TL;DR
Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
|---|---|---|---|---|---|---|---|
IBM DB2 Logs | ✅ | ✅ | ibm_db2_logs | Nested-Json-Text | S3 | ||
IBM NS1 Activity Logs | ✅ | ✅ | ibm_ns1_activity_logs | Nested-Json-Array | S3 |
Overview
International Business Machines Corporation (IBM), nicknamed "Big Blue," is a leading global technology company headquartered in Armonk, New York, founded in 1911 as the Computing-Tabulating-Recording Company (CTR). With a history stretching back over a century, IBM has evolved from producing early tabulating machines and time clocks into a dominant force in mainframe computers and, currently, a major player in 
hybrid cloud computing, artificial intelligence (AI), and quantum computing. As of 2026, the company operates in over 170 countries, providing a wide array of services including IT consulting, infrastructure, and software, while powering critical infrastructure, such as processing over 90% of global credit card transactions. Known for its extensive research and innovation, holding numerous patents, IBM continues to focus on ethical AI solutions and enterprise-scale digital transformation, including initiatives like the AI-driven "Watson" platform.
Supported data types
IBM DB2 Logs
Overview:
IBM Db2 is a family of AI-powered, cloud-native relational database management systems (RDBMS) designed to manage, analyze, and secure data for mission-critical transactional and analytical workloads. First released in 1983 for IBM mainframes, modern Db2 has evolved into a versatile platform supporting on-premises, cloud, and hybrid environments, including Linux, UNIX, and Windows (LUW) operating systems. Known for high performance, reliability, and scalability, Db2 supports both SQL and NoSQL data models, including JSON and XML, making it suitable for both traditional relational structures and modern, unstructured data. Key features include advanced data compression, in-memory processing for analytics, robust security features, and automated database management, such as the Db2 Genius Hub for autonomous operations.
Table name: ibm_db2_logs
Send data to Hunters
Hunters supports the ingestion of IBM DB2 Logs via an intermediary AWS S3 bucket.
To connect IBM DB2 Logs:
Export your logs from IBM DB2 Logs to an AWS S3 bucket.
Once the export is completed and the logs are collected to S3, follow the steps in this section.
Expected format
Logs are expected in Nested-Json-Text:
{"host":"host.example.internal","source":"/var/log/db2/diagnostic/db2diag.log","_raw":"1-1-2020 12:00:00 DB2-102-083 Successful Identity request, subsystem=DB2SUBSYS, Auth ID=AUTHUSER1, Correlation ID=12.34 05, Connecting Type=LOCAL, Plan Name=, Original OID=ENTRPPRD, End User UID=, Transaction Name=, Workstation Name=, by=ENTRPPRD, original id=ENTRPPRD, secondary ids=()","_time":1577836800,"cribl_breaker":"fallback","cribl_pipe":["passthru","passthru"]}IBM NS2 Activity Logs
Overview:
IBM NS1 Activity Logs is the native real-time activity monitoring and audit logging capability inside the IBM NS1 Connect platform. It consolidates continuous streams of API calls, user access events, and DNS configuration changes from the NS1 portal and automated workflows into actionable operational insights. IBM NS1 Activity Logs surface unauthorized zone modifications, administrative actions, and operational anomalies across global DNS and traffic management infrastructure, and presents them in a standardized event format that enables network and security teams to trace configuration changes, investigate routing incidents, and ensure infrastructure integrity effectively.
Table name: ibm_ns1_activity_logs
Send data to Hunters
Hunters supports the ingestion of IBM NS1 Activity Logs via an intermediary AWS S3 bucket.
To connect IBM DB2 Logs:
Export your logs from IBM NS1 Activity Logs to an AWS S3 bucket.
Once the export is completed and the logs are collected to S3, follow the steps in this section.
Expected format
Logs are expected in Nested-Json-Array:
{"_raw":"[{\"DateTime\":\"Mon, 01 Jan 2024 00:00:00 UTC\",\"User\":\"user_one\",\"Activity\":\"Account logged in\"},{\"DateTime\":\"Mon, 01 Jan 2024 01:00:00 UTC\",\"User\":\"user_two\",\"Activity\":\"CNAME record for apps.example.org deleted\"}]","host":"host-aaaaa","source":"https://api.nsone.net/v1/account/activity","_time":1704067200.000,"cribl_breaker":"Cribl:ndjson","cribl_pipe":"passthru"}
{"_raw":"[{\"DateTime\":\"Tue, 02 Jan 2024 00:00:00 UTC\",\"User\":\"user_two\",\"Activity\":\"Account logged in\"},{\"DateTime\":\"Tue, 02 Jan 2024 02:00:00 UTC\",\"User\":\"alert-center\",\"Activity\":\"Email notification sent for alert 00000000-0000-0000-0000-000000000000\"}]","host":"host-aaaaa","source":"https://api.nsone.net/v1/account/activity","_time":1704153600.000,"cribl_breaker":"Cribl:ndjson","cribl_pipe":"passthru"}