retro

Sweep an indicator of compromise (IOC) across your entire log history and render a prevalence-weighted hunt summary. Pairs with the ioc search term to answer "have we ever seen this, and how rare is it here?".

Description

The retro command runs a full-history, prevalence-weighted IOC sweep and renders an interactive hunt summary — not a raw row dump. It is designed for the moment a fresh indicator lands (from a threat report, a feed, or an incident) and you need to know whether it has ever touched your environment, when, where, and how unusual it is.

retro is almost always paired with the ioc search term, an observable-anywhere filter that matches a value across every observable column at once, so you never have to name the field. Together they answer the core retro-hunt question: given this indicator, show me the whole story across all retention.

By default, retro searches full retention — you do not need to set earliest=. Instead of a flat table, it renders an interactive page summarizing first/last seen, hit counts, matched fields, affected hosts, top entities, and a prevalence verdict that tells you whether the indicator is rare (and therefore interesting) in your environment.

The ioc search term

ioc = <value> is a search term, not a piped command. It matches the value across all observable columns simultaneously, so the analyst never specifies which field the indicator might appear in. Covered observables include:

• Network: src_ip, dest_ip, dvc_ip, device MAC, device host
• Web/DNS: url, url_domain, DNS query, DNS answers
• Files/Processes: file_hash, process_hash
• Identity: user_id, email sender/recipient and their domains
• Detection context: cve, rule_id, signature_id

The term is profile-aware: it resolves to UDM columns by default, or to OCSF columns (for example src_endpoint.ip, file.hashes.sha256) when the OCSF profile is enabled.

ioc is reusable on its own in a normal time window — it does not require retro:

ioc=1.2.3.4 | stats count by src_host

Bare hashes, IPs, and domains work unquoted. Only quote a value if it contains special characters; a leading digit alone does not require quoting.

Forms

Feeds accepted by ioc in <feed>(…): threatfox, misp, otx, feodo, abuse. Feed lookups pull live indicators from nano's enrichment pipeline, so a campaign sweep stays current without manually maintaining the indicator list.

Syntax

<ioc search term> | retro [by <asset|user>]

Optional Arguments

by Syntax: by <asset|user> Description: Roll the sweep up to the asset or identity model instead of summarizing by indicator. Resolves matches to nano's asset/identity model and sorts oldest-first-seen — the IR isolation/response list. Values: asset, user Default: none (summary or campaign view, depending on the ioc form)

Views

retro renders one of three views. The view is chosen by the shape of the ioc term, and you can switch between them with the in-product view switcher:

Prevalence verdict

Every indicator in the result carries a prevalence verdict derived from how widely it appears across your hosts. This reuses nano's existing prevalence data, so no extra computation is required at hunt time:

In the campaign view, indicators are sorted rarest-first so the most actionable hits surface immediately.

Examples

Sweep a single IP across all history

ioc=185.220.101.45 | retro

Renders the summary view for one IP: when it was first and last seen, how many hits, which observable fields matched, and how rare it is across your hosts.

Sweep a file hash

ioc=44d88612fea8a8f36de82e1278abb02f | retro

A SHA-256 (or other hash) matches against file_hash and process_hash at once, so you catch the indicator whether it appeared as a written file or an executed process.

Sweep a campaign indicator list

ioc in [185.220.101.45, evil-c2.example, 44d88612fea8a8f36de82e1278abb02f] | retro

Renders the campaign view, ranking the supplied indicators rarest-first so the most unusual hit in the set leads.

Roll up matches by asset for incident response

ioc in [185.220.101.45, evil-c2.example] | retro by asset

Resolves matches to the asset model and sorts oldest-first-seen — the hosts to isolate, in the order they were first touched.

Sweep every IOC in an internal lookup table

ioc in lookup("threat_iocs") | retro

Pulls all indicator values from the threat_iocs lookup table and sweeps them across full retention.

Hunt a threat-feed campaign, rolled up by user

ioc in threatfox("apt29") | retro by user

Pulls APT29 indicators from the ThreatFox feed and rolls matches up to the identity model, oldest-first-seen.

Notes

Full-retention default: retro searches your entire log history by default — you do not need to set earliest= or use the time picker. It is built to answer "have we ever seen this," not "what happened in the last hour."

Interactive page, no histogram: retro renders an interactive hunt summary rather than a row table or time histogram. Drill into an indicator to see its underlying events, or drill into an entity (asset/user) to pivot to that entity's events.

Entity resolution: the by asset and by user rollups reuse nano's asset and identity model, the same resolution used by asset and resolve_identity.

Prevalence reuse: the rare/uncommon/common verdict reuses the existing prevalence data computed at ingest — see prevalence for the underlying scoring.

Related Commands

• asset - Asset investigation view with identity resolution
• resolve_identity - Resolve IPs to hostnames/users
• prevalence - Filter or enrich based on artifact prevalence
• lookup - Enrich with internal lookup tables (and the source of ioc in lookup("…"))
• inputlookup - Read an internal lookup table or fetch an external URL