Platform Stats: Live Scan Telemetry

Platform Stats, shown in the product as Platform Pulse, is a live read on the scanning behind Hunt.io. It shows how much data is moving through the platform right now and which collection streams are busiest, so you can see the raw activity that feeds the rest of the tools.

That raw telemetry is what powers the views you use day to day: the per-IP records you query in HuntSQL and open from Search, the servers tracked in C2 Infrastructure, and the host behavior in Signals. New to the platform? Start at Getting Started.

This page is the successor to the older Real Time Stats documentation.

Live scan telemetry

The top of the page shows throughput: Signals per second, the number of active streams, the busiest stream right now, the last refresh time, and a combined trend sparkline. A Live badge marks that the numbers are updating.

Signal breakdown

Below that, each collection stream gets a card with its smoothed per-second rate and a sparkline:

• Parsed Certificates. SSL certificates parsed into their identifying fields.

• HTTP pages. Full HTML content grabs.

• Protocol Detection. A fast, extensible protocol detector run on unknown ports to spot custom C2 and other malicious signs.

• SSH Keys. Public SSH keys, used to associate activity and spot when a server changes hands.

• JARM Hashes. TLS fingerprints collected at scale to hint at what software is running.

• Open Ports Discovered. Ports that answer as open across the ranges being scanned.