MDR Threat Hunts

The Threat Hunts page gives you real-time visibility into the proactive threat hunting that Rapid7’s MDR SOC performs on your behalf. You can log in to the Command Platform at any time to review completed hunts, examine findings, inspect the queries that were run, and generate reports for stakeholders without waiting for your monthly service report.

To access the Threat Hunts page, you must be an MDR customer with an active Command Platform account and be using the new Unified Platform Navigation. Customers using the legacy navigation cannot access the Threat Hunts page.

To open the Threat Hunts page:

1. Log in to the Command Platform.
2. Go to Response & Remediation > Threat Hunts.

View your threat hunts

The Threat Hunts page provides a summary of recent hunting activity and a chronological list of all hunts completed in your environment.

Summary metrics

Four metric cards at the top of the page summarize your activity for the last 30 days:

Threat hunts list

The list below the metric cards shows all completed hunts. Each row displays the following columns:

Filter and search

• To filter the list by status, source, or other attributes, select the filter bar or press K.
• To find a specific hunt by name, use the Search box in the top-right corner of the list.
• To switch between grid and list views, use the view toggle icons to the left of the Search box.

Explore hunt details

Select any row in the Threat Hunts list to open the Threat Hunt Details page for that hunt.

Header and metadata

The page header displays the hunt name, status badge (for example, Closed), and the following metadata:

Summary counters

Three counters appear directly below the header:

Overview tab

The Overview tab contains three sections:

Hunt Details

• Description - A plain-language explanation of what Rapid7 was looking for and why it is relevant to your environment.
• Threat Brief - The intelligence rationale behind the hunt, including where the threat intelligence originated and why this hunt was prioritized. This may appear as a summary paragraph or a link to an external source.

Investigations

If the hunt produced findings that were escalated, the linked investigations appear in this section. If this section reads No investigations linked to this Threat Hunt, the hunt completed without actionable findings in your environment.

Queries

The exact queries Rapid7 ran during the hunt are listed here, along with the log source each query targets. For example, LE_DNS or LE_WEB_PROXY. From this section, you can:

• Copy a query to your clipboard by selecting the copy icon next to the query.
• Open a query directly in Log Search by selecting Run in Log Search. See Re-run hunt queries in Log Search for details.

IOCs tab

Select the IOCs tab to view the specific indicators (IP addresses, domains, file hashes, or URLs) that Rapid7 searched for during the hunt. These are the raw data points used to conduct the hunt.

Re-run hunt queries in Log Search

Each query on the Threat Hunt Details page includes a Run in Log Search button. Selecting it opens Log Search with the query and the hunt’s original time range pre-populated, so you can check whether the same indicators appear in more recent data.

To re-run a query in Log Search:

1. On the Threat Hunt Details page, scroll to the Queries section.
2. Note the log source label displayed beneath the query you want to run. For example, LE_DNS or LE_WEB_PROXY.
3. Select Run in Log Search. Log Search opens with the query and time range pre-filled.
4. In Log Search, manually select the log source you noted in step 2.
5. Run the query to view results.

Generate threat hunt reports

You can generate two types of reports from the Threat Hunts page: a detailed report for a single hunt, or a summary report covering all hunt activity across a selected time period. Both report types are available as PDF and HTML, and can be emailed to recipients or scheduled for recurring delivery.

Generate a single-hunt report

Use a single-hunt report to share the full details of one specific hunt with stakeholders.

1. Open the Threat Hunt Details page for the hunt you want to report on.
2. In the top-right corner, select Create Report. The Create Report panel opens.
3. In the Name field, edit the report name if needed. The field defaults to the hunt name.
4. Optionally, add a Description to provide context for recipients.
5. Under Formats, select PDF, HTML, or both.
6. Leave the hunt filter as-is. Do not clear the pre-set filter.
7. Under Scheduling, the Trigger report on save toggle is on by default. The report is generated immediately when you select Create.
8. To email the report, enter one or more Rapid7-associated email addresses in the Send via email field.
9. Optionally, select Add Schedule to configure recurring delivery. For example, monthly.
10. Select Create. The report is generated and saved to Reports & Dashboards.

Generate an all-hunts summary report

Use a summary report to produce a periodic overview of all threat hunting activity. This report is useful for executive briefings and compliance reviews.

1. From the Threat Hunts list page (not a detail page), select Create Report in the top-right corner.
2. Enter a Name for the report. For example, Threat Hunts - Monthly Summary.
3. Set the Date Range using the dropdown. The default is Last 30 days.
4. Select your output Formats (PDF and/or HTML).
5. Toggle on Trigger report on save to generate the report immediately.
6. Optionally, add recipients in the Send via email field.
7. To automate recurring delivery, Select Add Schedule and configure the cadence.
8. Select Create.

The summary report includes:

• Threat Hunt Overview - The total number of hunts conducted in the selected period.
• Hunts With Findings - The number of hunts that produced actionable results.
• Recent Threat Hunts - A table listing the most recent hunts with their name, status, source, and created date.

Access saved reports

All generated reports, whether created manually or by a schedule, are saved automatically. To access them:

1. From Command home, go to Reports & Dashboards.
2. Locate your report by name or creation date.

Quick reference

For questions about your threat hunting activity, contact your Rapid7 Cybersecurity Advisor.