Sqrrl Archive

"From about 2015 until they were purchased by Amazon Web Services (AWS) in early 2018, Sqrrl was a threat hunting platform vendor with an unusually strong focus on teaching the cybersecurity community about threat hunting best practices. They published some of what are still foundational documents about threat hunting.

When their website finally went offline in 2019, many of these foundational documents lost their permanent home on the Internet, making them harder to find and to reference in subsequent work.

With Sqrrl’s permission, I mirrored the documents from their website and am hosting selected pages here so that they will continue to have a permanent home. The formatting is not great since the original blog engine had a dynamic backend to help with lots of that, and I’m just hosting static pages which I’ve had to edit to render well, but everything should be readable.

I’m not hosting the entire Sqrrl website, but rather picking and choosing documents I think are helpful to the threat hunting community. If you’d like me to add something from their site, though, just get in touch and if I have it, I’ll add it for you." 1