Threat Hunting Queries & Investigation Workspace UI

Quick answer

Threat hunting UI lets analysts search across logs, pivot on entities (user, IP, hash), and build a timeline—not just react to alerts. Design a query builder with field picker, time range, and saved hunts; results table with pivot actions; entity timeline merging auth, network, and app events; investigation canvas linking alerts, IOCs, and automation runs; and case export for incident runbooks. Start from the Figma guides hub and pair with SIEM ingestion, audit log, sessions, and Dev Mode handoff.

Who this is for

Product designers building SOC investigation workspaces, hunt notebooks, and entity-centric timelines for enterprise Security consoles.
Design system teams aligning query chips with search UI, tables, and badges for severity and entity type.
Engineers implementing query DSL, cross-index joins, pivot caching, and investigation state persistence with RBAC.

Hunt library (saved queries hub)

HuntLibrary
├── Header: Threat hunting · [ New query ] [ Scheduled hunts ] [ Shared with team ]
├── Summary: 48 saved hunts · 6 scheduled · 12 ran this week
├── Filters: Data source · Author · Tag · Last run outcome
└── Row: Impossible travel follow-up · SIEM + Auth · Last run: 3 hits · Owner: SOC Tier 2

Column	Content
Hunt name	”Rare admin API calls after hours”
Data sources	Auth logs, SIEM, app audit, DNS
Schedule	Manual / Daily / Weekly / On new IOC
Last run	Hit count, duration, anomaly score
Shared	Team library vs personal draft
Linked playbook	Incident runbook step reference

Verdict: library separates proactive hunts (scheduled) from reactive pivots (spawned from alert or IOC).

Promote high-signal hunts to automation triggers when pattern stabilizes.

Query builder

QueryBuilder
├── Data source: Authentication logs · Index: auth-* · Time: Last 7 days
├── Filters:
│   ├── event_type = login_failure
│   ├── count_by(user_id) > 5
│   └── geo.country NOT IN allowlist_countries
├── Group by: user_id, source_ip
├── Visualization: Table · [ Run ] [ Save ] [ Schedule ]
└── Query assist: "Show similar to alert #8842"

Control	UI detail
Field picker	Autocomplete with type (string, IP, timestamp, enum)
Time range	Relative presets + absolute; timezone label for global teams
Aggregations	count, distinct, rate, percentile—for hunt not just filter
Join hint	”Enrich with user profile” pulls HR/identity attributes
Query history	Undo stack; compare last 3 runs
Cost estimate	”Scans ~2.1M events” before Run on large ranges
RBAC	Restrict raw log fields per team role

Use combobox for field names; sliders for threshold tuning.

Query assist: paste alert ID or IOC value—pre-fill filters from alert context.

Results table and pivot actions

ResultsTable
├── 23 entities · Sort: failure_count desc
├── Row: jchen@acme.com · 14 failures · 8 source IPs · Last: 2h ago
├── Pivot: [ View timeline ] [ All sessions ] [ Related alerts ] [ Add IOC ]
└── Bulk: [ Open investigation ] [ Assign analyst ] [ Export CSV ]

Pivot action	Destination
View entity timeline	Investigation workspace (user-centric)
Pivot on IP	New query with IP as anchor
Related alerts	Filtered alert inbox
Add to case	Attach rows to open investigation
Promote to IOC	Threat intel review queue
Run workflow	Automation dry-run on selection

Right-click row for context menu—mirror dropdown patterns.

Empty results: suggest broader time range or linked hunt template—not blank screen.

Investigation workspace (case canvas)

InvestigationWorkspace
├── Case: INV-2026-0412 · Credential stuffing hypothesis · Status: Open
├── Entities: jchen@acme.com · 185.220.101.42 · AS12345 · Alert #8842
├── Tabs: Timeline · Graph · Notes · Evidence · Actions
├── Timeline (merged):
│   ├── 3:10 PM — 12 login failures (jchen) from 185.220.101.42
│   ├── 3:12 PM — [Alert fired](/designing-security-alerting-rules-and-notification-routing-ui-in-figma/) Impossible travel
│   ├── 3:15 PM — [Automation run](/designing-security-automation-and-response-workflows-ui-in-figma/) #4521 started
│   └── 3:17 PM — Session revoke approved
└── Actions: [ Escalate ] [ Close as FP ] [ Link runbook ] [ Export case ]

Tab	Content
Timeline	Chronological merge of auth, network, app, alert, automation events
Graph	Entity nodes (user ↔ IP ↔ device ↔ app) with edge weights
Notes	Analyst markdown; @mention; pinned hypotheses
Evidence	Saved query snapshots, redacted log excerpts, screenshots
Actions	Assign, severity, link runbook, trigger workflow

Hypothesis strip: editable “We think X because Y”—drives recommended next pivots.

Assign cases with team roles—Tier 1 vs Tier 2 vs IR lead.

Entity timeline detail

EntityTimeline — user: jchen@acme.com · Last 30 days
├── Filter: Auth · App · Admin · Network
├── 2026-07-23 3:10 PM — login_failure ×12 · IPs: 185.220.*, 198.51.*
├── 2026-07-23 3:18 PM — session_revoked · automation step 4
├── 2026-07-22 — login_success · Seattle · MFA pass
└── Anomaly band: Unusual IP cluster highlighted

Event type	Visual
Auth	Login success/fail, MFA, password reset
Session	New session, revoke—link active sessions
Admin	Role change, API key created
Network	DNS, proxy, IP allowlist hit
Alert / Run	Inline chip linking source system
IOC match	Feed indicator overlay on IP/hash

Zoom presets: 24h, 7d, 30d; brush select to spawn sub-query.

Use progress indicators when loading large timelines—show partial results streaming.

Scheduled hunts and hit review

ScheduledHuntReview
├── Hunt: Rare OAuth scope grants · Ran 6:00 AM · 2 new hits
├── Hit 1: app_id=legacy-crm · scope=admin · user=contractor@vendor.com
├── Analyst action: [ Investigate ] [ Suppress 30d ] [ False positive ]
└── Auto-case: Create draft investigation when hits > 0 and severity ≥ Medium

Pattern	UI detail
Hit notification	Route via alert channels
Suppress	Time-boxed; documents reason in audit log
Auto-case	Optional; prevents hits sitting unreviewed
Hunt diff	Compare hit count vs prior run—spike badge
Tune hunt	Inline “Edit query” without leaving review

Pair with posture dashboard—track % hunts reviewed within SLA.

Collaboration and handoff

CaseHandoff
├── Assignee: Ana Liu → Marcus Chen · Reason: Escalation Tier 2
├── Handoff note: Pivot on AS12345; 3 other users same /24
├── Preserved: 4 saved queries · 2 hypotheses · Timeline bookmark 3:10–3:20 PM
└── Member impact: Account locked — link [recovery UI](/designing-suspicious-login-alerts-and-account-recovery-ui-in-figma/)

Feature	Purpose
@mention in notes	Notify assignee without email thread
Query snapshot	Immutable evidence—even if index retention expires
Timeline bookmark	Share deep link to 10-minute window
Export pack	PDF + JSON for compliance export
Legal hold	Freeze case evidence—investigation immutability flag

Read-only viewers: auditors with custom role—no pivot actions, export only.

Prebuilt hunt templates

Template	Anchor entity	Data sources	Pairs with
Impossible travel follow-up	User	Auth + geo	Suspicious login
IOC sighting sweep	IP or hash	SIEM + proxy	Threat intel feeds
Admin API anomaly	Service account	App audit + API keys	PAM
Lateral movement sketch	Host / IP	VPN + internal DNS	IP allowlist
OAuth app abuse	app_id	OAuth audit + app approvals	DLP
Post-automation validation	User	Auth after workflow run	Automation history
Leaked credential check	Email domain	Dark web feed + auth	Secrets vault

Template gallery uses cards with estimated scan cost and required roles.

Common mistakes

Mistake	Why it hurts	Fix
Query builder only, no workspace	Analysts lose context between pivots	Persistent investigation canvas
Timeline single-source	Misses alert ↔ auth correlation	Merged multi-index timeline
No query cost estimate	Accidental $50k scan	Show event count before Run
PII in shared hunt links	GDPR violation	RBAC + redaction on export
No evidence snapshot	Retention deletes proof	Immutable query snapshot on case
Pivot dead-ends	Analyst re-types filters	One-click pivot from any cell
Hunts without review SLA	Scheduled noise ignored	Hit review queue with notify
Graph-only investigation	Overwhelms Tier 1	Default to table + timeline
Case close without FP feedback	Same hunt fires again	Close reason feeds hunt tuning
No link to member recovery	Locked user stuck	Surface recovery path in case

Recommended workflow

Design hunt library with schedules, data sources, and playbook links.
Build query builder with field picker, aggregations, cost estimate, and alert assist.
Add results pivots to timeline, IP, alerts, IOC, and automation actions.
Create investigation workspace with entities, hypothesis, notes, and evidence tabs.
Implement entity timeline merging auth, network, alerts, and automation events.
Wire scheduled hit review with auto-case, suppress, and audit trail.
Document query DSL and pivot API in Dev Mode.

FAQ

Hunt workspace vs audit log?

Audit log is immutable org-wide record; investigation workspace is analyst-assembled narrative with hypotheses and snapshots for one incident.

Pivot from IOC table?

Yes—“Search sightings” pre-fills SIEM query for indicator value across indexes.

Who can run destructive pivots?

Same as automation approvers—team role gates “Run workflow” from investigation; others get dry-run only.

Scheduled hunt vs alert rule?

Alerts fire on single-event thresholds; hunts find multi-event patterns. Promote stable hunts to alerts when logic crystallizes.

Case retention?

Align with data retention—open cases exempt until closed; closed cases archive per policy; legal hold overrides deletion.

Next steps

Design threat intelligence feeds and IOC management UI in Figma — feed indicators into hunt pivots
Design SIEM log ingestion and data source connectors UI in Figma — primary data source for queries
Design security automation and response workflows UI in Figma — close the loop from hunt hit to action
Design incident response runbooks and security playbooks UI in Figma — structure analyst steps inside cases
Design suspicious login alerts and account recovery UI in Figma — member-facing outcome of hunt-driven locks

Designing threat hunting queries and investigation workspace UI in Figma: pivots, timelines, and handoff