top / rare, eval and timechart

What is it?

`top` and `rare` rank a field's most/least common values. `eval` builds a new field from an expression (e.g. a category, a length, a ratio). `timechart` aggregates over time buckets so you can see a pattern — a beacon, a spike — as a line.

Why it matters

`rare` is a hunter's friend: the least-frequent parent process or user-agent is often the intrusion. `timechart` turns a beacon's fixed rhythm into an obvious shape, and `eval` lets you compute the signal a raw field does not carry.

Where you see it

`... | rare limit=10 parent_process`, `... | eval mb=bytes/1048576`, `... | timechart span=1m count by dest` — a beaconing host draws a flat, evenly-spaced line.

What normal looks like

Normal `top` results are unsurprising (explorer.exe, chrome.exe); normal timecharts are irregular, following human activity that ebbs and flows.

What suspicious looks like

A rare value with no benign explanation (winword.exe as a parent of powershell), or a timechart that is suspiciously regular — the same small count every minute is automation, not a person.

How analysts investigate

Use rare to find the low-frequency tail, validate each outlier for a benign cause, use eval to compute a discriminating field, and use timechart to test whether a suspicious pair has a machine-like rhythm.

Common beginner mistakes

Treating every rare value as malicious — most rare things are benign; validate before escalating.
Reading a timechart without a span, so buckets are too coarse to reveal a per-minute beacon.

Rank the tail, compute the signal, see it over time

  ... process events | rare limit=5 parent_process    → the low-frequency tail (hunt output)
  ... | eval enc = if(match(cmdline,"-enc"), 1, 0)    → derive a discriminating field
  ... dest=45.9.148.200 | timechart span=1m count
     00:00 ▇  00:01 ▇  00:02 ▇  00:03 ▇   ← flat, evenly spaced = a beacon (automation)

rare surfaces outliers, eval computes a signal, timechart exposes a machine-like rhythm.

Quick check

A host connects to one external IP with the same tiny byte count every 60 seconds. Which command makes this obvious?

A quick self-check — it doesn't affect your XP or progress.