Prime Hunt
Automate retrospective threat search across your security stack – query data where it lives or upload the exported log files.
Trusted every day by teams that defend the world in cyber domain
What’s inside
Six ways to hunt, one workspace.
From auditing what you collect to correlating hits into attack chains, every step runs on SOC Prime’s detection intelligence.
01
Attack Chains
- AI groups related scan hits into chains that may represent a multi-step attack
- Each chain comes with an AI summary, ATT&CK techniques, threat actors, a timeline, and recommended response
- Tune the correlation window (1–24 hrs), the lookback (up to 365 days), and the match threshold to your environment
02
Log Event Analysis – LogTotal
- Drop in a log file (.log, .json, .evtx, .csv and more, up to 4.8 GB) and analyze it without a SIEM connection
- Sanitize hostnames, IPs, credentials, and file paths before anything goes further
- Match events against SOC Prime’s detection rule set and correlate the results into Attack Chains
03
Data Audit
- Map the logs you actually collect to MITRE ATT&CK and see your real coverage
- Find blind spots: techniques you can’t detect because the telemetry isn’t there
- Prioritize what to start logging next, based on evidence instead of guesswork
04
Content Audit
- Auto-map your existing rules and queries to ATT&CK with SOC Prime’s AI models
- Run it against a repository before you connect any SIEM
- See overlap and gaps across your detection library at a glance
05
SIEM Data Scan
- Search your historical data with Sigma rules translated for your platform. No query writing needed.
- Threat Hunting mode automates routine hunts and correlates findings with ATT&CK and threat intel
- Rules for Alerting mode finds the rules that fire in your environment, so you deploy fewer, higher-signal alerts
06
Query Where Data Lives
- API connections to 10 cloud platforms, plus apps for on-prem QRadar, Splunk, Elastic, and LogScale
- Scan up to 5 Data Planes at once
- Exclude noisy rules from future scans, and export scan results as a PDF report
Your data stays where it is.
Query where data lives
No migration. No new pipeline.
Prime Hunt connects to the platforms you already run and searches them in place. Or bring exported log files when a connection isn’t an option.
28+
vendor integrations
10
cloud platforms via API
5
data planes in one scan
4.8 GB
log file upload, no SIEM needed
Works with
We've received your form
Thank you!
Countries
155
Organizations
11,000+
Users
60,000+
Trusted by Enterprise Teams building AI SOC capabilities
Frequently Asked QuestionsFAQ
Prime Hunt is a threat hunting and detection coverage product from SOC Prime. It helps security teams audit their MITRE ATT&CK coverage, search historical log data for threats with ready-made Sigma rules, and correlate findings into Attack Chains that may represent multi-step attacks. It works with connected SIEM, EDR, and data lake platforms (Data Planes), or with standalone log files.
Prime Hunt connects through API integration to 11 platforms. Cloud: Microsoft Sentinel, Microsoft Defender for Endpoint, Elastic Cloud, Splunk Cloud, CrowdStrike Next-Gen SIEM (Falcon LogScale), AWS OpenSearch, Google SecOps, Sumo Logic, Amazon Athena, and Anomali Security Analytics. On-prem: IBM QRadar, Splunk, Elastic, and CrowdStrike Falcon LogScale, each of which also requires a SOC Prime app installed in the customer environment.
No. Prime Hunt scans run as queries inside your connected platform through API integration, so your logs stay where they are. Attack Chain correlation transmits and stores hostname data, encrypted and only with user consent.
Data Audit analyzes the log data in your connected platforms and maps it to MITRE ATT&CK. It shows which techniques your telemetry can support and identifies blind spots, which are gaps in log sources that prevent detection. Blind Spots analysis is available on all supported platforms except Microsoft Defender for Endpoint.
Content Audit maps your existing detection rules and queries to MITRE ATT&CK. It can run against a custom repository without connecting a Data Plane first.
A Prime Hunt scan queries your logs for a selected time period using translations of Sigma rules from the SOC Prime Platform that are relevant to your connected platforms. There are two scan modes. Threat Hunting automates routine hunting and correlates findings with MITRE ATT&CK and threat intelligence. Rules for Alerting identifies detection rules suited to your environment for low-noise, high-value alerting. A single scan can cover up to 5 Data Planes. Rules can be excluded from future scans, and scan results can be exported as a PDF report.
Attack Chains are possible threats that Prime Hunt infers by correlating events found in scan results. Agentic AI matches events against Higher Order Sigma rule sequences tied to Active Threats, which by default are threats from the last 35 days. A chain forms when a configurable share of the sequences match. Users set the correlation window (1 to 24 hours) and the lookback window (1 to 365 days). Each chain includes an AI-generated summary, MITRE ATT&CK techniques, related threat actors, a technique timeline, an Attack Flow, and recommended investigation, mitigation, and response steps.
Attack Chains form only after Prime Hunt scans have run. Detection Bypass identification, which uses fuzzy matching, is currently supported by Elastic – no other SIEMs support this feature. Chains marked as a likely false positive or low priority are hidden by default.
Yes. Prime Hunt Event Analysis (Logtotal) accepts uploaded or pasted log files (.log, .json, .jsonl, .evtx, .txt, up to 3 GB or 3,000,000 events). The LogTotal sanitizer replaces sensitive values such as hostnames, IPs, credentials, and file paths before further analysis. Users can preview, adjust, and download the sanitized result.
For on-prem Splunk, Prime Hunt needs a user role that can read all indexes and run queries, plus the SOC Prime Hunt App for Splunk. The app runs searches that Prime Hunt sends, writes hourly audit data to a dedicated socprime index, and uses the map and collect SPL commands for data audits.
No. Prime Hunt runs on top of your existing SIEM, EDR, or data lake. It queries data where it already lives and adds coverage auditing, threat hunting, and attack correlation.
Prime Hunt draws on Sigma rules from Prime Core, SOC Prime’s detection content library, and on SOC Prime’s Active Threats feed for Attack Chain correlation. Prime Architect, a separate product, is the workspace for writing and translating detection rules. Prime Hunt is where those rules run against your connected data.
Yes. Prime Hunt is the current name of the product formerly known as SOC Prime Attack Detective. Some on-prem components still carry the old name, such as the SOC Prime Attack Detective App for IBM QRadar.
