Skip to the content

Events and hunting

What happened, kept append-only, and what is rare enough to look at.

In the consoleEventsHunt

The event store

aertun spool stats
aertun spool verify
aertun spool retain --apply
aertun spool hold NAME --why "litigation hold"

Retention never deletes what a hold covers, and a hold is lifted by name.

One person, many accounts

aertun identity link okta:00u1abc dana@example.com
aertun identity list

Hunting

aertun telemetry fields events.jsonl
aertun hunt --field raw.user_agent --by actor events.jsonl
aertun triage events.jsonl --rules ./rules

A hunt counts one field's values and shows the rarest, which is what is worth a look. The Hunt screen does the same over the store, and offers what you found as the start of a rule.