Welcome to the AC-Hunter Documentation¶
Welcome to the new web-based documentation for AC-Hunter! Starting with v7, we have moved from PDF documentation to this online format to make it easier to find what you need, stay up to date, and navigate between topics.
AC-Hunter is designed to help security teams quickly identify command-and-control (C2) and other suspicious network behaviors using intuitive dashboards and focused analytics. These docs cover everything you need to deploy, operate, and get value from AC-Hunter.
Documentation In Progress
These docs are actively being built out alongside the v7 release. More content will be added as new features are deployed. Check back often for updates and new material.
Upgrading from AC-Hunter v6?
See the Migrating from v6 to v7 guide for a roadmap covering the server move, cutting existing Zeek and Espy sensors over to ZeekShip, and upgrading docker-zeek.
Start Here¶
If you’re new to AC-Hunter, begin with the following:
- Getting Started – Prerequisites, planning, and download
- AC-Hunter Installation – Deploy AC-Hunter in your environment
- Zeek Configuration – Set up Zeek sensors and log formats
- Zeek Log Transport – Ship logs from sensors to AC-Hunter
Using AC-Hunter¶
- Analysis Overview – How AC-Hunter scores and classifies threats
- User Interface Guide – Dashboard, session details, and Settings
- Safelisting Guide – Building and managing safelists
- Cyber Deception – Deception agents and alerting
Administration¶
- Server Administration – The
huntCLI, disk monitoring, log cleanup, and routine maintenance
Support and Resources¶
- ACM Portal: Log in at the Active Countermeasures portal for FAQs, software downloads, safelist resources, video tutorials, and supporting utilities. Look for the "Where Do I Start?" page for version-specific guidance.
- Bug Reports and Support: Open a support ticket or email [email protected]. Include "ACH7" in the subject line along with a description of the issue and steps to reproduce it.
- ACM Blog: Articles on threat hunting, packet capture, and technical topics at the Active Countermeasures blog.
- ACM YouTube Channel: Webcasts and shorter videos covering AC-Hunter features and threat hunting techniques.