📄️ Hunt playbooks
A hunt playbook is a reusable hunt definition: the hypotheses, queries, checkpoints, analytics and tasks that make up a hunt, saved as a versioned document you can launch again and again. Playbooks live in the Library, which opens on the Hunt playbooks facet by default.
📄️ Watchers
Library › Watchers is the catalog of watcher templates your organization can use. A template is a watcher you can switch on for your organization as it is, or copy and change into a watcher of your own. The catalog holds:
📄️ Test data
Library › Test data is the Huntbase test lake: a catalog of public attack recordings and real-world baseline telemetry, loaded and parsed into the same tables as your own data. Use it to see what a technique really looks like in the logs, to test a watcher before it goes near your estate, and to check a hunt query finds something before you run it on your telemetry.
📄️ Scripts
Library › Scripts holds the scripts Scout can run on your endpoints. A script is reviewed and signed before any endpoint will run it. Each run is tied to the exact bytes and arguments that were approved, so a changed script, or a script someone swapped on the way, is refused.
📄️ Actions
An Action is a saved, versioned response, such as Isolate endpoint or Initiate patch. People run it without seeing or choosing the script underneath. Each Action sets:
📄️ Query templates
Query templates are saved, reusable queries — from Huntbase's built-in catalogue, from content packs that ship with your connections, or saved by your team from the query workspace. You browse them in the Library, run them straight into an Explorer query tab, and schedule them to run on their own.
📄️ Schedules
A schedule runs a query template automatically — once at a set time, or on a recurring cadence — so recurring checks keep producing results without anyone pressing run. Schedules are created from a template in the Library and managed from the template's Schedules tab or the Schedules page.