Search telemetry
Search shows the raw events your log shippers send to Huntbase. Type a value or a field:value filter, or click values in the results to filter by them. Huntbase writes the search as a query, so you can open the exact query behind what you see, run it, save it, add it to a hunt or schedule it.
Search is a query language, Search (Huntbase Lake). It reads the telemetry that arrives through telemetry ingest keys, which all send to the Huntbase data lake. A view can also include your own lakes, which Huntbase reads but never sends to. It needs no connection. In a query tab, a Search / Query toggle at the left of the bar switches between the search and the query it compiles to. It's also the Browse tab of the Telemetry page. See Browse on the Telemetry page.
This feature is currently rolling out and may not be enabled for your organization.
Start a search
| From | How |
|---|---|
| A new tab | Where new tabs are available, click +, pick Query, and choose Search (Huntbase Lake), the first entry in the language pill. A new Query starts on it. Type your search and press Enter. You can also type /search or /browse and a space at the start of the input. In Auto, a single value such as an IP, hash or host, or text with field:value filters, goes to Search on its own. |
| The ▾ next to + | Choose Search telemetry. Without new tabs, the tab bar's + menu has the same entry, and it opens on every source for the last hour. |
| The command palette | Press ⌘K / Ctrl+K, type a value, and pick Search telemetry for "…". It searches every source over the last 24 hours. |
| A query tab | Click Search in the mode toggle at the left of the bar. |
| Telemetry | Click the Browse tab, View events on a source or an issue, or Browse on a destination. These open Browse on the Telemetry page. See Browse on the Telemetry page. Browse on one of your lakes includes your lakes in the view. |
| A Scout chat | Click Open in Browse on a telemetry result, or Apply filters on a view Scout suggests. See Scout and your telemetry. |
| A hunt | Click Open in Browse on a telemetry view cell. Where available, the tab stays linked to the cell, and Update step saves your changed view back to it. See Telemetry view cells. |
| A saved view | Open a query saved with Save view. It opens in Search, not Query mode. |
Each of these, except Telemetry, opens a tab named Search telemetry, or named after what you searched for. From a new tab, that tab turns into the search in place. A link carries the view, so the tab opens with the same sources, time range and filters. The older /explorer?new=browse links still work and open Query on Search. Search used to be called Browse, and some buttons, such as Open in Browse, still use that name.
Write a search
In a new tab, Search (Huntbase Lake) has its own pills: Scope, a time range (Last 24 hours by default), sources (All sources by default) and Live tail. Type your search and press Enter, or click Search. An empty search shows every event in the time range.
Enter searches the Huntbase data lake only. If you have lakes of your own in federation, a stores pill follows the time range: it reads Lake, or Lake + N when your lakes are included. Pick Huntbase Lake only or Huntbase Lake + your lakes there, or press ⌘/Ctrl+Enter to search them too for this run. The line under the input says what Enter will read, for example Search Huntbase Lake · ⌘↵ also search followed by your lake's name. Searching your lake scans your bucket, so it counts against your organization's daily scan budget.
| You type | It matches |
|---|---|
beacon "cmd.exe /c" | Events that contain every word and quoted phrase. |
-svchost | Leaves out events that contain the word. |
host:WKST-4471 | Events where the field has that value. Quote a value with spaces: process:"cmd.exe /c". |
-user:svc_backup | Leaves out events where the field has that value. |
parent_process:* | Events that have the field. |
-parent_process:* | Events that don't have the field. |
host:web-01 host:web-02 | Repeating a field matches either value. |
10.0.0.5 OR 10.0.0.6 OR "evil.example" | Events that contain any of the words or phrases. Write OR in capitals; lower-case or is just a word. |
@host: @source: @event_type: | The same as host:, source: and event_type:, so a mention works as a filter. |
Everything in a search must match, except a repeated field, which matches either value, and words or phrases joined with OR, which match any of them. OR can't sit next to a field:value or a - exclusion: repeat the field instead. A value that starts with / or : is plain text, not a filter, so IPv6 addresses, URLs and times like 12:30:01 search as you'd expect.
The filters you type appear as chips under the text, so you can check them before you run. If Huntbase can't read the search, the reason appears under the input and nothing runs. Switching to another language keeps your text.
To run the search on a schedule, pick a schedule from the ▾ next to Search. The button then reads Schedule. See Schedules.
A search is a query
A search you start from a new tab is saved as a query, like any other. So it gets what a query run gets:
- The run list, to step back through earlier runs.
- Add to hunt, next to Save view, which adds the search to a hunt as a step. See Add work to a hunt.
- A schedule.
In the tab, the words and filters you typed show as the search and filter tokens. Query in the mode toggle shows the KQL (Huntbase Lake) query the search compiles to. See Show as query.
The bar in a Search tab
In a query tab, the bar in Search mode has the same layout as in Query mode. The language and connection pills are replaced with a source picker, and the editor with a search box.
| Control | What it does |
|---|---|
| Scope | The same scope pill as Query mode. Search shows sources from the organizations in your scope. |
| Sources | All sources · N by default. Open it to pick one or more sources, or Every source. Each source has a status dot. |
| Time range | Last 15 minutes, Last 1 hour (the default), Last 4 hours, Last 24 hours, Last 7 days, Last 30 days, or Custom range…. |
| Search | Type any value and press Enter to keep only the events that contain it anywhere. |
| Ask Scout | Next to the search box. When you've typed a question in the search box, it sends the question to Scout along with the view. Otherwise it asks Scout about the view as it stands. |
| Live tail | Streams new events into the view as they arrive. See Live tail. |
Under the bar is a line that says how many sources the view covers, their current rate (~N events/min) and what the view reads: Huntbase data lake, or Huntbase data lake + your lake when it includes your own lakes. The Save view and Show as query buttons are at the right of that line.
Filter by clicking
A filter is created every time you click a value, and it applies at once. The token is solid, and there's nothing to apply. (In a query on one of your connections, clicked filters wait for Apply instead, because each run goes to the connection. See Filters wait for Apply.)
- Fields tab: the + and − next to a top value include or exclude it. Clicking the value itself includes it.
- An expanded event: the + (Include) and − (Exclude) next to each field.
- Table view: click a cell to keep only events with that value.
Each filter appears as a token under the bar. Include is shown as field = value and exclude as field ≠ value. Has field and Missing filters read field exists and field missing. When you include a second value for the same field, it's added to the existing token (host = web-01, web-02), so the token matches either value. Including a value that you'd excluded moves it rather than contradicting the exclusion.
On each token:
- ⇄ (Switch include / exclude) flips the filter between include and exclude.
- × removes the filter.
Clear all removes every filter, the search and any zoom. It keeps your sources and time range. When there are no filters, the row reads No filters. Click a value in Fields or in an event to add one.
The Fields tab
The Fields tab in the side panel lists every field in the current view. Each field shows its coverage, which is the share of events in the view that have it. Fields are ordered by coverage. Use Find a field… to narrow the list.
Click a field to see its top values with their counts and an estimate of how many distinct values it has (~N distinct). host and event_type are open by default. A field that not every event has also offers Has field, and every open field offers Missing.
The counts cover the whole view, not just the events on screen. For a large view, the field list and coverage are worked out from a sample of the most recent events. The note at the bottom of the tab then says sampled and gives the sample size, and so does each open field until its exact counts load. Opening a field always counts its top values over the whole view.
The volume strip
Above the events, Volume charts the view over its time range, stacked by source. Beyond the top few, the remaining sources are grouped under Other sources.
Click a bar to zoom the view to that slice of time. A time token appears with the filters, and Back appears on the strip. Either one returns you to the range you had before. Picking a new range in the bar also clears the zoom.
Events and table
The results header shows the number of events that match the whole view. A number that starts with ~ is an estimate. More events load as you scroll.
| View | Shows |
|---|---|
| Events | One line per event, newest first. Click a line to expand it. |
| Table | One column per field. Click a cell to filter to that value. Right-click a row to add a note to it or to one of its cells, or Add to timeline…. Rows can't be tagged here. See Tags and notes. |
Each line in Events shows the event's time, host and a short summary. For events in the OCSF schema, including those read from your own lake, the summary is chosen by the event's class:
| Class | Summary shows |
|---|---|
| Authentication | The activity, the outcome (Failure in red, Success in green), the user, the source and destination addresses and port, and the protocol |
| Network Activity | The activity, direction, source and destination addresses and ports, and the protocol |
| DNS Activity | The queried name and type, the answers, the response code and the asking address |
| Process Activity | The activity, the process name and command line, the user, the parent process, the PID and the file path |
When you searched for a value, the field it matched is highlighted, or shown first if it wasn't already in the summary. Schema bookkeeping such as metadata.* and class ids stays in the expanded event. The severity chip shows the severity the source sent.
Map appears in Search when results carry a location, such as sign-in events from Okta or Entra ID. Graph isn't available, because Search shows raw events rather than entities. To see entities in a graph, use Show as query or start a hunt.
Act on one event
An expanded event lists every field with Include and Exclude, followed by these actions:
| Action | What it does |
|---|---|
| Show surrounding events | Changes the time range to 5 minutes either side of the event and keeps your filters. Remove the time token to go back. |
| Start a hunt | Creates a hunt named after the event and pins the 5 minutes either side of it, with your current filters, as a telemetry view cell titled Events around the starting event. |
| Ask Scout about this event | Opens Scout in the dock with the event and the view attached, and asks what the event is, whether it's suspicious, and what to look at next. |
| Copy JSON | Copies the event as it was stored. |
Built-in fields
Whatever your shipper sends, every event has four built-in fields that you can filter on:
| Field | Where it comes from |
|---|---|
| source | The ingest key the event arrived on, shown by the key's source label. You can't set it from the shipper. |
| host | The first of these in the event: host (a string, or an object with name or hostname), hostname, host.name, computer. |
| event_type | The first of these in the event: event_type, eventType, eventName, event.action, action, type, EventID. |
| time | The event's own timestamp, from the first of time, timestamp, @timestamp, ts, eventTime that can be read as a time. ISO 8601 and epoch seconds, milliseconds, microseconds or nanoseconds all work. If none of them can be read, it's the time Huntbase received the event. |
All other fields keep the names they were sent with. Nested objects are flattened to dot paths, so a filter on process.parent.name matches both a nested object and a literal process.parent.name key.
The time range, the volume strip and the paging all use the time Huntbase received each event, not the event's own timestamp. The two are usually seconds apart. If a shipper sends a backlog late, those events appear in the window in which they arrived.
Show as query
Show as query switches the tab to Query mode with the query your view compiles to. The query uses KQL (Huntbase Lake), and the time window is set to match. The text you see is the text that runs. Search reads its events with that same query, so Run returns the same events as an ordinary run, with run history, export and everything else a query run has.
A note under the bar reads Built from your Browse filters. Edit freely — Run executes exactly this query. After you edit the query, the note changes to Edited. Going back to Browse starts again from your last filters. A query can't be turned back into filters. If you return to Search after editing, you're back on your last filters, and a notice says so.
Save a view
Save view asks for a Name, which defaults to a summary of the view, and adds the view to your saved queries. The saved query holds both the view and the query it compiles to:
- Opening it returns you to this view in Search.
- Anything that uses saved queries, such as Schedules, uses the compiled query.
Live tail
Click Live tail to stream new events into the view as they arrive, with your filters applied. New events are highlighted at the top of the list, and the button shows Live. While tailing:
- The results header shows ● Streaming. If more than 50 events a second match, some aren't shown, and the header says how many were dropped. Narrow the view to see them all.
- A tail pauses while its tab is hidden (Paused) and picks up again when you come back. If the connection drops, it shows Reconnecting….
Live tail has two limits:
- Huntbase data lake only. Your own lakes can't be tailed. While the view includes them, the button turns off and explains why.
- One tail per person. If a tail is already open in another tab or window, close it and try again.
A tail keeps checking that you may still see what it streams. If you lose access to an organization it covers, or are removed from it, the tail ends.
When Search can't show everything
Search doesn't let an incomplete view pass as complete. When something is missing, a notice appears above the events:
| Notice | What it means | What to do |
|---|---|---|
| Store name isn't in these results / N lake stores aren't in these results | A lake of your own that the view includes is excluded from federation, for the reason listed. Its events are missing from the counts and the rows. | Fix in Connections opens the store's connection page (with several stores, the Telemetry Overview, which lists each). See In federation, or excluded. |
| This view would scan too much of your lake | Reading the view from your own lake would go over today's scan budget. | Narrow to the last hour, or pick fewer sources. An admin sets the budget; see Capabilities. |
| The data lake didn't answer in time | The lake timed out or is briefly unavailable. | Try again, or narrow the time range to make the read smaller. |
| You can't browse telemetry in this scope | Browsing needs permission to list ingest keys. | Ask an admin, or switch scope. |
If nothing matches, Search offers Clear filters. If nothing arrived in the window, it offers Look at the last 24 hours. With no sources at all, Set up a source takes you to Telemetry › Sources.
Browse on the Telemetry page
Telemetry › Browse is the same search, full page: the bar, fields, filters, volume strip, live tail and Save view all work as they do in a query tab. The view is kept in the page address, so a link to it opens the same sources, time range and filters.
Open in Explorer, next to Save view, opens the view in a new Explorer tab. Anything that needs a query tab goes there too, carrying the view:
- Query in the mode toggle and Show as query open the view in an Explorer Search tab. Use Show as query there to get the query.
- Ask Scout opens the view in an Explorer Search tab and sends your question to Scout in its side panel, with the view attached.
Links from chats, hunts and saved views keep opening Search in the Explorer.
Search test data
The source picker also lists public attack recordings and baselines from the test lake, in a Test lake group. Pick a dataset, or click Open in Explorer on its page, to search it like your own telemetry, on the dataset's own clock. A view reads either test datasets or your own sources, never both, and a Test data banner shows above the events. See Open a dataset in Explorer.
Next steps
- Telemetry: check that each source is sending, and fix the ones that aren't
- Data lake: mint an ingest key and configure your shipper
- Scout and your telemetry: ask Scout about the view you're looking at
- Hunts: pin a view to a hunt as evidence