HuntDetectPowered by Armada

Start with a hunch. End with a case.

Hunt is where you go after what the rules haven't caught yet. Say the hypothesis in plain words. Armada, Convoy's AI, turns it into queries against all of your data, shows every query and every hit, suggests the next pivot, and keeps the evidence until you escalate or close with a reason. Paste a CVE and find out whether it touches you, and whether anyone has already tried it.

Start free · 14 days Run a hunt

Suggested hypotheses · from current fleet state

Are we exposed to CVE-2026-XXXXX, and has anyone tried it?Start

Are any of the source IPs from September's failed sign-in case reappearing?Start

Is anything on the file servers active at 4 a.m., outside the backup window?Start

Ask Armada, paste a hypothesis or a CVE↵ Send

Try it live

Paste a CVE. Know if it's yours.

This morning's advisory, checked against everything you run. Armada finds what's on the vulnerable build, looks for anyone who already tried it, and hands you the next question.

One hunch. Three queries. One case.

Are the sources behind September's failed sign-ins back? The exact match found nothing, which is where most people stop. Pivot, and watch Armada write the next query.

Hunt · activeLarkspur Group

Are we exposed to CVE-2026-XXXXX? It's the VPN gateway one from this morning's advisory.

ArmadaThat's the VPN gateway portal bug, fixed in firmware 7.4.3. I checked every source that reports a version: Convoy Agent inventory, the firewall and VPN logs and your cloud.

Asset	Firmware	Exposed	Patched
VPN-01	7.4.1	Yes	No
VPN-02	7.4.1	Yes	No
VPN-LAB	7.4.3	No	Yes

ArmadaTwo internet-facing gateways are on 7.4.1, which is affected. The lab unit is already on the fixed build.

Exploit attemptsAsset ownersPatch plan

Hunt

Search across assets, identities, rules…⌘K

Convoy platform nominalUTC {{ utc }}Local {{ loc }}Tick T+0000

Active tenantLarkspur Group1 act now· 1 decide todayRisk 27/100 · Guarded

SectorHealthcareRegionNAAssets2,746

Switch tenant⌘O

Active hunt

Recent hunts

File servers active at 4 a.m.

Oct 21Promoted → case

Obfuscated script · engineering OU

Oct 14Promoted → case

Slow-drip exfil baseline survey

Oct 9Closed · benign

Library

CVE exposure check

Inventory · exposure · footprint

Built-in admin tools

Unusual use · 30d

Suspicious PowerShell

Encoded · non-script parents

Off-hours service-account use

Outside maintenance window

OAuth grant fan-out

New app · 5+ grants in 10m

+ New hunt

Exposed to CVE-2026-XXXXX?Promoted → case 4473

Is the VPN gateway bug from this morning's advisory anywhere in the estate, and has anyone tried it yet?

Elapsed {{ elapsed }}

Q1Inventory · 2 of 3 gateways on the vulnerable build3 hits · 0.22s

Q2Footprint · malformed requests, then restarts on VPN-0116 hits · 0.61s

N. VegaAre we exposed to CVE-2026-XXXXX? It's the VPN gateway one from this morning's advisory.

Armada

That's the VPN gateway portal bug: unauthenticated remote code execution, CVSS 9.8, fixed in firmware 7.4.3. First question is whether it touches you at all, so I'm checking every source that reports a version: Convoy Agent inventory, the firewall and VPN logs and your cloud accounts.

Query 1Hits3 Runtime0.22s

Inventory · all sources · now
Assets running the VPN gateway firmware, any version
Show firmware, internet exposure, patch status and last seen

AssetFirmwareExposedPatchedLast seen

VPN-017.4.1YesNo2 min ago

VPN-027.4.1YesNo2 min ago

VPN-LAB7.4.3NoYes1 h ago

Two internet-facing gateways are on 7.4.1, which is affected. The lab unit is already on the fixed build.

Try pivoting on

N. VegaPivot · exploit attempts

Armada

Vulnerable isn't the same as hit. Looking for the bug's footprint on VPN-01 and VPN-02 since it went public: odd requests to the portal, crashes or restarts, and config changes.

Query 2Hits16 Runtime0.61s

Exploit footprint · since disclosure
Outside requests to the portal on VPN-01 and VPN-02
Flag malformed requests, portal restarts and config changes

203.0.113.77

16 malformed requests to VPN-01 · 03:06

Asset

VPN-01

Portal restarted twice · 03:14

Asset

VPN-02

Nothing unusual

198.51.100.23

Scanned both · no follow-up

VPN-01 took 16 malformed requests from one source, then the portal restarted twice. That fits a real attempt. No config change shows up afterwards.

Try pivoting on

N. VegaPivot · sign-ins after 03:14

Armada

Pulling VPN sessions on VPN-01 since the restarts and comparing each account with its usual pattern. I'm also checking your rule library for this CVE.

Query 3Hits4 Runtime0.38s

After the restarts · VPN-01
VPN sessions that started after 03:14, by user, against each user's usual pattern
Plus any rules in the library tagged with this CVE

User

svc-backup

First VPN sign-in ever · 03:22

User

l.osei

03:41 · usual device and place

Rule

Portal exploit attempt

Armed · tagged with this CVE

Fix

Firmware 7.4.3

Needed on VPN-01 and VPN-02

One session stands out: a service account that has never used the VPN signed in 8 minutes after the restarts. The rule for this CVE is armed, so the next attempt turns into a lead on its own.

Try pivoting on

Ask Armada, paste a hypothesis or a CVE↵ Send

Escalate · open a case

CVE-2026-XXXXX · attempt on VPN-01

SeverityCritical

AssigneeN. Vega · Senior operator

Attached3 queries · 23 hits · {{ evN }} evidence items

CommsIncident thread opens with the case

Case 4473 opened · 3 queries, 23 hits and {{ evN }} evidence items attached · N. Vega assigned

September IPs reappearing?Promoted → case 4472

Are any of the source IPs from September's failed sign-in case reappearing in the last 7 days?

Elapsed {{ elapsed }}

Q1Exact match against the September corpus0 hits · 0.31s

Q2Pivot · /24 neighbors · 2 of 4 inside September's block4 hits · 0.84s

N. VegaAre any of the source IPs from September's failed sign-in case reappearing in the last 7 days?

Armada

Reasonable framing. The September case (3104) had 47 distinct source IPs across 3 ASNs. I'll re-check those IPs against the last 7 days of authentication telemetry, then widen to the neighbors of those /24 blocks.

Query 1Hits0 Runtime0.31s

Exact match · last 7 days
Failed sign-ins from any of the 47 source IPs in case 3104
Grouped by source IP and network

No exact-IP recurrence in the last 7 days. The actor has either rotated source or paused.

Try pivoting on

N. VegaPivot · /24 neighbors

Armada

Widening to /24 neighbors of the 47 original source IPs. A softer match, but the September actor's ASN concentration was real.

Query 2Hits4 Runtime0.84s

Widen · last 7 days
Failed sign-ins from the same /24 blocks as the case 3104 sources
Keep sources that hit 2 or more users · show when each was first seen

Source IPNetworkUsersFailsFirst seen

203.0.113.42AS647217211Oct 27 14:18

203.0.113.118AS64721364Oct 27 13:51

198.51.100.12AS64721218Oct 26 22:09

192.0.2.41AS64477212Oct 24 06:42

Two of the four sit inside the same /24 block as September's primary source (AS64721, 203.0.113.0/24). That block has been quiet in your data for six months.

Try pivoting on

N. VegaPivot · users affected

Armada

Pulling the user set for the AS64721 hits and checking it against the accounts targeted in September.

Query 3Hits9 Runtime0.42s

Who they're hitting · last 7 days
Failed sign-ins from AS64721, grouped by user
Count fails and source IPs · flag anyone also targeted in case 3104

User

m.alvarez

9 fails · 2 IPs · also in the September case

User

k.tanaka

7 fails · 2 IPs · also in the September case

User

j.morais

5 fails · 1 IP · new

User

f.ying

4 fails · 1 IP · new

Two of the four are repeats from September. The actor still has at least part of the prior target list.

Try pivoting on

Ask Armada, or paste a hypothesis↵ Send

Escalate · open a case

September IPs reappearing · AS64721 cluster

SeverityHigh

AssigneeN. Vega · Senior operator

Attached3 queries · 13 hits · {{ evN }} evidence items

CommsIncident thread opens with the case

Case 4472 opened · 3 queries, 13 hits and {{ evN }} evidence items attached · N. Vega assigned

Evidence{{ evN }}

EmptyMark any Armada result as evidence with + Evidence. It travels with the case.

{{ e.t }}★

From query {{ e.q }}

Now do it on your own tenant {{ stepHint }}

How it works

You bring the hunch. Armada does the querying. You make the call.

A hunt is a conversation with your own data. Every turn is a query you can read, a result you can see and a set of pivots worth taking next, and whatever you find goes straight into the case.

Hypotheses

It suggests what to hunt.

Suggested hypotheses come from the current state of your fleet and your data: a block that went quiet, a service account that changed its hours, a new OAuth app fanning out grants. Or type your own, or paste a CVE straight from an advisory.

Queries

Every query, in the open.

Armada writes the query, runs it against all of your data and shows it, with the hit count and the runtime, on every step. Read it, copy it, run it yourself in Query. If you'd have written it differently, say so and it reruns.

QUERY 2 hits 4 · runtime 0.84s Failed sign-ins · last 7 days Same /24 as the case 3104 sources 2 or more users per source

Evidence

Evidence travels with the case.

Mark any result as evidence. When you escalate, the case opens with the hypothesis, every query, every hit and the evidence in the order you collected it. The comms thread opens with it. Nothing gets retyped.

Where it sits

Three ways to ask your data a question.

Guard, Query and Hunt all run against the same data. The difference is how much you already know.

Guard

You know what bad looks like.

Write the rule, backtest it against your own history, arm it. It fires on its own from then on and every hit becomes a lead.

Query

You know the question.

So ask it. Read-only, every table described, every run saved, results straight into the case.

Hunt

You have a hunch and no rule yet.

Say it the way you'd say it to a colleague. Armada does the querying and the pivoting, you do the judging, and the evidence is kept for you.

ThenWhat a hunt finds becomes a Guard rule, with the hunt's own queries as its backtest. Next time, it fires without anyone hunting for it.

Your first hunt, within an hour of your first source.

Connect a source, pick a suggested hypothesis, and see what your own data says.

Start free · 14 days Book a briefing