Changelog — September 28 – October 11, 2026

New Features

• Notes everywhere. Add notes to result rows and cells, entities, graph nodes, endpoints, indicators, telemetry rows and the hunt itself (under Notes on the Brief tab). Notes are saved and shared, show who wrote them, and appear in exports and reports. See Tags and notes.

• Threat Indicators and Tags on more than rows. Entities, graph nodes, endpoints and hunts can now be tagged Suspicious, Compromised, IOC · Confirmed and the rest, not only result rows.

• Scout suggests, you decide. Scout suggests tags with a confidence and a reason, and you accept or dismiss each one. A suggestion isn't evidence until it's accepted. Notes Scout writes carry a Scout badge.

• Investigation timeline. A new Timeline view on every hunt: your curated, UTC timeline of the incident. Add events with Add to timeline… from result rows, entities, endpoints and entity timelines, by hand, or with Suggest from tagged evidence. See Investigation timeline.

• Tracker spreadsheet. The hunt's .xlsx export is now an incident-tracking workbook: a master timeline, then Investigated Systems, Malware & Tools, Compromised Accounts, Network Indicators, Exfiltration, Evidence, Action Items, Case Notes and more, with status colours derived from your tags and timeline. See Tracker spreadsheet.

• Pick a report template, download as Word. Choose the template for each report: Threat hunt report, the new Incident / hunt investigation report, or your organization's own. Download the report as a Word document (.docx) or Markdown (.md). Reports now draw on your timeline, notes and tags, and flag unverified claims and drafts written on open hunts. See Hunt reports.

• Reports in the Activity feed. A new Reports pill lists every hunt's latest report, with its version, Draft / Final, template, quality flags and snapshots. Filter by draft or final and by template; open, download or export from the row; open a report's Versions and Snapshots in the side panel. Reports stay out of All Activity. See Reports.

• Report versions. Every generate and regenerate is a new version, and older versions are kept read-only. Open or download any version as .docx or .md, and see who generated it, when, and how (by hand, regenerated, by Scout or on hunt close). See Versions and snapshots.

• Tracker spreadsheet snapshots, opt-in. Exports still store nothing. Tick Save a snapshot (with an optional label) in the export dialog, or Also save a spreadsheet snapshot when you generate or regenerate a report, to keep the workbook on the hunt, paired with that report version. List, download and delete snapshots from Versions & snapshots. Snapshots follow the hunt's access and are removed with sample data. See Snapshots.

• "Am I ready to write this up?" Ask Scout in a hunt and it checks what's missing before writing the report: evidence not on the timeline, untagged IOCs, open leads, a missing verdict. See Write up a hunt with Scout.

• Sample data page. Example Corp sample data now has its own page in the docs and its own section in Settings › [Organization] › Sample data: what it includes, Pause for new sample alerts, a Remove automatically date and Remove sample data, which lists what goes and what stays before you confirm. Sample data is removed automatically 14 days after your own data starts arriving. See Sample data.

• Guided hunts on Example Corp. Start this hunt on a Try a hunt on Example Corp card adds the card's suggested queries as query cells. Once you've started one, the card offers Resume, and a card for a part of the story that hasn't happened yet says when it will be available.

• Organization profile. Describe your environment — products and data sources, size, business domain, cloud providers, security tools, compliance frameworks — on the organization's Overview, or during setup. Scout uses it to recommend hunts and spot telemetry gaps. See Organization profile.

• Record & close in one step. The verdict cell asks for a one-line rationale, and Record & close hunt records the verdict and closes the hunt together; Record only keeps it open. After a reopen, the verdicts the hunt was closed on read Superseded. See Verdicts.

• Undo and restore archived cells. Archiving a cell offers Undo, and an archived cell has Restore.

• {{parameter}} prompts in the notebook. A query cell with unfilled parameters asks for them inline before it runs.

• OR in searches. Join words or phrases with a capital OR to find events that contain any of them. Search these N values on pasted text now uses it. See Search telemetry.

• Scripts and Actions (beta, rolling out). Library › Scripts to review scripts and Sign and publish them, with a second person required for high-risk versions. Library › Actions for saved endpoint actions with an approval policy, rollout and expiry. Activity › Actions lists runs, with approve, pause, resume, stop and retry. On an endpoint, Respond › Saved Actions and Save as Action. See Actions and runs.

• Response actions on the investigation timeline. A hunt's Timeline lists the isolate, release, kill, script and file-collection runs on its endpoints beside your own entries, with who requested and approved each, the reason and the outcome (Succeeded, Failed, Awaiting approval, …). They're read-only, Show response actions hides them, and the tracker workbook includes them. See Investigation timeline.

• A customer copy of the tracker workbook. The export dialog asks Who is it for? Internal (working copy) is unchanged; Customer copy turns analyst names into initials, leaves out emails, case notes, internal plan steps and raw step results, keeps only tagged evidence, and says who prepared it. See Tracker spreadsheet.

• "Why this fired." A hunt a watcher opened explains itself under Provenance and in the watcher's note in the notebook: the watcher and its rule, a summary such as "11 signals from 4 sources over 2 days", Linked by chips for what the signals share, and the signals grouped by day. It replaces What fired this. See Hunt views.

• Linked identities. Hunt › Brief, the finding panel and the graph panel for an IP or host show which accounts signed in from those addresses or to those hosts — "Signed in from 203.0.113.201 on 6 Oct · 2 failed attempts" — each with a Sign-in events link. See Entity timeline.

• Map for Search results. Search results that carry a location, such as Okta or Entra ID sign-ins, get the Map view, and Map plots coordinates in nested fields too. See Search telemetry.

• SigNoz connections. Connect SigNoz and query it in SigNoz Query (JSON) or SigNoz SQL (ClickHouse); Scout can write SigNoz queries too. See Connections.

• Scout fixes broken cells. Check why / Why no rows? on an empty result, Fill with Scout for missing parameters, Rebuild query on a cell with no query, Review approvals with Scout from Needs you (safe groups pre-selected, likely duplicates flagged) and Use Scout's draft on the verdict cell. Nothing is saved, approved or run until you do it. "N claims unsupported" now highlights the sentences. See Approvals.

• Updated terms. Our Terms of Service and Privacy Policy were updated on 10 October 2026. You'll be asked to accept them the next time you open Huntbase.

Improvements

• A query typed on Auto runs. On the Auto language, in a query tab or on Home, SQL, SPL, KQL and other queries run in their own language instead of going to Scout. For SQL, Auto picks the dialect from the tables the query names and the connections in scope.

• One set of approval words. Approve & run when approving starts a run, Approve otherwise, and Approve step on a checkpoint (under Your approval is needed). Accept task is gone. Endpoint proposals in Needs you show Review and are approved on their own card.

• Needs you follows the notebook. Items are listed in notebook order, with the verdict last.

• Honest Run all. The button says what it will do, such as Run 2 · 6 need approval, and its tooltip lists where it will stop.

• Scout plans behind one gate. When Scout plans a hunt in Guide or Collaborator, the plan is query steps behind one approval checkpoint, and nothing runs before you approve it.

• Closing a hunt settles it. Steps waiting for approval are rejected, running steps stop, and the hunt leaves Needs you. New Explorer tabs no longer attach to a closed hunt, and a closed hunt offers no reruns.

• Scout: Guide / Collaborator / Operator. The hunt header's mode chip names Scout, so it no longer reads like a sharing role. When the header is short of space, its chips fold into +N and the title keeps its room.

• Scout Summary sticks to the hunt. A hunt's Scout Summary is written from its own cells: hypothesis, queries and row counts, notes and verdict.

• Sample hunts are Example Corp's. Sample hunts are owned by Example Corp (sample) and are read-only, and the hunt menu offers Add from Library…, Import YAML and Triggers… only to people who can edit the hunt.

• Sample connections don't mark products Connected. In Add a source, products only Example Corp has a connection for show a Sample chip and stay under Available. Sample connections are in scope for queries.

• Connection setup says why Continue is off, and a reloaded link keeps the product you picked.

• Pulse links show the whole picture. Links from Pulse into triage keep Pulse's time window and show the whole team's hunts.

• The approver can end live response that their approval started. See Files and console.

• Live tail checks access. A live tail ends if you lose access to an organization it covers.

• Better template search. Library and ⌘/Ctrl+K template search match on words first and only add close matches in meaning.

• Keyboard. ⌘⏎ / Ctrl+⏎ runs the focused notebook cell, the same keys as inside the editor (⇧⏎ still works outside an editor). Arrow keys, Home and End move along Explorer's tab bar. Shortcut hints show Ctrl on Windows and Linux.

• Sentence case. Menus and the command palette use sentence case: New query, New hunt, Quick actions, Recent queries. Field and column labels keep acronyms: Client IP, Event ID. The app now uses the Geist and Geist Mono fonts, and copy follows one style: Sign in / Sign out, and Activity feed in sentence case.

• Tooltips open and close the same way everywhere.

• Watchers say why they're quarantined. The quarantine banner shows Manual release required and why — for example, it tripped 3 times in 7 days, and only the first 2 trips release on their own — plus Trips in 7 days and how many matches were dropped this hour over the hourly digest cap. See Quarantined watchers.

• Matches held below the severity floor. Watcher rows and the drawer say "N matches held below your High threshold in the last 7 days · View", Activity has a Held below the threshold section with a shortcut to Change the severity floor, and watcher findings now reach the bell and Needs attention.

• Watcher severity and the floor, separately. The severity chip shows the watcher's own severity, the organization's floor shows as Fires at ≥ Low, and hunts a watcher opens keep the watcher's severity.

• Off watchers say what switching on would do. Ready · off is now Data ready · off, with a tooltip on Shadow and On, and Settings › Watchers no longer shows an Off watcher as Armed.

• Library › Watchers and Intelligence › Watcher health. Library › Detections is now Library › Watchers, and Intelligence › Detections is now Watcher health; old links redirect. A watcher is the rule; a detection is what it produces. See Watcher health.

• More SigmaHQ rules compile — about 3,140 of 3,302, up from about 2,330, with gains across Okta, GCP, GitHub, Kubernetes, Duo, Entra ID / Microsoft 365, Sysmon, Zeek, auditd, Windows channels and more. See SigmaHQ rules.

• Scope picker groups. For service providers, the scope picker groups organizations under Customers of your provider, Your organization and Personal (Only you).

• Recent queries: Mine / Everyone. Explorer's Recent queries shows your own queries by default, including ones Scout ran for you; Everyone shows the rest.

• "New events delayed since …" Telemetry › Sources and Search say when new events aren't landing yet. They're kept and appear once processing catches up.

• Side panels lead with what matters. Finding, graph entity, collection, action, threat, feed and watcher panels open on key facts, name affected hosts, link related hunts and findings, tuck ids under Identifiers, and keep their header in place as you scroll. Collection runs show Requested by and the Reason, and label the hash Archive SHA-256, for checking the download.

• Panels say when loading failed. Notifications and the hunt flow panel show Couldn't load … with Try again instead of an empty state, and Scout no longer says "Analyzing results…" while idle.

• One message when Huntbase is unreachable: "Can't reach Huntbase right now. We'll keep retrying." with Retry now, instead of every panel failing on its own.

• Export all endpoint activity. Endpoints › Activity's Export this page is now Export all N, which exports every row matching the filters, up to 10,000.

• Connections. New connection opens the full catalog; the inventory has filter chips with counts (Can't be queried, Needs attention, …) and a List / By product switch; the failing-connections banner has Show all N.

• Consistent menus. The endpoint header has Respond ▾ (Investigate / Undo / Contain), each header has one ⋯ menu, and row actions sit in a sticky last column.

• More room for results. Events over time folds to a one-line sparkline (folded by default in Table view), and your choice is remembered.

• Readability. Text meets WCAG AA contrast in light and dark mode.

• Clearer hunt state. A paused Run all reads like Cancel paused run (6/16 · 3 waiting for approval); tasks being worked on show as in progress, not running; a checkpoint asks for approval only once the run reaches it; partial runs show their rows with a Partial badge and the reason; and a failed cell says when the problem is access to a connection rather than the query.

• Reports. The report screen says what generating it added to the hunt; data sources the hunt never queried are flagged; unapproved proposals stay out of the evidence; durations are checked against the timeline; and report tables use the page width.

Bug Fixes

• Activity feed summary cards count every hunt in the window, and sample rows carry the Sample chip.
• Notification settings no longer fail to load when a new category, such as Inbox, appears.
• Start hunt from an inbox message creates the hunt in that message's organization.
• Typing fast in a query editor no longer drops characters.
• Your chosen organization is kept across a reload.
• Editing or deleting a query schedule now takes effect.
• Date-range presets such as Last 7 days respond to clicks again.
• Check against history on a watcher no longer times out, and backtest samples show the time, host and what matched.
• A fleet query that returned rows no longer ends as failed, and an invalid query no longer marks a connection unhealthy.
• The hunt entity graph no longer shows duplicate device and IP nodes, and labels nodes by value instead of column name.
• Watcher started a hunt notifications link to the hunt, the new-message pop-up no longer shows raw {{…}} placeholders, and inbox Run query opens with the right connection selected.
• Lapsed Scout proposals show as lapsed, not failed.
• Coverage and threat drawers update as soon as a watcher is switched on or off, entity panels name the real intel feed (for example ThreatFox), and Scout's indicator lookup recognises community-feed indicators.
• Intel retro-hunts also search your own lakes, and the maximum threat level is honoured on API-mode MISP feeds.
• Hunt titles are no longer cut short with "…", and exports get sensible file names.
• Endpoint check rows count in Results and can be tagged, and Add to timeline… fills in the host, time and id.
• Activity feed digest tiles say what they count, type pills keep their own time window, and Pulse reads "So far" for All time.
• Smaller fixes: lake results say "N stores", not "1 connection"; a long unmapped-columns notice collapses; the collect-file dialog no longer opens with an error; an empty Search can't be submitted; run links open in Query mode; Library framework counts match the list; and a connection's run-history chip says Responding.