Hunt status ↗

Hunts consist of searches across multiple endpoints and those searches can take time to return results from all of the targeted endpoints. To view the status of all of the searches contained within a hunt, go to Investigation & Response → Forensics. From the investigations table, click the investigation link. From the Collections tab, select Hunt and from the Status column of the hunt, click Actions. This launches a new browser tab displaying the Actions table. Within the Actions table, you can scroll or use the filters to see the status of any search within a hunt across any of the targeted endpoints.

Using this information, you can identify the successful and failed searches and take the necessary action in Cortex XSIAM.

FieldDescription
Endpoint nameAgent hostname.
Endpoint IDAgent unique ID.
Action IDA unique identifier for the agent action.
NameName of search.
Status

Shows one of the following statuses of the search:

  • Pending
  • In progress
  • Completed successfully
  • Failed
  • Timeout
Artifact category

Name of category for the search.

Example: Process execution

Artifact

Artifact targeted by this search.

Example: Amcache

ResultsNumber of results received for the search.
Last updatedLatest time results were received for this action.
Parameters

The string that describes the search parameters.

Example: C:\Users* File Name Regex: *.exe

Creation timeTimestamp when the search was created.