Blauhaunt
A tool collection for filtering and visualizing logon events, designed for experienced DFIR specialists in threat hunting and incident response.
A tool collection for filtering and visualizing logon events, designed for experienced DFIR specialists in threat hunting and incident response.
Checked October 2026.
Blauhaunt is a tool collection for filtering and visualizing logon events, designed to help answer the 'Cotton Eye Joe' question (Where did you come from where did you go) in Security Incidents and Threat Hunts. It provides an interactive user graph, heatmap of user activities, and timeline, and is designed for experienced DFIR specialists.
The tool is easy to use, with no backend, and can be run locally by cloning the repository and running a simple HTTP server.
Blauhaunt integrates with various tools and services, including PowerShell Script, Velociraptor Artifact, and Defender 365 KUSTO Query, making it a valuable resource for threat hunting and incident response.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about Blauhaunt: features, pricing and alternatives.
Blauhaunt is a product in the Threat Hunting category. It covers Log Management.
Blauhaunt is free. Download and setup instructions are at https://github.com/cgosec/Blauhaunt/.
Alternatives to Blauhaunt listed on CybersecTools:
Compare all Blauhaunt alternatives at https://cybersectools.com/alternatives/blauhaunt
Blauhaunt is available as on-premises software. It is listed for mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
A tool for adding new lines to files, skipping duplicates.
A threat hunting tool for Windows event logs to detect APT movements and decrease the time to uncover suspicious activity.
Covert proactive threat hunting platform with remote freeze & forensic analysis.
A lookup service for AS-numbers and prefixes by country
Proactive threat hunting platform for detecting adversary infrastructure
CimSweep is a suite of CIM/WMI-based tools for incident response and hunting operations on Windows systems without the need to deploy an agent.
On our shortlist?
No shortlist covers this product's category yet. The closest is Best MDR Solutions for Business.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,030 products.
Connect your AI
