Product Update: Alert Hunts

Security teams don't have a shortage of alerts. They have a shortage of time to correlate them across the 5-10 different products most environments run. Mars's new Alert Hunts capability closes that gap: every alert – from your SIEM, EDR, cloud security posture tools like Wiz, identity, or anywhere else Mars is connected – is automatically picked up and investigated using the same federated search and hunting engine that powers the rest of the platform, and turned into a verdict you can act on, with the full cross-source evidence trail behind it.

What it does

Alert Hunts sits on top of your existing alert stream, wherever it comes from, and, for every alert, runs a full investigation without a human having to open a ticket first:

• Multi-source by design. An alert from one system triggers a federated investigation across every connected data source – SIEM, EDR, cloud, identity, and more – pulling in whatever context is needed to build the full picture, not just what the originating tool logged.
• Verdict, not just a score. Each alert is resolved to a clear outcome – Threat detected, Suspicious, Clean, or Inconclusive – plus a confidence rating (Critical / High / Medium) and severity, so your team knows at a glance what needs eyes first.
• MITRE ATT&CK mapping is applied automatically to every hunt, so alerts roll up into your existing coverage and reporting model instead of sitting outside it.
• A written summary and full evidence log for every verdict – each key finding is tagged by strength (Strong / Weak), whether it was directly observed or inferred, its source system, and a timestamp, so analysts can see exactly how Mars got to its conclusion instead of trusting a black box.
• Evidence gaps are called out explicitly. When telemetry is missing or a query window falls short, Alert Hunts says so – "sensor session window ended at 12:11Z, leaving only ~3 minutes of post-alert telemetry" – instead of quietly filling the gap with a guess.
• Recommended next steps are generated per alert: concrete actions like isolating a host, verifying whether a user's activity was authorized, or auditing who dismissed a related alert earlier – not generic advice.

Why it matters

Alert Hunts can absolutely be pointed at high-volume L1/L2 triage – every alert still gets a verdict, evidence, and next steps instead of sitting in a queue. But that's not where it's strongest. It's built for the alerts that actually justify a deep dive: the complex, critical cases where the only way to know if something is a real anomaly is to pull context from five or ten different security products at once and assemble it into a coherent case. That's exactly what Mars's federated search was built to do, and Alert Hunts is the first capability to point it at every alert by default:

• False positives get closed with reasoning, not just dismissed. One example from a live queue: an ML alert flagged as malicious was resolved Clean because Mars traced the flagged binary to Apple's own signed installer path on a pre-release OS build – and documented exactly why.
• Real threats come with a case already built. A genuine Metasploit installation on a corporate endpoint was resolved Threat detected with the full case timeline already assembled from correlated signals – how it was installed, that it persisted through an initial quarantine, that no MDM authorization existed – and precisely what telemetry gap remains before the case can be closed.
• Big, messy data sets get turned into a baseline, not a guess. Instead of an analyst manually pivoting across SIEM, EDR, cloud, and identity consoles to decide whether an alert is truly anomalous, Alert Hunts does that correlation automatically and shows its work.
• Nothing requires new data plumbing. Alert Hunts runs on Mars's federated query engine, so it investigates alerts by querying your connected sources directly, at the source – no data ingestion, no new pipeline to stand up, regardless of how many products are in scope.

Where to find it

Alert Hunts is live now in the Mars platform under Alert based hunts, alongside Intelligence Hunts and Co-Hunter. Queues are filterable by verdict, status, alert severity, source, and resolution state, so teams can slot it straight into existing alert-review workflows – whether that's high-volume triage or the handful of alerts each week that need the full multi-source treatment.

Questions or want a walkthrough on your own alert stream? Reach out – happy to set up a live look.