Per-Hunt Custom Finding Tags

Overview

When a Hannibal hunt bills to a surge pool, Guard stamps that pool's name on every finding the hunt files. Use that tag to filter results for that pool. A hunt billed to the monthly allocation does not add a custom tag.

Setting a Custom Tag When Launching a Hunt

There is no free-form Custom Tag field, and the finish step is Exit Criteria, not Finish criteria & duration.

1. Go to Insights → AI Assistant and open Launch Hannibal.
2. On Select Budget Pool, choose how the hunt is billed.
3. A hunt billed to a surge pool stamps that pool's name as the finding tag. A hunt billed to the monthly allocation does not send a custom tag.
4. Finish on Exit Criteria and launch.

Findings still receive the built-in hunt and agent-reported tags. The surge pool name is added only when that pool is selected.

How Tags Are Applied to Findings

Once the hunt is running, the platform propagates the custom tag automatically:

• The surge pool name is stored as the hunt's custom tag.
• Every finding that hunt files receives that name in addition to hunt and agent-reported.
• No manual tagging or post-processing is required.

Filtering and Reporting on Tagged Findings

Tagged findings can be located using the tag filter on Assets or Vulnerabilities.

1. Go to Assets or Vulnerabilities.
2. Use the tag filter to enter or select your custom tag value.
3. The view updates to show only findings that carry that tag.

This allows you to scope reports and triage workflows to a single hunt engagement without affecting visibility into other hunts or finding sources.

Considerations

• The tag is the surge pool name chosen before launch. It is not a field you type on Exit Criteria.
• The pool name appears alongside, not instead of, the built-in hunt and agent-reported tags.

---

Viewing Findings in the Hunt Drawer

Opening the hunt drawer for an active or completed Hannibal hunt displays all findings associated with that hunt, regardless of their lifecycle state.

Finding Visibility and Sort Order

The drawer lists findings across all lifecycle states — Demonstrated, Detected, and any other statuses — without requiring manual filter changes. Findings are sorted by criticality, with the most severe items appearing first. Within each severity tier, the most recently discovered finding ranks highest.

This means a hunt that has produced findings but has not yet reached the Demonstrated state will still show its results in the drawer. The previous behavior — which defaulted to showing only Demonstrated findings — caused hunts with no compromises yet to appear empty, which is no longer the case.

Considerations

• No filter changes are needed to see findings at earlier lifecycle stages; all states are visible by default.
• The criticality sort order is applied automatically and cannot be changed within the drawer itself.
• Findings remain accessible on Vulnerabilities for more advanced filtering and reporting.

---

Viewing an Attack Graph from a Finding

When a Hannibal hunt places a finding inside an attack graph, the Exploitation tab on that finding's detail view renders the associated attack graph directly. This lets you see where the finding sits within the broader attack chain without navigating away from the finding.

How It Works

• Open any finding that was produced by a hunt with an associated attack graph.
• Select the Exploitation tab on the finding detail view.
• The attack graph loads automatically. The camera fits the entire kill chain into the drawer pane and centers on the finding's own vulnerability node, so its position in the chain is immediately clear without any manual panning or zooming.

If no attack graph is associated with the finding, the existing Not yet exploited placeholder is shown instead. Empty or incomplete graphs do not suppress this placeholder.

Graph Layout and Camera Behavior

When the Exploitation tab opens, the graph camera behaves as follows:

• Full path in view — all nodes in the attack graph, including those at the far end of multi-hop paths, are included in the initial layout fit. No nodes are clipped off-screen on load.
• Centered on the vulnerability node — the camera opens centered on the vulnerability node for the finding you are viewing, rather than on the attacker origin.
• Consistent zoom level — padding is applied around the fitted graph so that the surrounding attack-path neighborhood remains visible at a legible zoom level.

Switching Between Multiple Attack Graphs

A single finding can appear in more than one attack graph (for example, when multiple hunts reference the same vulnerability). In that case, a switcher control appears above the graph. Each entry in the switcher displays the parsed hunt title; hovering over an entry shows the full name in a tooltip. Select an entry to load the corresponding graph.

Considerations

• The attack graph is only available on the Exploitation tab when the finding has been placed in a graph by a hunt. Manually filed findings without a hunt association will show the Not yet exploited placeholder.
• The highlighted vulnerability node corresponds to the specific finding you are viewing; other nodes in the graph represent related steps in the attack chain and are not directly linked to this finding's detail view.