Intel Sweep

Tagging marks rows you judge. Intel Sweep works the other way: you have known indicators — a report, a watchlist, a feed — and want every row that mentions any of them. A sweep scans a source and marks each match as a sighting.

What it matches

All case-insensitive; the indicator doesn’t have to fill the cell (free-text messages and command lines count):

  • IPv4 — whole token (8.8.8.8 matches, 18.8.8.81 doesn’t).
  • Domain — substring (evil.com also hits mail.evil.com).
  • Hash — MD5 / SHA-1 / SHA-256, whole token.
  • File name — whole token (svchost.exe in a path, not notsvchost.exe).

Running one

Open a source → Investigate ▾ → Intel sweep:

  1. Indicators — stack any of:
    • Paste a list (URLs reduce to their domain; defanged values refang automatically).
    • Watchlist ▾ — load a saved watchlist.
    • File — a .txt / .csv of indicators.
    • 🛡 Flagged — everything a provider flagged in this case’s intel, no new lookups.
    • Each line shows its classification, normalization, or skip reason (IPv6 isn’t swept yet). Tick “Treat each line as a file name” for filename sweeps.
  2. Scope — all columns, or specific ones.
  3. Run — progress bar, cancelable. If sightings already exist you choose Add or Replace.

Working with sightings

  • Matched rows get a red crosshair in the gutter; the matched value is highlighted. Click the crosshair to jump to the cell.
  • The Sightings rollup (Investigate ▾, or the sightings pill) lists each indicator with its hit count:
    • Click → filter the grid to its rows. Right-click → exclude it.
    • Show all sightings filters to every matched row.
    • Clear everything, one indicator, or one row (right-click → Clear sighting) to drop false positives.
  • Sightings are independent of tags (a row can be both) and feed the “seen in N files” chip in Intel mode.

From Intel mode

Select indicators in the Intel grid → right-click → Run Intel Sweep… — pick a target source and the dialog opens pre-filled.

A typical flow

  1. Import a timeline.
  2. Sweep your watchlist across all columns.
  3. Open Sightings, click the noisiest indicator.
  4. Pivot ±15 minutes around a hit, tag the blast radius, clear the false positives.