SentinelOne Hunter

Hunter works with SentinelOne Deep Visibility to hunt for indicators of interest, captured right from your browser page. The Hunter Chrome Extension lets you easily scrape data from your browser and opens a query in your SentinelOne Management Console to search for that data across your organization. Hunter captures these indicators from information open in your current browser tab: IP addresses, DNS names, and hashes (MD5, SHA-1, and SHA-256).

The Hunter extension does not capture any personal or private data from the browser or the user. When the indicators of interest are captured, they are redirected to your SentinelOne Management Console. The data is not saved. The only permission the extension requires is to scrape the browsed pages, get the indicators, and send them to the SentinelOne Management Console.

How to use: To use Hunter, you must be an Admin user in an active SentinelOne Management Console with Deep Visibility. Open Hunter and select the indicators to hunt for. When you click Hunt, a new query opens in Deep Visibility in your SentinelOne Management Console. You can edit the query or run it as is to search for the indicators in your environment.

Steps:

1. Download Hunter by SentinelOne from the Chrome Web Store.
2. The first time you open Hunter, enter the URL of your SentinelOne Management Console.
3. Click Hunter and you’ll see all indicators in your current browser tab.
4. Hover over one and click Hunt. Or select multiple items and then click Hunt Now.
5. A new query opens in Deep Visibility in your SentinelOne Management Console. You can edit the query or run it as is to search for the indicators in your environment.