Internal SOC tooling. Not for customer distribution.

For SOC analysts and threat hunters

Hunt by ATT&CK technique.

Quarrix maps the full MITRE ATT&CK catalog to hunts that run directly against our shared Elastic cluster, isolated per tenant. Pick a technique, validate the query, run it, and triage what comes back.

Open Quarrix See how it works
ATT&CK coverage for one tenant 15 tactics, sample view
Finding Untriaged Clean Blind spot Hunt ready, not run yet
706ATT&CK v20 techniques and sub-techniques, each with a hunt package
437techniques with a runnable ES|QL or EQL query
1,865Elastic detection rules converted into draft hunts
15tactics, including the new Stealth and Defense Impairment

How a hunt moves through Quarrix.

Three content sources feed one hunt library. The runner resolves each tenant's indices, checks the fields exist, and only then queries Elastic with the tenant filter attached.

Quarrix architecture MITRE ATT&CK, Elastic detection rules and hunt YAML files feed the hunt library. The hunt runner applies tenant isolation and a field pre-flight, queries Elastic Cloud per namespace, and results flow to triage, coverage and analysis, with escalation to Dossio planned. Content Execution Outcome MITRE ATT&CKTechniques & analytics Elastic detection rulesConverted into drafts Hunt YAMLWritten by the team Hunt libraryActive, draft and stub hunts Hunt runnerTenant isolation, field pre-flight Elastic CloudPer namespace ES|QL / EQL rows TriageSuspicious or benign CoverageHeatmap & Navigator layer AnalysisHost × tactic DossioEscalation (planned)
  1. 01

    Generate coverage

    Elastic rules become draft hunts. Techniques without a rule get a stub with MITRE analytics guidance.

  2. 02

    Check data readiness

    See which data sources each tenant actually sends, and which hunts can run today.

  3. 03

    Validate in the console

    Run a query once and inspect the request, raw response, and tenant filter exactly as Kibana sees them.

  4. 04

    Run and triage

    Activate hunts that pass, run them per tenant or in batch, mark findings, and escalate.

Where the hunts are, tactic by tactic.

Share of parent techniques in each tactic covered by a converted Elastic detection rule. The rest still have a MITRE stub waiting for a query.

Inside the networkPre-compromise, mostly outside our telemetry ATT&CK v20, parent techniques only

What you use day to day

One web app, one login. The menu adapts to your role: viewer, analyst, or admin.

Hunt library
Manual hunts (YAML), Elastic-derived drafts, and MITRE stubs in one list. Filter by status, origin, and data source.
Validation console
Swagger for hunts: test a query without saving a run, then copy the request to Dev Tools in one click.
Data readiness
When a new integration (CrowdStrike, Defender, Sysmon) starts shipping data, its hunts light up. No rebuild.
Coverage and Navigator
ATT&CK heatmap with blind spots, exported straight to an ATT&CK Navigator layer.
Result triage
Automatic stacking (rarest first), per-row or bulk triage, analyst notes, and case references.
Users and roles
Per-user login, tiered roles, and access that can be scoped to specific tenants.

The hunt library: every hunt, its query, and how to run it.

Search or filter, then pick a hunt to see its hypothesis, required fields, and query. Drafts come from Elastic rules; stubs carry MITRE guidance until someone writes the query.

Interactive preview with sample hunts from the library.

One host across six tactics matters more than six separate findings.

The Analysis view merges results from every hunt per host, user, or IP and maps them to ATT&CK tactics in kill-chain order.

Sample lab data, last 7 days
HostScoreTacticsHuntsTriage

Guardrails you should know before you hunt.

Tenant isolation works in two layers. Even if the app has a bug, Elastic still refuses access to another tenant's data.

  • Read-only API key per tenant, scoped to that tenant's namespace indices and stored encrypted.
  • Namespace and time filters are sent through Elastic's filter parameter, never spliced into the query string.
  • Fail-closed: any index pattern that does not end in the tenant's namespace is rejected, ad-hoc console queries included.
  • Cluster load limits: capped concurrency, timeouts, a maximum time window, and an automatic row limit on every query. Start with short windows.
  • Everything is audited: every hunt run, triage decision, and configuration change is logged with your username.

Getting access

Ask the Quarrix admin for an account. You get a temporary password and must change it on first login.

Viewer
Dashboards, results, coverage, and analysis. Read only.
Analyst
Run hunts, use the console and data readiness, triage findings.
Admin
Manage tenants and users, import catalogs, generate coverage.
Open Quarrix Read the setup guide

Self-hosting for development

cp .env.example .env
docker compose up -d --build
docker compose exec api python -m app.cli import-attack
docker compose exec api python -m app.cli import-rules
docker compose exec api python -m app.cli generate-hunts
docker compose exec api python -m app.cli create-user <name> admin

Docker Compose, FastAPI, and PostgreSQL. Connects to Elastic Cloud by Cloud ID or to a self-managed endpoint.