Hunts

A hunt is a hypothesis (“an account created and set to never expire outside a change window is persistence”) turned into a SIEM query, run on a schedule or on demand. Each run produces a report, and what it finds becomes findings.

Garrison ships a library of hunts mapped to MITRE ATT&CK, including account backdoors (T1098), beaconing (T1071), brute force followed by success (T1110), DCSync (T1003.006), first-seen external destinations (T1041), impossible travel (T1078), Kerberoasting (T1558.003), log clearing (T1070.001), new-domain spikes (T1568.002) and recurring indicators.

A hunt

Field
Hypothesis	What the hunt looks for and why it matters
ATT&CK technique	The MITRE technique it maps to
Look back	How many hours of SIEM data each run searches
SIEM connection	One connection, or each connection with a matching query
Scope tags	The hunt only looks at systems with one of these tags. Without a scope it does not run: hunts are never unscoped
Schedule	A cron expression, and Run on the schedule to turn it on
Queries per SIEM dialect	The query for Elastic (query DSL) and for LevelBlue (USM)

Run now runs it at once. The Runs tab lists past runs and their reports. New hunt creates your own.

Tag systems you want hunted as Hunt target (the default scope) under Systems.