Aegis
// Investigation

Hunt console

Structured search across the normalised event store. Terms combine with AND; prefix a value with ! to negate it.

aegis — hunt consoleREADY
Try

Query reference

Every term is bound as a parameter, never concatenated into SQL.

Identity and infrastructure

  • user:jsmith
  • host:WIN-DC01
  • ip:185.100.200.50
  • dstip:10.0.0.5
  • source:"Palo Alto"

Activity

  • type:AUTHENTICATION_FAILURE
  • process:powershell.exe
  • cmd:-enc
  • parent:winword.exe
  • action:deny

Scope

  • severity:CRITICAL
  • country:Pakistan
  • city:Lahore
  • last:24h

Saved hunts

Start from a known pattern.