← All modules
Federated Threat Hunting
One query. Every customer. At once.
What it does
- Write one UDM query and run it across every customer instance simultaneously — not N times, logged in N times.
- Save and share hunts across the team, so a technique found at one customer gets checked everywhere immediately.
- Pivot straight back into the source customer's own Chronicle instance from a result row.
- Results are grouped by customer, so a fleet-wide sweep doesn't turn into an unreadable wall of events.
Who it helps, and when
A threat hunter who just read a new IOC or technique write-up and needs to know, in minutes, whether it shows up anywhere across the whole customer base — not just the one tenant they happen to be logged into.
Book a Demo
See Federated Threat Hunting on your own customer fleet.
30 minutes, no slide deck required — we'll walk through the modules most relevant to how you run SecOps today.