Exabot Hunt

AI threat hunting that turns new research into verdicts

Exabot Hunt reads new threat research, reasons out the attacker's TTPs, and builds an ad-hoc detector to test each hypothesis against your telemetry. Every hunt ends in a verdict, including the gaps it couldn't check.

Request demo

Exabot Hunt result for GlassWorm-linked extensions on the VS Code Marketplace and Open VSX: a high-severity hunt marked needs investigation, with four top findings, the affected user and device, and 44 IOC matches

Trusted by leading security teams

Hunt the attacker, not the indicator

New research lands every day, and IoC lists go stale within days. Exabot Hunt reasons from each report to the attacker's behavior, searches your telemetry for it without anyone writing a query, and tells you when a clean result only means the telemetry was missing.

Flowchart of how a hunt runs: a new threat report is checked for whether it is huntable. If not, it is triaged out. If so, a hypothesis is written (actor, behavior, location, evidence), one detection is built per hypothesis, the hunt runs against your telemetry, findings are triaged like any other alert, and a verdict is reached.

Hypotheses tested against the right data

For each hunt, the Exabot reasons about why the threat applies to your environment, works out which logs or configuration data can prove or disprove it, and filters out known-benign activity before testing what remains against the hypothesis.

Exabot Detect explaining how a hunt was analyzed: triage of the article into a Compromise Hunt with a hypothesis, then finding out which endpoint and proxy telemetry exists to test it.

An ad-hoc detector for every hunt

For each hypothesis, Exabot Hunt builds an ad-hoc detector and tests it against your telemetry. What each hunt finds, and what it rules out, adds up to threat intelligence unique to you.

Threat Center impact rate chart: hunts over the last 30 days by verdict, mostly not impacting, with a few needing investigation and some benign.

Verdicts that show where coverage ends

Priority reflects what was found in your environment, not the campaign's headline severity. Every malicious call cites its evidence, and missing telemetry is reported as not checkable.

Exabot listing the coverage gaps a hunt reported: workflow file contents, commit messages, GitHub Actions run logs and runner-level egress telemetry, and why each one matters.

Your sources, your leads

Choose the intel sources that matter for your industry and geography, run the same in-depth hunts from your own leads, or simply ask in plain English. Exaforce MDR runs the same hunts for managed customers.

Hunt settings: intel sources toggled on for CERT and government advisories, vendor threat research and security news, scoped to healthcare in North America, and a plain-English lead typed in to start a hunt.

Featured hunting capabilities

Purpose-built to turn new research into verdicts you can act on.

Curated intel sources

Pick the research feeds that fit your industry and geography, and Exabot Hunt turns each new report into hunts against your telemetry.

Hunt from your own lead

Start a hunt in plain English, with no query language needed. Exabot Hunt reasons out the hypotheses and tests them for you.

Exposure and impact assessment

See whether your environment is in the threat's path and whether the threat is actually present, with a confidence level for each verdict.

Promote hunts to cases

Ask Exabot to turn any hunt into a case. It drafts the case from the hunt’s findings and evidence, then waits for your approval before creating it.

With Exaforce's Exabots, we've accelerated detection, threat hunting, response, and investigations while expanding coverage without adding headcount. Our team uses Exabot's natural language search to get actionable answers about security events and security posture in a single tool instead of juggling disparate interfaces and query languages. Exaforce has become a high-trust partner, and the platform has transformed how we run security operations.

to disprove a suspected AWS account compromise mid-incident: ~15 seconds
for SIEM, MDR, correlation, and threat hunting: 1 platform

Frequently asked questions

Do analysts need to know a query language?

No. Analysts hunt by asking in plain English across identity, cloud, endpoint and SaaS, and Exabots write and run the queries.

Isn't this just IoC matching?

No. Each hunt is minutes to hours of agent research, not a single lookup, and indicators are only a starting point. Exabots reason to the attacker's patterns and TTPs and build a detection for each hypothesis, so hunts still find activity after the IPs and hashes change.

What happens to a hunt's findings?

Each one becomes threat intelligence about your own environment: a verdict on whether the campaign reaches you, the evidence behind it and every investigation step. If a hunt needs follow-up, Exabot can turn it into a case.

What if we don't have the data to check a threat?

The verdict says so. A coverage gap is reported as "not checkable", never as "not present", so you know exactly where visibility ends.

Where does the threat intelligence come from?

Exaforce curates research papers, vendor research, CERT advisories and security news, and you choose the sources that matter for your industry and geography. Sources are only the starting seed: Exabots identify the TTPs and IoCs themselves as part of each hunt. You can also seed hunts with your own leads.