Skip to main content

Activity map

The Activity map shows what happened on one endpoint over time: a lane per data type, the process tree around any process, and that process's events. It reads the endpoint's local event store, so it can go back as far as retention allows, and it can follow the endpoint live.

It is part of Investigate and appears where Investigate is enabled.

Open the activity map​

  • On an endpoint's page, open Investigate › Activity map.
  • From a timeline row, a look-back hit, a hunt match or a detection, click Activity map (or Open activity map). The map opens on that endpoint's page, centred on the process and the moment you came from.
  • Endpoints › Investigate › Activity map asks you to choose an endpoint, then opens its tab.

The link carries the process and time (?tab=activity-map&guid=…&at=…), so you can share it with someone who has access to the fleet.

How long a read takes​

The swimlanes, the process tree and the process panel are read from the endpoint, not from Huntbase. The endpoint answers at its next check-in, and endpoints check in about every 60 seconds. So the first read of a window or a process can take up to a minute or so.

  • While a read waits, the panel shows that it's waiting for the endpoint's next check-in instead of an error. It fills in on its own when the endpoint answers.
  • With a live response session open on the endpoint, reads don't wait for a check-in and come back much faster. Choose Respond › Start live response in the endpoint page's header if you plan to explore for a while.
  • If the endpoint hasn't checked in for 15 minutes, the tab shows Endpoint offline — last seen … and doesn't query it. Click Query anyway to ask at its next check-in. The Event timeline tab works the same way.
  • If a read is still waiting when the endpoint goes quiet, it finishes after the endpoint checks in again. Click Ask again or Retry to read again.

Swimlanes​

The top of the map counts events per data type over time: Process, Network, File, Login, Persistence, Scout action and Detection.

  • Pick a window: 15 m, 1 h, 6 h, 24 h or 7 d. Opened from an event, the window is the hour around it.
  • Drag across the lanes to zoom into a span. Zoom out goes back one step.
  • Click a bar to list that bucket's events, for that data type, in Events below. Show all clears the selection.

If the endpoint hasn't answered in full, a note says the counts are partial. Click Ask again.

Process flow​

Pick an event that has a process, in Events or in the timeline, to map its process tree: its parents up to the root and a few generations of children.

Each process shows its name and pid, the user, when it started and ended, small counts of its events by type, and a red mark with the number of detections. Click a process to open its panel.

  • +N on a process loads more of its children.
  • Flat draws the tree as cards. Isometric draws it as a 3D view, with the root at the bottom right and the tree rising to the top left. Labels stay upright, a red ring marks a detection, and hovering shows the details. Click, select, expand and pan or zoom work the same in both. Zoom to fit fits the tree to the view.
  • Activity is the legend for the event colours.

If the endpoint hadn't answered in full, or the tree hit its size limit, a note says so. Ask again reads it again; +N loads the rest of a branch.

Follow the tree​

Double-click a process to follow the tree from it. With the keyboard, focus the process and press Enter. A single click still opens the process's panel.

  • Children that aren't loaded yet load first. This applies when the process is at the edge of the map, or when some of its children are in a stack. Each double-click brings in up to 12 more, and they leave their stack.
  • Otherwise the map re-centres on that process. It reads the process's parents and a few generations of its children again.
  • To walk further up, double-click the topmost process. Double-click the centre process to move up to its parent. If the endpoint has no record of an earlier parent, a message says so.
  • Back in the map's toolbar returns to the previous centre. The breadcrumb next to it lists earlier centres; click one to go straight back to it. The browser's Back and Forward buttons move through the same centres.

A dashed line to a parent means the endpoint wasn't sure of that parent when the process started. That happens, for example, after Scout restarts. Huntbase matched the parent by its process id and start time instead.

Wide trees​

A parent with many children, such as a web server or a shell loop, shows its first 12 children. The rest are grouped by program, as a stack labelled with the count and the name (for example 388 × ssh), with a small chart of when they started, how many are still running and any detections.

Click a stack to open its list. It loads 100 children at a time as you scroll.

  • Search by pid, user or command line.
  • Only program lists the children running that program; switch to All children for every child of the parent.
  • Map, or a double-click on the row, re-centres the map on that child.

The process panel​

The panel shows the selected process's Path, Command, SHA-256, user, start and end, and its Children. Below that come its events, grouped by data type. The map shows a few events per process; the panel loads the selected process's full list. If the endpoint hadn't answered in full, the panel says there may be more events.

  • Map from here re-centres the map on this process.
  • Open in timeline opens the endpoint's Event timeline around the process's start.

Arrange the map​

The map has three areas: Histogram (the swimlanes), Process tree and Events. Each area's header has buttons to fold it, maximise it or restore it, and each area can be resized.

  • Fold: the arrow at the right of the header folds the area down to its header, and clicking it again opens the area. You can also double-click an empty part of the header.
  • Maximise: this button makes the area fill most of the window and folds the other two. Click it again, or press Esc, to put the map back as it was. Opening a folded area also leaves the maximised view. A maximised process tree re-fits so the whole tree stays in view.
  • Resize: drag the bar along the bottom edge of an area to make it taller or shorter. You can also focus the bar and use the ↑ and ↓ arrow keys; hold Shift for bigger steps. The process tree re-fits to its new size unless you've panned or zoomed it yourself.
  • Process details: the process panel sits to the right of the tree. Hide details / Show details in the Process tree header hides or shows it. Drag its left edge to make it wider or narrower, or focus the edge and use ← and →. On narrow screens, the panel sits below the tree instead.

Huntbase remembers your layout in this browser, separately for Activity map, Live activity and Event timeline. The Event timeline's events table and its process tree panel work the same way. If someone else signs in on the same browser, they start from the default layout.

Live activity​

Live activity adds events to the map as they happen. It needs an open live response session on the endpoint, so it sits with the endpoint page's other live tools.

  1. On the endpoint's page, open Live response › Live activity, or click Watch live on the activity map.
  2. If no session is open, the map shows Live activity streams over a live response session. Click Start live response. Streaming starts as soon as the session is live.

The window moves to the last 15 minutes and new events arrive every 2 seconds. They are added to the swimlanes, the tree and Events, and new processes are highlighted. The status shows how many events have arrived and when the last read was.

Switching Live off pauses the stream; leaving the tab stops it. If the session ends, the status shows Session ended. If you have too many endpoint sessions open, the stream pauses until you close one (for example in Console).

Permissions​

The activity map runs queries on the endpoint, so you need to be allowed to run commands on the fleet's endpoints: an admin of the connection, or a Responder grant. See Investigate permissions.

Next steps​