Hunt (TLQL)
huntRun deterministic SIEM-style queries over 106k pre-joined threat observations to aggregate or cross-reference tools, malware, IOCs, MITRE, CVE, and infrastructure.
Instructions
Run a deterministic SIEM-style query over the pre-joined observation index (~106k rows across tool, malware, ioc, mitre, cve, attribution, dns and infra observations). Use this INSTEAD of chaining many search_threats calls when the question is an aggregate ("how many X grouped by Y") or crosses observation types ("threats using tool A that also have IOC type B"). Append "| stats count by " to aggregate; without it you get matching rows. A threat contributes one row per observation, so for "how many THREATS" use "| stats count_distinct(threat) by " — plain count double-counts. Operators are = != > < >= <= LIKE CONTAINS IN "NOT IN"; quote any value with a hyphen (cve = "CVE-2024-3400"). Call hunt_schema first if you do not know the field names.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Row cap for non-stats queries (default 50, max 100). In stats mode it caps the number of GROUPS returned. Check `has_more` in the response. | |
| query | Yes | TLQL, e.g. `tool = "cobalt strike" AND sector = "healthcare" | stats count by nation` |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| by | No | ||
| func | No | ||
| mode | Yes | 'stats' when the query has a | stats pipe, otherwise rows. | |
| rows | No | ||
| count | No | Rows RETURNED, not rows matched. | |
| limit | No | ||
| query | Yes | ||
| groups | No | ||
| columns | No | ||
| has_more | No | True when rows (or, in stats mode, groups) were cut at the limit. | |
| tier_gated_included | No | True when the caller's tier allows the c2_beacon/dns/infra observation types. |