Search & Threat Hunting
Ask any question of your endpoint data
Search every table at once for a machine, a program, a CVE, a hash, an address or a domain, then narrow it down. Threat Hunting surfaces the activity that stands out.
Network activity
Connections
Files
Packages
One search box
Searches every table at once
Build conditions
Pick values instead of typing them
Built-in hunts
Suspicious activity no single rule flags
The problem
Why investigations take too long
Is this anywhere else?
Answering a simple question about a hash, domain or program means jumping between several tools.
One search box looks across every table at once and shows each place it appears.
Query languages slow people down
Only specialists can write the queries most hunting tools require.
Pick values from what exists in your tenant and build conditions without writing syntax.
The quiet activity no rule flags
Skilled attackers avoid obvious signatures and blend in with normal activity.
Threat Hunting surfaces the quiet activity that stands out.
01
Search everything at once
Type what you know and see every place it appears across your endpoints.
One box, every table
Search for a machine, program, CVE, hash, address or domain and get results grouped by table.
Conditions, not syntax
Pick values from a catalogue of what exists in your tenant, then add them to the current conditions or start a new search.
Choose the time window
Look at the last 24 hours, 7, 30 or 90 days, or everything kept.
Pick up where you left off
Your last search is restored when you come back.
Network activity
Connections
Files
Packages
02
What you can search
Machines and agents
Every enrolled endpoint and the agent running on it.
Network and web activity
Where your machines connect and which sites they visit.
Files and detections
Files seen on your endpoints and what AIShieldNet found.
Software and vulnerabilities
Installed software, open and fixed vulnerabilities, and exploited software.
Machines & agents
Network activity
Web activity
Files & detections
Software & vulnerabilities
03
Threat Hunting
Built-in hunts surface suspicious activity that no single alert would flag, and link straight to incidents that are already open.
Built-in hunts
Ready-made hunts across your endpoints, with no queries to write.
Historical hunts
Run hunts over past activity to find what was missed at the time.
Linked to incidents
New leads connect to incidents that are already open.
Judge the results
Review each lead with its context and decide what happens next.
Leads
Suspicious execution
FIN-LT-07
Unusual program behaviour
DEV-WS-14
First-time activity
HR-LT-03
New network destination
OPS-SRV-02
AIShieldNet
Built for real investigations
01
Start from any clue and see everywhere it appears.
02
Move from a search result to the machine, detection or vulnerability behind it.
03
Use hunts to find activity that no single rule would flag.
04
Combine with incidents and process trees to tell the full story.
See AIShieldNet on your endpoints
Walk through detection, investigation and exposure management with our team, using your own environment.
