Hunt results - The hunt results page consolidates information collected by the Cortex XDR agent enabling you to investigate and take action on your endpoints. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Auditd Rules

Auditd Rules artifact in Linux forensics refers to the log data collected by the Linux Audit Daemon, a core component of security auditing. It records a detailed, chronological trail of system events based on a set of pre-configured rules.

Authorized Keys

Shows the public keys that are permitted to log in as a specific user via SSH. Attackers can add their own keys to this file to gain persistent access to a system.

Environment Variables

Lists environment variables for a given context (for example: a user's shell or a specific process). These variables define the execution environment and can contain important paths, configurations, or sensitive data.

File Listing

Shows information about the timeline of file system activity.

Files & Processes

Lists files opened by processes. This is crucial for mapping processes to the files and network sockets they are interacting with, which can reveal hidden activities, loaded libraries, or active network connections.

Firewall Rules

Lists control network traffic. Analyzing these rules is crucial for understanding the network security posture and identifying potentially malicious or overly permissive configurations.

System-Wide Configuration

Shows key-value pairs parsed from various configuration files in the /etc directory, for example: /etc/resolv.conf for DNS settings. This artifact helps understand the system's network and operational configuration.

Kernel Modules

Lists kernel modules on the system, their state, and the associated file path. Malicious actors may use custom kernel modules (rootkits) to hide their presence or gain privileged access.

Known Hosts

Lists the files that store the public keys of SSH servers a user has connected to. This helps to verify the server's identity and prevent man-in-the-middle attacks by alerting the user if the server's key changes.

Mounted Filesystems

Lists all mounted file systems, their sources (devices), types, and unique identifiers. This is useful for discovering connected storage and network shares, and understanding the file system layout.

Network Connections

Shows the lists of active network connections and listening ports. Essential for identifying unauthorized network communications, malware command and control (C2) channels, or unexpected listening services.

Running Processes

Shows a detailed snapshot of running processes on the system. This includes process identifiers, user context, executable path, parent-child relationships, state, and performance metrics. It is a cornerstone artifact for live system analysis.

System Information

Provides fundamental hardware and system information, including manufacturer, model, UUID, and memory details. This helps to identify and profile the system.

Systemd Service

Lists the system daemons or services (for example, from systemd). Analyzing these is key to understanding what long-running processes are configured on the system and to spot malicious or unnecessary services.

User Login & Session History

Shows records of user login sessions from the last command, showing who logged in, from where, and for how long. This is essential for auditing user access and investigating unauthorized logins.