Skip to the content

Events and hunting

What happened, kept append-only, and what is rare enough to look at.

In the consoleEventsHunt

The event store

vaigil spool stats
vaigil spool verify
vaigil spool retain --apply
vaigil spool hold NAME --why "litigation hold"

Retention never deletes what a hold covers, and a hold is lifted by name.

One person, many accounts

vaigil identity link okta:00u1abc dana@example.com
vaigil identity list

Hunting

vaigil telemetry fields events.jsonl
vaigil hunt --field raw.user_agent --by actor events.jsonl
vaigil triage events.jsonl --rules ./rules

A hunt counts one field's values and shows the rarest, which is what is worth a look. The Hunt screen does the same over the store, and offers what you found as the start of a rule.