Create a custom detector

At Hunters, we believe that we can cover ~80% of the attack surface by covering common detection use cases with our internal research and detection engineering teams, so that you can focus on customizing the 20% that's unique to your organization.

Hunters allows users to create their own Custom Detectors, which run continuously over your raw data as part of the Hunters Detection Engine, in addition to the library of detectors provided out-of-the-box by Hunters.

To create a custom detector:

1. Navigate to the Detectors page.

2. In the top-right corner, click New Detector
   The Custom Detector creation wizard opens.
    

To create a Custom Detector you'll need to complete the following steps:

• Define a query - Choose the data and conditions that will be queried in order to generate leads.

• Set up scoring & alert generation - Determine the scoring and alerting that generated leads would have.

• Additional configuration - Provide additional details about the detector, like its name and description.

STEP 1: Define a query

To create a Custom Detector, you'll need to define the query that will be continuously executed on the raw data.

To define a query:

1. Name your new detector by replacing the placeholder heading.
   

2. From the top toggle, select one of the two detection modes offered:

   • Filter - This detection mode will execute the query on a row-by-row basis and generate leads for any row that fits the filter. For example, we could filter for specific process names, with specific flags in their command line.

   • Group by - This detection mode will group events over a time window based on a configurable grouping logic, with an option to generate leads only when the group fits a certain post-grouping condition. For example, we could group login events of a specific username over a 10-minute period, and see if the amount of logins passes a certain threshold.

3. From the Event Source dropdown list, select from a list of built-in event sources.

   📘What is an event source?

   An event source is a definition that includes:

   • The table that will be queried

   • The specific events that will be filtered (since we'll usually want our query to be on a specific event like "process creation", and not on the entire raw table).

   • The specific attributes that will be extracted in the query
     
     

   We recommend using one of the built-in event sources suggested in the drop-down list. Those sources, created by the Hunters team, already contain the correct filters and extract all of the relevant attributes from the event. However, you can also create your own custom event source by clicking New event source. Learn more here.

4. Continue according to the selected detection mode:

Our next step is to set scoring and alert generation settings. In other words, we will determine when a new lead is generated (based on the logic you set in the previous step), its risk score, and when it will generate an alert.

1. Under Choose TTP, select any MITRE ATT&CK Technique associated with the custom detector you're creating. Hunters will use this to assign the base severity level to each lead generated.

   📘Note

   In case there's no specific technique that can be associated with the detector, or if you want to determine the base severity manually, check the Other checkbox.

2. Define the detector's base risk by selecting a confidence level.

   📘 How does that work?

   Leads arriving from your custom detector will receive a base risk score based on the base confidence you select in this field.

   Risk score is a multiplication of Confidence (the likelihood of the event being malicious) and Severity (The potential impact and damage of the security event on the organization).

   If you've selected techniques in the previous field, the base Severity dropdown will be deactivated, as it's determined according to the selected techniques. If you've selected Other, then you can determine the base Severity yourself.

   Learn more about Risk Score.

3. Under Create your alerts, define whether you'd like the detected leads to create alerts and starting from which confidence level.

4. Under Set clustering logic, determine the grouping attribute that will be used to group leads together into a cluster.

5. Once done, click Next.

STEP 3: Additional Configuration

With the query and scoring details set, we need to fill in a few more details before we're done.

1. In the Description field, write a short description for the detector. This description will be available when interacting with the generated leads in different parts of the platform, and can help get your users up to speed on the detector's purpose and logic.
   For example: A hunting query for suspicious rundll32 executions

2. Under String representation of the lead/alert, write a sentence describing what was detected in the lead originating from this detector. You can include variables to display specific attributes.
   For example: Rundll32.exe executed {target_process_name}

3. Under String representation of the threat cluster, write a sentence describing what was detected in the cluter originating from this detector. You can include variables to display specific attributes.

4. Finally, select the most important attributes of this detector:

   • Display Attributes: these are the attributes that will be displayed first in various screens (leads page, leads grid, investigation drawer, etc.)

   • Aggregate Attributes: these are the attributes that will be used to aggregate the different leads into threat clusters.

5. Click Apply to create the detector.

Available operators

Detection logic operators

You can use the following operators to create the detection logic statement:

Statistics operators

When creating a Group by detector, you can use the following operators in the Statistics field: