Hunts
A hunt is a preset question that runs once a day as an investigation of the Olympusx AI audit log, over the hours since its last run. The questions are the platform’s, written once and reviewed. Each hunt is off until an admin turns it on with the model that answers it.
The hunts
Section titled “The hunts”| Hunt (and its key) | The question the console shows |
|---|---|
Keys used from new addresses (new-address-keys) |
Was an API key created and then used from an address that had not been seen before in this window? Name the account, the key and the addresses. |
Data exports (data-exports) |
Who exported findings, the audit log or other data in this window, when, and from which addresses? Is any of it unusual for that account? |
Unplanned people changes (people-changes) |
Did anyone change roles, disable or remove people, or reset passwords in this window in a way that looks unplanned or out of hours? |
To ask the same kind of question of your firewall or sign-in logs, start an investigation of a log source, or send its alerts to Olympusx AI with alert integration.
Who can do what
Section titled “Who can do what”| Role | What they can do |
|---|---|
| Admin | Turn a hunt on or off, change its model, and Run now. |
| Auditor | See the hunts, whether each is on, and the investigations they opened. |
| Builder, End user, Reviewer | Cannot open the Investigations tab. |
Turn a hunt on
Section titled “Turn a hunt on”- Open Use cases › Security and select the Investigations tab. Hunts is at the top.
- On the hunt’s row, choose the Model.
- Turn on Daily.
The first run starts within a quarter of an hour, and the row says so until it has run. After that, the row shows Last run and when.
To change the model, choose another and turn Daily off and on again. To stop a hunt, turn Daily off.
Run a hunt now
Section titled “Run a hunt now”On a hunt that is on, select Run now. It opens an investigation over the hours since the hunt’s last run, and the next daily run counts from now.
How a hunt runs
Section titled “How a hunt runs”- Olympusx AI looks for due hunts every 15 minutes, and runs each hunt at most once every 24 hours.
- The window runs from the hunt’s last run to now. On a first run, or when the last run is more than 90 days old, the window is the last 24 hours.
- Each run is an ordinary investigation: the same rounds, limits, verdict, findings and proposed actions. It is listed on the Investigations tab tagged Hunt.
- A run is skipped when the hunt’s model is no longer one the tenant may call, or its budget is spent. Turn the hunt on with another model, or raise the budget.