SentinelOne Deep Visibility Threat Hunting

Field Operator "Value" AND/OR Field Operator "Value"

-- Process Events
EventType = "Process Creation"
EventType = "Process Termination"
EventType = "Process Modified"
EventType = "Duplicate Process Handle"
EventType = "Open Remote Process Handle"
 
-- File Events
EventType = "File Creation"
EventType = "File Modification"
EventType = "File Deletion"
EventType = "File Rename"
EventType = "File Scan"
 
-- Network Events
EventType = "IP Connect"
EventType = "IP Listen"
EventType = "DNS Resolved"
EventType = "DNS Unresolved"
 
-- Registry Events (Windows)
EventType = "Registry Key Create"
EventType = "Registry Key Delete"
EventType = "Registry Value Create"
EventType = "Registry Value Modified"
EventType = "Registry Value Delete"
 
-- Other Events
EventType = "Module Load"
EventType = "Scheduled Task"
EventType = "Driver Load"
EventType = "Login"
EventType = "Logout"

-- AND: Both conditions must be true
EventType = "Process Creation" AND ProcessName = "cmd.exe"
 
-- OR: Either condition can be true
ProcessName = "cmd.exe" OR ProcessName = "powershell.exe"
 
-- Grouping with parentheses
(ProcessName = "cmd.exe" OR ProcessName = "powershell.exe") AND UserName = "SYSTEM"

-- Search for known malicious hash
FileSha256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
 
-- Search for known C2 domain
DnsRequest ContainsCIS "malicious-domain.com"
 
-- Search for known C2 IP
DstIp = "192.168.100.100"

-- Hunt for encoded PowerShell (T1059.001)
EventType = "Process Creation" AND
SrcProcName = "powershell.exe" AND
SrcProcCmdLine ContainsCIS "-enc"
 
-- Hunt for credential dumping (T1003)
TgtProcName = "lsass.exe" AND
EventType = "Open Remote Process Handle"

-- Unusual parent-child process relationship
SrcProcName = "excel.exe" AND
TgtProcName In ("cmd.exe", "powershell.exe", "wscript.exe")
 
-- Process running from unusual location
EventType = "Process Creation" AND
TgtProcImagePath ContainsCIS "\Users\" AND
TgtProcImagePath ContainsCIS "\AppData\" AND
TgtFileIsExecutable = "true"

-- New scheduled tasks (compare against baseline)
IndicatorName = "ScheduleTaskRegister" AND
SrcProcParentName Not In ("services.exe", "svchost.exe", "OfficeClickToRun.exe")
 
-- Unusual outbound connections
EventType = "IP Connect" AND
DstPort Not In (80, 443, 53, 123) AND
SrcProcName Not In ("chrome.exe", "firefox.exe", "msedge.exe")

-- Office spawning suspicious child processes
(SrcProcName In ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe") AND
TgtProcName In ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe"))

-- Browser spawning suspicious processes
(SrcProcName In ("chrome.exe", "firefox.exe", "msedge.exe", "iexplore.exe") AND
TgtProcName In ("cmd.exe", "powershell.exe", "mshta.exe", "wscript.exe"))

-- Encoded PowerShell commands
EventType = "Process Creation" AND
SrcProcName = "powershell.exe" AND
(SrcProcCmdLine ContainsCIS "-enc" OR
 SrcProcCmdLine ContainsCIS "-encodedcommand" OR
 SrcProcCmdLine ContainsCIS "frombase64string")
 
-- PowerShell download cradles
EventType = "Process Creation" AND
SrcProcName = "powershell.exe" AND
(SrcProcCmdLine ContainsCIS "downloadstring" OR
 SrcProcCmdLine ContainsCIS "downloadfile" OR
 SrcProcCmdLine ContainsCIS "invoke-webrequest" OR
 SrcProcCmdLine ContainsCIS "wget" OR
 SrcProcCmdLine ContainsCIS "curl" OR
 SrcProcCmdLine ContainsCIS "iwr")
 
-- PowerShell executing from unusual locations
EventType = "Process Creation" AND
SrcProcName = "powershell.exe" AND
SrcProcImagePath Does Not ContainCIS "System32" AND
SrcProcImagePath Does Not ContainCIS "SysWOW64"

-- CMD with suspicious commands
EventType = "Process Creation" AND
TgtProcName = "cmd.exe" AND
(TgtProcCmdLine ContainsCIS "/c " OR TgtProcCmdLine ContainsCIS "/k ") AND
(TgtProcCmdLine In Contains Anycase ("whoami", "net user", "net localgroup",
 "systeminfo", "tasklist", "ipconfig", "netstat", "reg query"))

-- WScript/CScript execution
EventType = "Process Creation" AND
TgtProcName In ("wscript.exe", "cscript.exe") AND
(TgtProcCmdLine ContainsCIS ".vbs" OR TgtProcCmdLine ContainsCIS ".js")

-- WMIC process creation
TgtProcName = "wmic.exe" AND
TgtProcCmdLine ContainsCIS "process call create"
 
-- WMIC remote execution
TgtProcName = "wmic.exe" AND
TgtProcCmdLine ContainsCIS "/node:"

-- Schtasks creation
(TgtProcName = "schtasks.exe" AND TgtProcCmdLine ContainsCIS "/create") OR
(SrcProcCmdLine ContainsCIS "New-ScheduledTask" OR
 SrcProcCmdScript ContainsCIS "New-ScheduledTask")
 
-- Via Indicator
IndicatorName = "ScheduleTaskRegister" AND
SrcProcParentName Not In ("services.exe", "OfficeClickToRun.exe", "svchost.exe")

-- Run key modifications
(RegistryKeyPath ContainsCIS "Windows\\CurrentVersion\\Run" AND
EventType In ("Registry Key Create", "Registry Value Create", "Registry Value Modified")) AND
SrcProcParentName Not In ("smss.exe", "svchost.exe", "SetupHost.exe", "msiexec.exe")
 
-- Startup folder file creation
FileFullName ContainsCIS "Programs\\Startup" AND
TgtFileExtension In Contains ("exe", "vbs", "bat", "cmd", "ps1", "lnk") AND
EventType = "File Creation"

IndicatorName = "ScheduleTaskRegister" AND
SrcProcParentName Not In ("Integrator.exe", "OfficeClickToRun.exe", "services.exe",
"OneDriveSetup.exe", "Ccm32BitLauncher.exe", "WmiPrvSE.exe")

-- Service creation via sc.exe
TgtProcName = "sc.exe" AND
TgtProcCmdLine Contains "binPath="
 
-- Service creation via PowerShell
SrcProcCmdLine ContainsCIS "New-Service" OR
SrcProcCmdScript ContainsCIS "New-Service"

-- Web shell file creation
EventType = "File Creation" AND
FileFullName ContainsCIS "inetpub\\wwwroot" AND
TgtFileExtension In Contains Anycase ("jsp", "aspx", "php", "asp") AND
SrcProcName Not In ("explorer.exe", "msdeploy.exe", "w3wp.exe")

SrcProcCmdLine ContainsCIS "New-CimInstance -Namespace root/subscription" OR
SrcProcCmdScript ContainsCIS "New-CimInstance -Namespace root/subscription" OR
SrcProcCmdLine ContainsCIS "__EventFilter" OR
SrcProcCmdLine ContainsCIS "CommandLineEventConsumer"

SrcProcCmdLine ContainsCIS "UserInitMprLogonScript" OR
(RegistryKeyPath ContainsCIS "UserInitMprLogonScript" AND
 EventType = "Registry Value Create")

-- Common UAC bypass registry keys
(SrcProcCmdLine ContainsCIS "ms-settings\\shell\\open\\command" OR
SrcProcCmdLine ContainsCIS "mscfile\\shell\\open\\command") OR
-- CMSTPLUA COM bypass
(TgtProcDisplayName = "COM Surrogate" AND
TgtProcCmdLine ContainsCIS "{3E5FC7F9-9A51-4367-9063-A120244FBEC7}")

-- Token impersonation indicators
SrcProcCmdLine ContainsCIS "ImpersonateLoggedOnUser" OR
SrcProcCmdScript ContainsCIS "ImpersonateLoggedOnUser" OR
SrcProcCmdLine ContainsCIS "DuplicateTokenEx" OR
SrcProcCmdScript ContainsCIS "DuplicateTokenEx"

-- Event log clearing
(TgtProcName = "wevtutil.exe" AND TgtProcCmdLine ContainsCIS "cl ") OR
((SrcProcCmdLine ContainsCIS "Clear-EventLog" OR
  SrcProcCmdScript ContainsCIS "Clear-EventLog") AND
 SrcProcParentName Not In ("WmiPrvSE.exe", "svchost.exe"))

-- Disable Defender
TgtProcCmdLine ContainsCIS "Set-MpPreference" AND
TgtProcCmdLine ContainsCIS "DisableRealtimeMonitoring"
 
-- Disable Sysmon
(TgtProcName = "fltmc.exe" AND TgtProcCmdLine ContainsCIS "unload SysmonDrv") OR
(TgtProcName = "sysmon.exe" AND TgtProcCmdLine ContainsCIS "-u")
 
-- AMSI bypass
SrcProcCmdLine ContainsCIS "AmsiUtils" AND SrcProcCmdLine ContainsCIS "amsiInitFailed" OR
SrcProcCmdScript ContainsCIS "AmsiUtils" AND SrcProcCmdScript ContainsCIS "amsiInitFailed"

-- Disable Windows Firewall
TgtProcName = "netsh.exe" AND TgtProcCmdLine ContainsCIS "state off"
 
-- Add firewall rules
TgtProcName = "netsh.exe" AND
TgtProcCmdLine ContainsCIS "add rule" AND
TgtProcCmdLine ContainsCIS "dir=in"

-- Mshta spawning processes or loading remote content
(SrcProcName = "mshta.exe" AND EventType = "Open Remote Process Handle") OR
(SrcProcName = "mshta.exe" AND
 SrcProcCmdLine RegExp "https?:\\/\\/(www\\.)?[-a-zA-Z0-9@:%._\\+~#=]{1,256}\\.[a-zA-Z0-9()]{1,6}\\b")

-- Rundll32 with suspicious arguments
TgtProcName = "rundll32.exe" AND
(TgtProcCmdLine ContainsCIS "javascript:" OR
 TgtProcCmdLine ContainsCIS "vbscript:" OR
 TgtProcCmdLine ContainsCIS "shell32.dll,Control_RunDLL" OR
 TgtProcCmdLine ContainsCIS ",#")

-- MavInject usage
TgtProcName = "mavinject.exe" AND
TgtProcCmdLine ContainsCIS "/injectrunning" AND
SrcProcName Not In ("AppVClient.exe") AND
SrcProcParentName Not In ("smss.exe")
 
-- Process hollowing indicators
SrcProcCmdScript ContainsCIS "Start-Hollow" OR
TgtProcCmdLine ContainsCIS "Start-Hollow"

-- BITS download
((TgtProcName In Contains Anycase ("bitsadmin.exe", "desktopimgdownldr.exe") AND
  TgtProcCmdLine RegExp "https?:\\/\\/") OR
 (TgtProcName = "powershell.exe" AND TgtProcCmdLine ContainsCIS "Start-BitsTransfer")) AND
SrcProcParentName Not In ("services.exe", "smss.exe", "wininit.exe")

-- LSASS access
TgtProcName = "lsass.exe" AND
EventType = "Open Remote Process Handle" AND
SrcProcName Not In ("svchost.exe", "lsm.exe", "wmiprvse.exe", "taskmgr.exe",
"procexp64.exe", "procexp.exe", "MsMpEng.exe")
 
-- Mimikatz indicators
TgtProcCmdLine In Contains Anycase ("sekurlsa::", "lsadump::", "kerberos::",
"privilege::debug", "token::elevate")

-- SAM/SYSTEM registry access
(TgtProcCmdLine ContainsCIS "reg save" AND
 TgtProcCmdLine In Contains Anycase ("sam", "system", "security")) OR
(SrcProcCmdLine ContainsCIS "Copy-Item" AND
 SrcProcCmdLine ContainsCIS "config\\SAM")

-- Kerberoast indicators
SrcProcCmdLine ContainsCIS "Invoke-Kerberoast" OR
SrcProcCmdScript ContainsCIS "Invoke-Kerberoast" OR
(TgtProcCmdLine ContainsCIS "setspn" AND TgtProcCmdLine ContainsCIS "-Q")

-- Searching for credential files
(TgtProcCmdLine ContainsCIS "findstr" OR TgtProcCmdLine ContainsCIS "Select-String") AND
TgtProcCmdLine In Contains Anycase ("password", "credential", "secret", "apikey", "token")

-- Local account enumeration
TgtProcCmdLine In Contains Anycase ("net user", "net localgroup", "Get-LocalUser",
"Get-LocalGroupMember", "whoami /all")
 
-- Domain account enumeration
TgtProcCmdLine In Contains Anycase ("net group /domain", "Get-ADUser", "Get-ADGroup",
"Get-ADGroupMember", "dsquery")

TgtProcCmdLine In Contains Anycase ("systeminfo", "hostname", "Get-ComputerInfo",
"wmic computersystem get", "wmic os get")

TgtProcCmdLine In Contains Anycase ("dir /s", "Get-ChildItem -Recurse", "tree /f",
"find / -name", "ls -laR") AND
TgtProcCmdLine In Contains Anycase ("password", "credential", "config", "backup")

TgtProcCmdLine In Contains Anycase ("net share", "net view", "Get-SmbShare",
"Get-WmiObject Win32_Share")

-- Mimikatz PTH/PTT
TgtProcCmdLine In Contains Anycase ("sekurlsa::pth", "/ntlm:", "kerberos::ptt")

-- RDP session hijacking
SrcProcName = "tscon.exe" AND SrcProcCmdLine ContainsCIS "/dest:"

-- Scripted RDP credential storage
TgtProcName = "cmdkey.exe" AND
TgtProcCmdLine ContainsCIS "/generic:TERMSRV" AND
TgtProcCmdLine ContainsCIS "/user:" AND
TgtProcCmdLine ContainsCIS "/pass:"

-- Net use and PSDrive mapping
TgtProcCmdLine ContainsCIS "New-PSDrive" OR
(TgtProcName = "net.exe" AND TgtProcCmdLine ContainsCIS "use ")

-- WinRM/WMIC/PsExec lateral movement
(TgtProcCmdLine ContainsCIS "MMC20.application" AND
 TgtProcCmdLine ContainsCIS "ExecuteShellCommand") OR
(TgtProcName = "wmic.exe" AND TgtProcCmdLine ContainsCIS "/node:" AND
 TgtProcCmdLine ContainsCIS "process call create") OR
((SrcProcName ContainsCIS "psexec.exe" OR
  SrcProcDisplayName = "Execute processes remotely") AND DstIp Is Not Empty)

-- Data staging via archive
TgtProcName In ("7z.exe", "7za.exe", "rar.exe", "zip.exe", "tar.exe") OR
(TgtProcName = "powershell.exe" AND
 TgtProcCmdLine ContainsCIS "Compress-Archive")

SrcProcCmdLine ContainsCIS "[System.Windows.Forms.Screen]" OR
SrcProcCmdScript ContainsCIS "[System.Windows.Forms.Screen]" OR
SrcProcCmdLine ContainsCIS "CopyFromScreen"

-- DNS exfiltration (long subdomains)
EventType = "DNS Resolved" AND
DnsRequest RegExp "^[a-zA-Z0-9]{30,}\\."
 
-- Exfil over ICMP
TgtProcName = "ping.exe" AND
TgtProcCmdLine ContainsCIS "-l" AND
TgtProcCmdLine RegExp "-l [0-9]{4,}"

-- Uploads to file sharing services
DnsRequest In Contains Anycase ("dropbox.com", "drive.google.com", "onedrive.live.com",
"mega.nz", "sendspace.com", "wetransfer.com", "file.io") AND
SrcProcName Not In ("OneDrive.exe", "Dropbox.exe", "googledrivesync.exe")

-- Suspicious HTTP/HTTPS connections
EventType = "IP Connect" AND
DstPort In (80, 443, 8080, 8443) AND
SrcProcName Not In ("chrome.exe", "firefox.exe", "msedge.exe", "iexplore.exe",
"outlook.exe", "teams.exe", "slack.exe") AND
SrcProcVerifiedStatus != "verified"

-- Suspicious DNS queries (potential C2 or tunneling)
EventType = "DNS Resolved" AND
(DnsRequest RegExp "^[a-zA-Z0-9-]{20,}\\." OR  -- Long subdomain
 DnsRequest RegExp "\\.(xyz|top|tk|ml|ga|cf|gq)$")  -- Suspicious TLDs

-- Connections on non-standard ports
EventType = "IP Connect" AND
DstPort Not In (20, 21, 22, 23, 25, 53, 80, 110, 123, 143, 443, 445, 993, 995,
3389, 5985, 5986) AND
NetConnStatus = "SUCCESS"

-- Find the Storyline ID from initial event
-- Then query all related events
StorylineId = "1234567890abcdef..."

-- From process to all child processes
SrcProcParentName = "suspicious.exe"
 
-- From file to creating process
FileFullName = "C:\\Users\\user\\malware.exe" AND EventType = "File Creation"
 
-- From network to process
DstIp = "192.168.100.100" AND EventType = "IP Connect"
 
-- From hash to all instances
FileSha256 = "abc123..."
 
-- From user to all activity
SrcProcUser ContainsCIS "compromised_user"
 
-- From endpoint to all events
AgentName = "INFECTED-PC"

## Threat Investigation Checklist
 
Alert/Finding: _________________
Date/Time: _________________
Analyst: _________________
 
### Initial Triage
- [ ] Review alert details and severity
- [ ] Identify affected endpoint(s)
- [ ] Note initial IOCs (hash, IP, domain)
 
### Scope Assessment
- [ ] Search for IOCs across all endpoints
- [ ] Check for lateral movement indicators
- [ ] Identify affected users/accounts
- [ ] Determine data at risk
 
### Timeline Reconstruction
- [ ] Query Storyline for full context
- [ ] Document initial access vector
- [ ] Map attack progression
- [ ] Identify persistence mechanisms
 
### Evidence Collection
- [ ] Export relevant Deep Visibility data
- [ ] Fetch suspicious files for analysis
- [ ] Capture Remote Shell investigation
- [ ] Screenshot key findings
 
### Response Actions
- [ ] Isolate affected endpoints
- [ ] Kill malicious processes
- [ ] Quarantine malicious files
- [ ] Initiate rollback if needed
 
### Documentation
- [ ] Complete investigation notebook
- [ ] Create STAR rule for detection
- [ ] Update IOC list
- [ ] Prepare incident report

function Invoke-S1DeepVisibilityQuery {
    param(
        [Parameter(Mandatory=$true)]
        [string]$ApiToken,
 
        [Parameter(Mandatory=$true)]
        [string]$ConsoleUrl,
 
        [Parameter(Mandatory=$true)]
        [string]$Query,
 
        [string]$SiteId,
        [string]$FromDate = (Get-Date).AddDays(-1).ToString("yyyy-MM-ddTHH:mm:ss.fffZ"),
        [string]$ToDate = (Get-Date).ToString("yyyy-MM-ddTHH:mm:ss.fffZ"),
        [int]$Limit = 1000
    )
 
    $headers = @{
        "Authorization" = "ApiToken $ApiToken"
        "Content-Type" = "application/json"
    }
 
    $body = @{
        query = $Query
        fromDate = $FromDate
        toDate = $ToDate
        limit = $Limit
    }
 
    if ($SiteId) {
        $body.siteIds = @($SiteId)
    }
 
    $bodyJson = $body | ConvertTo-Json
 
    try {
        $response = Invoke-RestMethod -Uri "$ConsoleUrl/web/api/v2.1/dv/query" `
            -Method POST -Headers $headers -Body $bodyJson
 
        return $response.data
    }
    catch {
        Write-Error "Query failed: $($_.Exception.Message)"
        return $null
    }
}
 
# Example usage
$results = Invoke-S1DeepVisibilityQuery `
    -ApiToken "YOUR_API_TOKEN" `
    -ConsoleUrl "https://tenant.sentinelone.net" `
    -Query 'EventType = "Process Creation" AND SrcProcName = "powershell.exe" AND SrcProcCmdLine ContainsCIS "-enc"'
 
$results | Format-Table AgentName, SrcProcCmdLine -AutoSize

<#
.SYNOPSIS
    Automated threat hunting script for SentinelOne Deep Visibility
.DESCRIPTION
    Runs predefined hunting queries and exports results
#>
 
param(
    [Parameter(Mandatory=$true)]
    [string]$ApiToken,
 
    [Parameter(Mandatory=$true)]
    [string]$ConsoleUrl,
 
    [string]$OutputPath = "C:\ThreatHunting\Results"
)
 
$huntingQueries = @(
    @{
        Name = "Encoded_PowerShell"
        Query = 'EventType = "Process Creation" AND SrcProcName = "powershell.exe" AND SrcProcCmdLine ContainsCIS "-enc"'
        MITRE = "T1059.001"
    },
    @{
        Name = "LSASS_Access"
        Query = 'TgtProcName = "lsass.exe" AND EventType = "Open Remote Process Handle" AND SrcProcName Not In ("svchost.exe","lsm.exe","wmiprvse.exe")'
        MITRE = "T1003.001"
    },
    @{
        Name = "Scheduled_Task_Creation"
        Query = 'IndicatorName = "ScheduleTaskRegister" AND SrcProcParentName Not In ("services.exe","OfficeClickToRun.exe")'
        MITRE = "T1053.005"
    },
    @{
        Name = "Event_Log_Clearing"
        Query = '(TgtProcName = "wevtutil.exe" AND TgtProcCmdLine ContainsCIS "cl ") OR (SrcProcCmdLine ContainsCIS "Clear-EventLog")'
        MITRE = "T1070.001"
    },
    @{
        Name = "Web_Shell_Detection"
        Query = 'EventType = "File Creation" AND FileFullName ContainsCIS "inetpub\wwwroot" AND TgtFileExtension In Contains Anycase ("jsp","aspx","php")'
        MITRE = "T1505.003"
    }
)
 
$headers = @{
    "Authorization" = "ApiToken $ApiToken"
    "Content-Type" = "application/json"
}
 
# Ensure output directory exists
New-Item -Path $OutputPath -ItemType Directory -Force | Out-Null
 
$timestamp = Get-Date -Format "yyyyMMdd-HHmmss"
$summaryResults = @()
 
foreach ($hunt in $huntingQueries) {
    Write-Host "Running hunt: $($hunt.Name) [$($hunt.MITRE)]" -ForegroundColor Cyan
 
    $body = @{
        query = $hunt.Query
        fromDate = (Get-Date).AddDays(-1).ToString("yyyy-MM-ddTHH:mm:ss.fffZ")
        toDate = (Get-Date).ToString("yyyy-MM-ddTHH:mm:ss.fffZ")
        limit = 10000
    } | ConvertTo-Json
 
    try {
        $response = Invoke-RestMethod -Uri "$ConsoleUrl/web/api/v2.1/dv/query" `
            -Method POST -Headers $headers -Body $body
 
        $resultCount = $response.data.Count
 
        $summaryResults += [PSCustomObject]@{
            Hunt = $hunt.Name
            MITRE = $hunt.MITRE
            Results = $resultCount
            Status = if ($resultCount -gt 0) { "FINDINGS" } else { "Clear" }
        }
 
        if ($resultCount -gt 0) {
            Write-Host "  [!] Found $resultCount results" -ForegroundColor Yellow
 
            # Export results
            $outputFile = Join-Path $OutputPath "$($hunt.Name)_$timestamp.csv"
            $response.data | Export-Csv -Path $outputFile -NoTypeInformation
            Write-Host "  [+] Exported to: $outputFile" -ForegroundColor Green
        }
        else {
            Write-Host "  [OK] No findings" -ForegroundColor Green
        }
    }
    catch {
        Write-Host "  [ERROR] Query failed: $($_.Exception.Message)" -ForegroundColor Red
        $summaryResults += [PSCustomObject]@{
            Hunt = $hunt.Name
            MITRE = $hunt.MITRE
            Results = -1
            Status = "ERROR"
        }
    }
 
    Start-Sleep -Seconds 2  # Rate limiting
}
 
# Display summary
Write-Host "`n=== Hunting Summary ===" -ForegroundColor Cyan
$summaryResults | Format-Table -AutoSize
 
# Export summary
$summaryFile = Join-Path $OutputPath "HuntingSummary_$timestamp.csv"
$summaryResults | Export-Csv -Path $summaryFile -NoTypeInformation
Write-Host "Summary exported to: $summaryFile"
 
# Alert on findings
$findings = $summaryResults | Where-Object { $_.Status -eq "FINDINGS" }
if ($findings) {
    Write-Host "`n[ALERT] $($findings.Count) hunts returned findings - review required!" -ForegroundColor Red
}