process GUID, event ID and time;
- a cloud audit event by the provider's own event ID.
When none of these is present, Huntbase uses the fields the rule matched plus the event time, to the second. It merges such copies only when they come from different stores, so two similar events in one store stay two events.
The first copy raises the detection. Each later copy, from another store, is added to it as a source. It raises no new alert and doesn't count towards noise limits.
Events are never merged across organisations, and two different watchers never share a detection.
Seen in
Open a detection's insight. Seen in lists every place the event was found, first seen first, for example:
Seen in: Huntbase stream, Axiom (prod) · edr-logs, Splunk (prod)
| Source | What it means |
|---|---|
| Huntbase stream | Huntbase checked the event as it arrived. |
| A connection, with its dataset | A deployment found it in that store, or a rule pushed into the SIEM raised it. |
| Endpoint query | An endpoint query returned it. |
| Unknown connection | A connection you can't see. |
Seen in is also a health signal. If one store stops reporting what the others see, its data may be lagging.
Detections raised before this feature, and insights not raised by a watcher, have no Seen in row.
Store verdicts
When a store returns a row, Huntbase normally maps it back to the rule's own fields and checks it against the rule again. Only rows that really match raise a detection.
Sometimes Huntbase can't re-check a row:
- a field can't be mapped back exactly from that store;
- the rule was pushed into the SIEM, so the SIEM decided the match;
- the store's copy of the rule is still catching up with an edit.
Then the store's match is taken as the verdict, and the source carries a Store verdict badge: The store's query decided this match. Huntbase could not re-check the row. A source Huntbase checked has no badge.
A store verdict is still a real detection. The badge tells you who decided.