Auto Retro-Hunt
Automatically match newly-landed threat-intel indicators against your historical logs with retro-hunt rules.
Auto Retro-Hunt
A retro-hunt rule automatically matches newly-landed threat-intel indicators against your historical logs. When a feed publishes an indicator today, the rule answers the question a scheduled forward-looking detection can't: was this already in our logs three weeks ago?
Hits are first-class detections — they flow through the normal alert and case pipeline like any other detection match.
Prerequisite: threat-intel feeds must be syncing via the enrichment marketplace — e.g. ThreatFox, URLhaus, MalwareBazaar. A retro-hunt rule with no feed data has nothing to hunt.
Creating a retro-hunt rule
Create the rule in the rules area, like any other detection rule. A retro-hunt rule is configured with:
| Setting | Meaning |
|---|---|
| Feeds | Which threat-intel feeds to hunt indicators from — specific feeds, or all |
| Artifact types | Which indicator types to match: ip, domain, hash, url |
| Lookback window | How far back in your logs each indicator is hunted (default 90 days, max 365) |
| Schedule | Cron expression controlling how often the rule runs |
| Max indicators per run | Cap on indicators hunted in a single run |
How it works
Each run:
- Computes the delta of indicators newly landed since the last run, tracked by a watermark.
- Hunts only those indicators across your logs over the lookback window.
- Emits hits through the standard signal processor — the same path as every other detection.
Re-running never re-alerts on already-hunted indicators: an indicator is hunted once, when it lands. If a run exceeds the per-run cap, the overflow carries over to the next run and is recorded on the run — nothing is silently truncated.
Run history
Each run records the number of indicators processed, the hits it produced, and any truncation (overflow carried to the next run). Use it to confirm the rule is keeping up with feed volume.
Lifecycle
A retro-hunt rule consumes indicators as it hunts — its watermark advances regardless of mode. In Live mode the rule bakes in and records hits without alerting on the historical backlog it works through. Promote it to Alerting for go-forward alerts on newly-landed indicators — or create the rule directly in Alerting if you want alerts on the current backlog too.
See detection rule modes for how Staging / Live / Alerting behave in general.
Relationship to the | retro command
The interactive | retro search command is the manual, one-off version of the same engine: you bring an indicator and sweep history on demand. A retro-hunt rule automates that sweep for every new indicator your feeds deliver.