We hunt what hunts you.
One library of hunts and detections, mapped to MITRE ATT&CK, filterable by tactic, technology and severity, and ready to run against your own telemetry.
Make hunting a habit.
Attackers don’t wait for the next engagement. Irate keeps hunts close to the alerts they inform, so a technique you hunt today becomes a detection you trust tomorrow.
Hunts and detections in one place.
Queries, lookup files and detection rules share one catalog. Filter by ATT&CK tactic, technology or severity; search everything; open any entry to see the exact query and the techniques it covers.
- ATT&CK tactic and technique badges on every entry
- Copy the query or open it straight in your console
- Region-aware links for multi-region estates
Hunts built on the field’s best work.
Our hunt pack covers initial access through exfiltration: impossible travel, ClickFix, encoded PowerShell, DCSync, beaconing, Tor exits and shadow SaaS. The queries are adapted from proven community work and tuned for real environments, with attribution kept.
- Organised by ATT&CK tactic
- Shared lookups: LOLBins, Tor exits, cloud ranges
- Dry-run first: see the resolved query before it runs
Coming next: hunts the agents run.
Hand off a hypothesis and let the agents run the hunt, compare against a baseline, and raise anything new into the same queue as alerts. Today, hunts run on demand by our analysts.
Bring us your backlog.
Thirty minutes, no slideware. Watch Irate work last week’s alerts on your own data.