Prime Hunt helps security teams analyze security data, assess detection coverage, search for threats, and investigate potential attack activity. You can use Prime Hunt to analyze data from your Data Planes or standalone log files, depending on the investigation.
There are the following processes in Prime Hunt:
Data Audit – During the Data Audit, we automatically analyze log data collected in your Data Planes to determine your MITRE ATT&CK coverage and potential gaps in log sources.
Scan – Scanning involves querying your logs for the selected period with translations of all Sigma rules from the SOC Prime Platform that are relevant to your Data Planes. When running a scan, you can select one of the following scan types based on your objective:
Rules for Alerting – Allows you to discover the best detection rules for your SIEM, seamlessly configure them and deploy to generate low-noise, high-value alerts.
Threat Hunting – Allows you to search and identify threats by automating routine threat hunting tasks and correlating findings with the MITRE ATT&CK framework and CTI.
Content Audit – During the Content Audit, we map your rules and queries to the MITRE ATT&CK framework using SOC Prime AI models.
Attack Chains – To form Attack Chains, Prime Hunt correlates events collected from your Data Plane during a scan around Active Threats. Events that form potential attack sequences are linked into Attack Chains, so you can see activity that may represent a multi-step attack rather than isolated alerts.
Event Analysis (LogTotal) – During Event Analysis, the events from your log file are analyzed against the SOC Prime detection rule dataset. Then matching events are correlated around Active Threats to identify potential attack sequences. Related events are grouped into Attack Chains, providing a connected view of activity that may represent a multi-step attack.