Threat Hunting Tools

Data sources · Updated 2026-10-18

How threat hunting tools reach your data

Named sources and published data-access models.

Editorial assessment · From vendor product pages, docs and announcements · Updated 2026-10-18

Which sources does each tool name?

Where each tool hunts: data source types named by 7 threat hunting toolsArtemis Security names all six source types. Mars Security, Nebulock and Cotool name five. Anvilogic names three. CardinalOps names two. Vega names none on its public pages. How it reaches the data: Mars Security: Queries in place, no ingestion. For cloud logs: "No new data copy. No second retention clock." "The SIEM keeps its compliance and retention jobs." Nebulock: Federated search. Helix federated search "to get data just-in-time, not just-in-case". Public pages do not say what data is retained in the platform. Anvilogic: Queries in place; standalone mode also offered. "One query across Splunk, Snowflake, Sentinel, S3, and more, without moving the data"; augment, standalone or combined deployment. Cotool: Stores some logs, queries the rest. "Logs you store in Cotool are optimized for agents" and "a detection can run against logs in Cotool or directly against the tools where your data already lives." Vega: Queries in place. "No migration, ingestion, or egress." Artemis Security: Ingests hot-path data, queries the rest. "Hot-path data ingested, high-volume data queried where it lives." Its connectors page lists Splunk, Microsoft Sentinel, Exabeam, LogRhythm and CrowdStrike NG-SIEM among ingested sources. CardinalOps: Works inside the SIEM and EDR. Connects through native APIs and delivers rules in their native syntax; a separate data store is not described.SIEMEDRIdentity providerCloud logsData lake or warehouseSaaS appsMars SecurityMars Security, SIEM: Named (Splunk)Mars Security, EDR: Named (CrowdStrike Falcon)Mars Security, Identity provider: Named (identity providers)Mars Security, Cloud logs: Named (AWS telemetry, Wiz)Mars Security, Data lake or warehouse: Named (Snowflake, Databricks)Mars Security, SaaS apps: Not named5 of 6 namedNebulockNebulock, SIEM: Named (Microsoft Sentinel)Nebulock, EDR: Named (CrowdStrike, Microsoft Defender, SentinelOne)Nebulock, Identity provider: Named (Okta, Microsoft Entra, Duo)Nebulock, Cloud logs: Named (AWS CloudTrail)Nebulock, Data lake or warehouse: Not namedNebulock, SaaS apps: Named (Jamf, GitHub)5 of 6 namedAnvilogicAnvilogic, SIEM: Named (Splunk, Microsoft Sentinel, CrowdStrike NG-SIEM, Elastic)Anvilogic, EDR: Not namedAnvilogic, Identity provider: Not namedAnvilogic, Cloud logs: Named (S3, Azure Blob, GCS object storage)Anvilogic, Data lake or warehouse: Named (Snowflake, Databricks, Azure Data Explorer, Amazon Security Lake, Microsoft Fabric)Anvilogic, SaaS apps: Not named3 of 6 namedCotoolCotool, SIEM: Named (Splunk, Panther)Cotool, EDR: Named (CrowdStrike, Microsoft Defender, SentinelOne)Cotool, Identity provider: Named (Okta)Cotool, Cloud logs: Not namedCotool, Data lake or warehouse: Named (Snowflake, Databricks)Cotool, SaaS apps: Named (Code42, Kandji, Jira)5 of 6 namedVegaVega, SIEM: Not namedVega, EDR: Not namedVega, Identity provider: Not namedVega, Cloud logs: Not namedVega, Data lake or warehouse: Not namedVega, SaaS apps: Not named0 of 6 namedArtemis SecurityArtemis Security, SIEM: Named (Splunk, Microsoft Sentinel, Google SecOps and others)Artemis Security, EDR: Named (CrowdStrike, Defender XDR, SentinelOne)Artemis Security, Identity provider: Named (Entra ID, Okta)Artemis Security, Cloud logs: Named (AWS Security Lake, AWS Athena)Artemis Security, Data lake or warehouse: Named (Snowflake, BigQuery)Artemis Security, SaaS apps: Named (the homepage names SaaS among the sources it correlates)6 of 6 namedCardinalOpsCardinalOps, SIEM: Named (SIEM via native APIs (platforms not named))CardinalOps, EDR: Named (EDR via native APIs; CrowdStrike Marketplace)CardinalOps, Identity provider: Not namedCardinalOps, Cloud logs: Not namedCardinalOps, Data lake or warehouse: Not namedCardinalOps, SaaS apps: Not named2 of 6 named
  • Named
  • Not named
Where each tool hunts, as a table: for each tool and data source type, whether its public pages name it, with the examples named.
ToolSIEMEDRIdentity providerCloud logsData lake or warehouseSaaS appsNamedHow it reaches the data
Mars SecurityNamedSplunkNamedCrowdStrike FalconNamedidentity providersNamedAWS telemetry, WizNamedSnowflake, DatabricksNot named5 of 6Queries in place, no ingestion

For cloud logs: "No new data copy. No second retention clock." "The SIEM keeps its compliance and retention jobs."

Source: marssec.ai/guides/cloud-threat-hunting · Read 2026-10-18 · marssec.ai/guides/ai-threat-hunting · Read 2026-10-18 · Source dates shown above

NebulockNamedMicrosoft SentinelNamedCrowdStrike, Microsoft Defender, SentinelOneNamedOkta, Microsoft Entra, DuoNamedAWS CloudTrailNot namedNamedJamf, GitHub5 of 6Federated search

Helix federated search "to get data just-in-time, not just-in-case". Public pages do not say what data is retained in the platform.

Source: nebulock.io/platform · Read 2026-10-18 · Source dates shown above

AnvilogicNamedSplunk, Microsoft Sentinel, CrowdStrike NG-SIEM, ElasticNot namedNot namedNamedS3, Azure Blob, GCS object storageNamedSnowflake, Databricks, Azure Data Explorer, Amazon Security Lake, Microsoft FabricNot named3 of 6Queries in place; standalone mode also offered

"One query across Splunk, Snowflake, Sentinel, S3, and more, without moving the data"; augment, standalone or combined deployment.

Source: www.anvilogic.com · Read 2026-10-18 · Source dates shown above

CotoolNamedSplunk, PantherNamedCrowdStrike, Microsoft Defender, SentinelOneNamedOktaNot namedNamedSnowflake, DatabricksNamedCode42, Kandji, Jira5 of 6Stores some logs, queries the rest

"Logs you store in Cotool are optimized for agents" and "a detection can run against logs in Cotool or directly against the tools where your data already lives."

Source: www.cotool.ai · Read 2026-10-18 · www.cotool.ai/detect · Read 2026-10-18 · Source dates shown above

VegaNot namedNot namedNot namedNot namedNot namedNot named0 of 6Queries in place

"No migration, ingestion, or egress."

Source: vega.io · Read 2026-10-18 · Source dates shown above

Artemis SecurityNamedSplunk, Microsoft Sentinel, Google SecOps and othersNamedCrowdStrike, Defender XDR, SentinelOneNamedEntra ID, OktaNamedAWS Security Lake, AWS AthenaNamedSnowflake, BigQueryNamedthe homepage names SaaS among the sources it correlates6 of 6Ingests hot-path data, queries the rest

"Hot-path data ingested, high-volume data queried where it lives." Its connectors page lists Splunk, Microsoft Sentinel, Exabeam, LogRhythm and CrowdStrike NG-SIEM among ingested sources.

Source: artemissecurity.com/connectors · Read 2026-10-19 · Source dates shown above

CardinalOpsNamedSIEM via native APIs (platforms not named)NamedEDR via native APIs; CrowdStrike MarketplaceNot namedNot namedNot namedNot named2 of 6Works inside the SIEM and EDR

Connects through native APIs and delivers rules in their native syntax; a separate data store is not described.

Source: cardinalops.com · Read 2026-10-18 · Source dates shown above

Notes and sources

Figure 1. Where each tool hunts. Data source types each vendor's public pages name as hunted or queried in place, reviewed 2026-10-18. This records published claims, not tested integrations.

Ingestion or federated search: why it matters

Some tools query each source where it sits, often called federated search. Others copy some of the data into their own platform first, which is ingestion. Copying data in adds a second pipeline and a second store to run and pay for, next to a SIEM that already collects, stores and correlates the same events. Querying in place leaves the SIEM as the system of record. We score this under 'Works across existing SIEM and data lakes' (20%). This site does not rank or compare SIEM products; they appear only as data sources.

Where a tool ingests, ask which sources are copied, what the ingested data costs (none of these tools publishes a price) and how much of that work your SIEM already does. Artemis Security, for example, ingests hot-path data and lists five SIEM platforms among its ingested connectors, so the same events can be stored and processed in two places. Where a tool says it queries in place, ask which sources it names and how queries are written for each one.