Build a queryChoose a table and fill in anything you know. The query updates live as you type.
?
Fill in what you know. Blank fields and Any are ignored. The query on the right updates live; there is no Generate button.
Live · no filters yet
Local processing · No query data sent to IMPLEMONIMPLEMON
Paste a clue to see what you can investigate.
Fill in what you know. Blank fields and Any are ignored. The query on the right updates live; there is no Generate button.
This query no longer matches the generated investigation. The provenance below describes the originally generated query and may not match your edits.
Evidence returned
Changes on the left won't overwrite your edits. Use Restore generated query to go back.
Checks that the KQL is well formed and that every table and column exists in the documented schema. It does not check whether the investigation logic is right. That is what Investigation checks are for.
Click any line in the query to see what it does.
Microsoft Defender is a trademark of Microsoft Corporation. Huntriage is an independent IMPLEMON product and is not affiliated with or endorsed by Microsoft. Privacy
Check who registered a set of domains and when.
Repeated registration infrastructure is an investigation clue, not a maliciousness verdict. Lookups go from your browser to public RDAP servers, not to IMPLEMON.
| Domain | Registrar | Created | Last updated | Status / notes | Memory |
|---|
Registration data comes from RDAP: your browser asks IANA which registry serves each domain, then asks that registry directly. Lookups are not sent to IMPLEMON and nothing is saved unless you choose Remember or Add to board. Some country-code registries have no RDAP service or do not allow browser lookups; those rows say so.
Decode a link locally, pull out reusable sender-side artifacts, and compare up to four links.
Huntriage reads the URL text only and never visits the link. Click a value to copy it. A value's presence does not establish ownership or maliciousness, and a repeated artifact is not proof of a common sender. Nothing leaves your browser.
Link Analysis runs entirely in your browser and never requests the link. Redirect chains are decoded from the link text, so the real HTTP redirects may differ. Extracted values are leads to verify, not confirmed facts. Link Analysis keeps recurring sender-side observations locally in your browser. Unpromoted observations automatically expire after 12 months of inactivity. Saved Memory items do not expire automatically.
Huntriage analyzes URL structure generically and can add extra context for some recognized tracking/delivery infrastructures. Recognition is supplementary, not a requirement.
Your current input will not be lost.
| Feature | Free | Pro |
|---|
Huntriage processes investigation data and Analyst Memory locally in your browser. Pro activation sends only the information required to validate your Lemon Squeezy license. Investigation inputs, KQL, remembered artifacts, analyst notes, and investigation history are not sent to IMPLEMON or Lemon Squeezy for licensing. Privacy policy
Want to pick tables and fields yourself? Advanced Builder builds the query live from a form.
sender@example.com. It is detected as Sender address (From), a best guess you can change. Choose Find the messages to get an EmailEvents query on that sender with its path and limits.Huntriage does not connect to your tenant or run anything. Copy the query and run it against your own Defender XDR data. If you edit the query, Huntriage marks it as modified and stops presenting the original explanation as current.
example.com, Time range 7 days. The query immediately gains | where SenderFromDomain =~ "example.com".You can edit the query by hand. From then on the form no longer overwrites it and the header says Manual edit. Restore generated query reconnects the editor to the form, including any form changes you made meanwhile.
u41682696, why: Same SendGrid account ID appeared in URL and Return-Path, context: Confirmed phishing. Later the same ID in another link shows Seen before with that note.Free keeps up to 25 items with exact matching and shows when a value was last seen. Pro adds unlimited items, Contains and wildcard (* ?) matching, observation counts with first and last seen, history, pinning and dormant items. Export and import work on both. Memory stays in this browser and is not sent to IMPLEMON. Remembering something does not mark it as malicious, and a repeated value does not by itself mean a common attacker. Separately, Link Analysis keeps recurring sender-side observations locally. Unpromoted observations expire after 12 months of inactivity. Saved Memory items do not expire automatically.
https://login.brand-secure.example/verify, billing@partner.example and choose Look up.A repeated registrar is not a malicious registrar. It only means the same registrar appeared more than once among the domains you are looking at or have remembered; registrars serve huge numbers of legitimate domains. Lookups go directly from your browser to IANA and the domain's registry, not to IMPLEMON, and nothing is saved unless you choose Remember or Add to board.
u41682696 as a possible sender-side identifier in SendGrid context. When it shows up again in SendGrid-context links, the row says Seen before · 4.Provider recognition is supplementary context. Generic URL analysis works even when Huntriage does not recognize the infrastructure. Huntriage locally remembers recurring sender-side observations, separately from Analyst Memory; the same value in a different context is a different observation. Unpromoted observations expire after roughly one year of inactivity, and after about five sightings Huntriage may suggest remembering one. Nothing is sent anywhere, and a repeated artifact is not proof of the same sender or campaign.
u41682696 on a board, connect them as an analyst hypothesis and write why the shared 41682696 matters. It stays labeled as a hypothesis until you attach a source that shows it.Relationships are labeled Source-cited observation (a captured source is cited; a citation is not proof), Derived from supplied text (for example a URL encoded inside another, not an observed redirect), Analyst hypothesis (unverified), or Visual connection (a board line, never evidence). Select a card for its actions, compare two artifacts side by side, and use Focus for a larger board. Identifiers are scoped to their provider or site, so the same text elsewhere is never merged. Everything stays in this browser: use Backup & storage for a full backup, because browsers can clear site data.
Remember values you may want to recognize if they appear again. Remembering something does not mark it as malicious.