Hunts
A hunt keeps an investigation together: the hypothesis you are testing, the steps you and Scout run, the entities and evidence they turn up, and the verdict and report you hand off at the end. In Explorer a hunt is a folder: one tab with five views — Notebook, Results, Flow, Entities and Timeline — plus a Report tab and the hunt's chats. The dock's Workspace tree lists the same folder for every hunt you can see.
A hunt opens on its Notebook: the steps as an ordered list of cells you read top to bottom, with what each one found. The Flow view draws the same steps as a graph. Nothing in a hunt is linear by design — you can plan, run, review, plan again, and record a verdict at any point.
Work through a hunt
These pages follow a hunt from start to finish:
- Start a hunt: pick a starting point, write the hypothesis, choose how much Scout does, and add work from other tabs.
- Work in the notebook: add, run, edit and rearrange cells, and read what each one found.
- Endpoint and telemetry cells: bring one endpoint, or a view of your shipped telemetry, into the hunt as evidence.
- Approvals and Needs you: approve the steps Scout proposes, and clear what the hunt is waiting on.
- Hunt views and the details pane: the Flow graph, Results, Entities and Timeline, and the Brief, Evidence and Provenance beside the notebook.
- Record a verdict and close: record the outcome, close the hunt, export it, reuse it and write the report.
Parts of a hunt
| Term | What it is |
|---|---|
| Hypothesis | What you suspect. It's the first cell, and Scout plans from it. |
| Cell | One step in the notebook: a query, a note, a task, a checkpoint, an endpoint or telemetry cell. The Flow view calls the same step a node. |
| Section | A heading that groups the cells beneath it. |
| Checkpoint | A step that stops Scout's plan until a person decides. |
| Needs you | The list of what the hunt is waiting on: failures, approvals, checkpoints and the verdict. |
| Verdict | The outcome you record at the end: Confirmed, Nothing found, Inconclusive or False positive. |
| Report | The write-up Scout drafts from the hunt, in its own tab. |
A hunt's lifecycle
| Status | What it means |
|---|---|
| Draft | Every new hunt starts here. Until it has any steps, the owner can remove it with ⋯ › Discard draft…. |
| Active | The hunt is being worked: cells run, Scout plans, approvals wait under Needs you. |
| Closed | A verdict has been recorded and the hunt is read-only. Anyone who can edit it can reopen it. See Record a verdict and close. |
| Archived | Shelved. Restore to active brings it back. |
The status chip in the header is read-only. You change the status from the header's ⋯ menu, or by recording a verdict with Record & close hunt.
The hunt header
The hunt header carries the title (click to edit), status, severity, an access chip, the Scout mode chip, the organization the hunt investigates (as plain text, for example in Example Corp), and counts of cells, done, failed and entities. The title comes first: when the header is short of space, chips that don't fit fold into a +N button, and you can still see and change them there.
| Chip | What it does |
|---|---|
| Status | Read-only. Its tooltip says where to change it: close, reopen, archive and restore are in ⋯. |
| Access | Shows the people on the hunt, a lock (private) or a building (visible to the organization), and your own standing — Yours, Can edit or Read-only. Click it to see who owns the hunt, who created it if that was someone else (Scout, say), everyone on it with their role, and who can see it. The owner can add or remove people and pick Only people on this hunt or Everyone in the organization there. With the new sharing screens, the owner clicks Share… there instead, which opens the Share dialog. |
| Scout: Guide / Scout: Collaborator / Scout: Operator | Opens Scout autonomy · applies at the next checkpoint: the three modes, each with a one-line description. Switching to Operator asks you to confirm. You can change it while the hunt is active and you can edit it. |
The header's actions are Ask Scout, which opens Scout with the hunt attached, then Run all, then ⋯ (More actions for hunt). The menu is grouped:
| Group | Items |
|---|---|
| Content | Add from Library… (outside the Notebook view; in the notebook, use From Library… under Add cell), Import YAML… |
| Export | Export YAML (tick Flow only for a clean, reusable structure), Export tracker spreadsheet… (see tracker spreadsheet) |
| Reuse | Save as playbook…, Triggers… |
| Lifecycle | Close hunt… on an open hunt, Reopen hunt on a closed one, Archive hunt / Restore to active |
| — | Discard draft…, last and in red, on a draft (owner only) |
Import YAML…, Triggers… and the lifecycle entries appear for the owner and anyone with Can edit, and Add from Library… only while the hunt is open. An item that can't be used yet stays in the menu, disabled, and says why — for example Nothing to export yet — add a step first. The menu stays available on a closed hunt, so its exports do too.
Run all (N) in the header runs every step that can run. When some steps will stop for approval, the button says so instead, for example Run 2 · 6 need approval, and its tooltip lists the steps it will pause at. While it runs, it becomes Cancel (n/m) with the step in progress.
Collaborators and visibility
Every hunt has an Owner and a Scope. On an organization's hunt, the person shown as the owner is the person who created it. The owner and anyone with Can edit can add and run cells, edit the title, description, hypothesis and scope, and close, reopen or archive the hunt. Only the owner can delete the hunt (Discard draft), add or remove people, and change who can see it. Someone with Can view reads the hunt but cannot change it. Hunts are private to the people on them by default; the owner can make one visible to everyone in the organization from the header's access chip, and what you can do is always stated there.
Where the new sharing screens are on, the owner changes this in the hunt's Share dialog: View is Can view, Edit is Can edit, and Restricted to the people below is Only people on this hunt. Hunts are shared with people, not teams. Sample hunts can't be shared.
Read-only hunts
When you cannot edit, the notebook says why in place of Add cell. A closed hunt is read-only and offers Reopen hunt to its owner and anyone with Can edit. It asks for nothing: checkpoints and proposed steps can't be approved, steps can't be run again, and new Explorer tabs no longer attach to it. Someone else's hunt is read-only unless you are a contributor on it; the strip names the owner.
The hunts that come with sample data are owned by Example Corp (sample) and are read-only for everyone. Their access chip says Example Corp sample hunt. You can read it but not change it.
A hunt opens in its own scope
A hunt belongs to one organization, or to you personally, and it opens only while the Scope selector is set to that scope. If you open a hunt that belongs to another scope, from a link, a tab left open, or after switching scope, Explorer shows This hunt belongs to Cyberdyne Systems (or Personal) in place of the hunt, with two buttons:
- Switch to Cyberdyne Systems changes your scope to the hunt's and opens it.
- Back to hunts takes you to the hunts list.
The same applies to the hunt's other tabs and its Report tab. If you are not on the hunt's organization at all, you see Hunt not available instead.
Where hunts appear
Every hunt you can see is a folder in the dock's Workspace tree, with its needs-you count beside it; pin the ones you return to with Pin to top. Hunts are listed under Feed › Hunts in the Activity Feed, and outcomes roll up in Pulse.
Next steps
- Start a hunt — the ways in, and the empty notebook
- Work in the notebook — cells, runs and results
- Chatting with Scout — where most hunts begin
- Hunt playbooks — save a hunt as a reusable definition and launch it later