Endpoints (beta). A new top-level workspace for the hosts you manage through Endpoint Control. Your scope decides which fleets you see — one per Endpoint Control connection — and a fleet switcher moves between All fleets and one fleet. Six tabs: Overview, Endpoints, Collections, Activity, Access and Deploy. See Endpoints overview.
Fleet health at a glance. The Overview tab counts Online, Stale and Offline endpoints, charts check-ins, breaks the fleet down by platform and agent version, lists recently enrolled endpoints, and flags what Needs attention — an install link about to expire, endpoints offline for over 7 days, endpoints behind on their version.
One table for every endpoint, across fleets: filter by status, platform and tag, search by hostname, IP, UUID or serial, see 24 hours of activity per row, and Tag, Run query on these, Collect file or Remove in bulk. When a selection spans fleets, the action applies to the endpoints you are allowed to act on and says how many are skipped. See Endpoints and endpoint details.
A page per endpoint: identity, hardware, activity, tags, Logs, Open in Explorer, and Seen in hunts — the hunts whose results included it. Run query opens a query tab targeted at exactly that endpoint; a Targeting N endpoints banner warns if the targeting is edited away and offers Restore targeting.
Collect file. Pull a file from one or more endpoints into a bucket your organization owns. Each run shows per-endpoint status, size, the SHA-256 of the stored archive and Download. See Collect files.
Storage destinations in Settings: an S3 or S3-compatible bucket you own, with Test connection, a write-only access key and one Default. File collections need one. See Organization management.
Endpoint access. A Responder role lets someone collect files, browse files and run console commands without being a connection admin. Grant it on a whole fleet, or grant Viewer, Operator or Responder on a tag — "responder on everything tagged finance". Only tags in a folder marked Access-bearing can carry access. See Access and activity.
An audit trail per fleet. The Activity tab lists every hands-on operation — who, what, on which endpoints, with what outcome — including denied attempts and work done by Scout, a schedule or a watcher on someone's behalf. Command text is recorded; console output and file contents never are.
Files and Console (beta, separate rollout). Browse an endpoint's file system and run read-only commands and osquery SELECTs on it, live. Sessions start only when you click start, end when you leave, and everything in them is recorded under your name. File retrieval from the console is refused — use Collect file. See Files and console.
One new tab (beta).+ in Explorer's tab bar opens a New tab with one input and four shapes: Auto, Chat, Query and Hunt. Auto says what Enter will do before you press it: a question goes to Scout, a single value or field:value text searches your telemetry, and KQL for the Huntbase data lake runs. Any other query language opens in Query and waits for ⌘/Ctrl+Enter, and Auto never starts a hunt by itself. Pick a shape with Ctrl+Shift+1–4 or a slash command (/chat, /query, /kql, /osquery, /search, /hunt). The ▾ next to + still lists New chat, New query, Search telemetry and New hunt, and Home uses the same input. See Open a new tab.
Search (Huntbase Lake) (beta). Browse is now a query language, first in Query's language pill. Type words, "quoted phrases", -word, field:value, -field:value or field:*, and press Enter; an empty search shows every event in the window. A search is saved as a query, so it has a run list, Add to hunt and a schedule, and a search tab's Search / Query toggle shows the KQL it compiles to. Filters you click in a search apply at once. /search, /browse and ?new=browse links open it. See Search telemetry.
Paste and drafts (beta). Paste a block of text or drop a text file and choose what to do with it: Ask Scout about it, Search these N values, Hunt over it or Put in Query. What you type in a new tab survives a reload, and a short draft in a closed tab comes back from Jump back in.
Refine a query in place (beta). Re-running an edited query updates the same tab; Run in new tab (⌥⌘Enter / Alt+Ctrl+Enter) keeps the old results. Run N of N with ◀ ▶ steps through earlier runs without running them again, and Edit from this run brings one back into the bar. After a run the bar shrinks to one row; click it, or press / or ⌘/Ctrl+E, to expand it. See Refine a query in place.
Filters wait for Apply (beta). On queries that run on your connections, values you click in the results queue as chips, and Apply N filters adds them all and runs the query once.
Add to hunt (beta). Add query results, a Scout answer or a graph node to the hunt picked in the tab bar, another hunt, or New hunt from this. An added query tab stays linked to its step, and later runs update it. See Add work to a hunt.
Scout sees what you're asking about (beta). Asking about a row, a graph node, an event in a search or a hunt step goes to Scout in the dock with that item attached. The dock offers Summarize results instead of analyzing every run, and Open as chat tab moves a conversation into its own tab. See Ask about what's on screen.
Endpoint Control speaks one vocabulary. The connection page and the Deploy tab now say Install on endpoints, Uninstall from endpoints, Install link secret and Manage link. Install and uninstall commands, and the secret, are shown only to fleet admins; everyone else sees when the link expires and whom to ask. See Endpoint Control.
With Endpoints enabled, an Endpoint Control connection's page shows a compact Fleet card with Open in Endpoints in place of the two-tab panel.
Fleets that serve more than one organization are marked Shared and are view-only.
A hunt query cell opened with Open as tab stays linked to its step: runs in the tab update the cell instead of adding a new one, and a run from the notebook or Flow view shows up in the tab. See Add, move and remove cells.
New notebook cells, including telemetry and endpoint cells, hang off the step they follow instead of starting a new branch in the Flow view.
@ mentions reach Scout as the entities and insights themselves, not just their names.
Entity and query template lookup moved to the command palette (⌘/Ctrl+K). Picking an entity opens its graph and picking a template opens it ready to run. Search "…" in entities and queries opens the full grouped search, and Search telemetry for "…" searches your telemetry. The query bar's Auto language no longer searches entities; it hands your description to Scout. See The command palette.
Column settings in query results belong to each tab.
The query editor now loads from Huntbase itself, so a blocked content delivery network no longer leaves it stuck on loading. If it takes more than a few seconds, a plain text box stands in, with Retry, until it's ready.