Signals: Sensor Network Observations

Signals surfaces what Hunt.io's global sensor network sees: hosts scanning the internet, probing for weaknesses, and launching attacks. It builds host profiles from that activity so you can tell whether an IP is noisy, malicious, or tied to a known actor.

It is the behavior layer behind the other views. A host you find in Search or C2 Infrastructure carries Signals activity, you can slice that activity precisely in HuntSQL, and an actor-tagged host connects back to IOC Hunter reporting. New here? Start at Getting Started.

Open Signals from the Hunting group in the sidebar.

What Signals is for

Use Signals to add behavior to an indicator. A reputation score tells you an IP is bad, Signals tells you what it was doing: which ports it hit, how it was classified, and whether its activity lines up with a tracked actor.

Querying (to verify)

The earlier documentation described querying Signals by IP, by actor, and by classification. Confirm whether these still apply and what the current syntax is before documenting them:

• Search by IP to see the activity a host was involved in.

• Search by actor to see hosts tied to a given actor.

• Search by classification to find hosts involved in a type of malicious activity.