Skip to the content

Detections, findings and threat hunting

Rules with fixtures, one ranked queue, and an analyst agent that can only suggest.

In the adminFindingsRiskEventsHuntDetectionsIndicators

Run the rules

quilzo detect pack install    # the rules that ship
quilzo detect test            # every rule against its own fixtures
quilzo detect run
quilzo sigma import ./rules   # bring your own, in the open standard

The Detections screen listing rules with what each reads and its ring — Rules, and what each has been worth.

A new rule can run in a trial ring before it reaches the queue (quilzo detect ring RULE trial). quilzo detect replay runs every rule over the events people have already ruled on, so a change that would have missed something is caught first. Suppressions end on a date.

Work the queue

The Findings screen ranked by severity, with critical findings at the top — One queue, ranked by severity, age, recurrence and ownership.

To	Run
The queue	`quilzo finding list`
What is open about each person or machine	`quilzo finding risk`
Decide one	`quilzo finding decide ID STATE`
Who decided what, and why	`quilzo finding story ID`
What is rare	`quilzo hunt --field F`
Indicators from STIX, then look back	`quilzo intel import FILE --source NAME`
A model's first pass, as suggestions	`quilzo analyst triage --limit 20`
How often it agrees with people	`quilzo analyst eval --k 3`