Hunt across your connected data, with context attached
The hunting workbench lets analysts query the sources ThirdEYE is connected to, then pivot into correlation, ATT&CK mapping and enrichment without leaving the platform.
The problem
Hunting starts from a blank query box
Analysts rebuild context by hand: who owns the host, what else did the source IP touch, what technique is this?
Findings do not feed detection
A good hunt rarely turns into a maintained rule or a case.
How ThirdEYE addresses it
Query connected sources
Run ad-hoc queries across the data sources configured for your deployment, with AI-assisted query suggestions.
Add context
Look at related alerts, MITRE techniques, UEBA anomaly scores and threat-intelligence enrichment for the same entities.
Turn a finding into work
Open a case from a finding, or capture the logic as a custom detection rule.
Key capabilities and their status
Status labels reflect what is in the product today.
Threat hunting workbench
An ad-hoc query workbench across connected data sources with AI-assisted query suggestions.
Note: Depends on which data sources are connected. Not separately covered by an automated test in this review.
Behavioural correlation and kill-chain progression
Correlates related alerts (shared source, technique, asset, time window) and tracks multi-stage progression.
MITRE ATT&CK mapping and navigator
Alerts are mapped to ATT&CK techniques and tactics, with a technique drilldown.
UEBA statistical anomaly scoring
Statistical (not LLM-based) anomaly scoring on user and host activity feeds the same alert pipeline.
Threat intelligence enrichment
Indicators are enriched from VirusTotal, AbuseIPDB, Shodan and OTX.
Note: Each provider needs its own API key.
External attack surface monitoring (passive)
Passive recon using Shodan and HTTP-header checks.
Note: Needs a Shodan key for full results.
Where it fits in your environment
What you can hunt depends on what is connected: Elastic, Splunk, Wazuh, agents or webhook-fed events. UEBA scoring is statistical rather than model-based.
Scope to know about
- Query results are only as broad as the connected sources.
- The hunting workbench is not covered by a dedicated automated test in this repository.
- Threat-intelligence enrichment needs your own provider API keys.
See a hunt end to end.
Book a walkthrough with the team. We will show the platform end to end, tell you what is production-ready and what is not, and discuss how it would sit next to your existing SIEM.