Watches

What is a watch?

After a compromise or a remediation, the question for the next day or two is whether anything else happens on that account. A watch is Hal’s answer: a saved search over the log platform for a named account, address or activity pattern, scoped to one client or to all of them, checked on a schedule for a bounded time. On each check a fast model judges the matching events against your instruction and the previous finding, so a routine sign-in still counts when the instruction says the account was just breached.

The typical use is exactly that: an account was just compromised or just remediated, so watch it for 24 to 72 hours for any new sign-in, mailbox rule or consent grant.

Opening one

In chat, name the account or address, the client, what matters and for how long. Hal opens the watch and confirms it by name, WATCH-YYYYMMDD-NNN, with one sentence on where its alerts will land.

Defaults and limits:

• Checked every 30 minutes, and never more often than every 5.
• Runs for 24 hours by default and 7 days at most, then expires on its own.
• Up to 20 watches can be active at once.
• One incident, one watch. Several accounts from the same incident go in one watch; separate watches are for a different client, context or timing.
• A one-time check, check for activity from that account in 20 minutes, is a watch that runs once and answers either way, unless its check cannot be completed.

Where a hit lands

A hit is an alert like any other Hal alert. It appears on the Events page as its own report, with the watch’s name in the summary and a severity on the same scale as every Hal report. It is emailed under the alert threshold in Settings, and posted to the Slack thread and to Microsoft Teams when they are connected. The report records the instruction, your original request, the report the watch follows if it follows one, the search, the check cadence, and the finding.

A recurring check that finds nothing raises nothing. A one-time check answers either way: a hit as above, or an all-clear recorded on the watch itself and in the Slack thread and Microsoft Teams when connected. If its check cannot be completed, the watch says so and ends without an answer.

Seeing and removing watches

Memories → Watches in the portal lists every watch with its client and status, with a toggle to show expired ones. Click a row for its last finding. While a watch is active, its status says when its last check could not be completed. In chat, ask Hal what he is watching, or ask him to remove a watch by name.

What a watch cannot do

A watch only inspects event data. It cannot run Hal’s other tools, so it is not a way to schedule an action for later. Enable ingestion in an hour or verify the setup tonight are not watches. Hal will say so and offer to do the thing now. A watch also cannot see what is not in the logs: an account with no connected source produces nothing to watch.

Cost

Each check is a single call on the fast model over the matched events, so a watch costs a fraction of a dollar over its life. It shows on the Costs page like everything else Hal does.