Key concepts & glossary

This page defines the terms used throughout the Huntbase docs and shows how work flows through the product. Skim it once; come back when a word in the app is unfamiliar.

Surfaces

Explorer and tabs

Explorer is Huntbase's home. On the left is the dock — a rail of views: Workspace (a tree of your hunts, stores and schedules), Chats, Queries, Library and Scout. Beside it is a tabbed workspace: the pinned Home tab holds the launcher and the What now worklist, and every piece of work you open becomes a tab. Tabs come in five kinds — query, chat, hunt, hunt node, and hunt report — and stay open until you close them, so a running query keeps streaming while you read a chat. Most tabs have a URL, so you can share or bookmark them. See Explorer overview.

Scout

Scout is Huntbase's AI assistant. You talk to it in plain language; it plans, writes and runs queries, extracts entities and insights, summarises results, and proposes next steps. How much it does on its own is up to you (see Initiative below). See Chatting with Scout.

Activity Feed

The Activity Feed is the team's shared record of hunts, insights, entities, and queries, with hunt reports under their own Reports filter. Filter by kind, time range, and type; open any row in a side panel; and act on it (start a hunt, review an insight, rerun a query). See Activity Feed.

Pulse

Pulse is the outcomes dashboard: how many hunts ran, how many confirmed a threat, how much was automated, and how your hunting practice is maturing over time. See Pulse.

Library

The Library holds reusable content: hunt playbooks, query templates and watchers (the catalog of rules your organization can switch on, under Library › Watchers). See Hunt playbooks, Query templates and Watchers. It also holds Test data, the test lake of public attack recordings and baselines you can search in Explorer and test rules and watchers against. See Test data.

Conversations and hunts

Term	Meaning
Chat session	One conversation with Scout, opened as a chat tab in Explorer. It keeps its own history, queries, and stash. Chats are lightweight: ask, get an answer, move on.
Hunt	A structured investigation (a hunt session). In Explorer it is a folder — Notebook, Results, Flow, Entities, a Report and its chats — with a title, a hypothesis, a scope, and a verdict. Hunts are the unit that Pulse counts.
Notebook	A hunt's primary view: its steps as an ordered list of cells, each showing what it found. Cells can be inserted, moved, archived or deleted, and are grouped under section headings; notes sit between them.
Cell / hunt node	One step in a hunt: a query, a task, an action, a checkpoint, a watcher. The same step is a cell in the notebook and a node in the flow. Nodes branch, so the Flow view draws a graph.
Checkpoint	A point where Scout stops and waits for your decision before continuing (Approve & run, Refine, or Abort).
Verdict	The hunt's conclusion — Confirmed, Nothing found, Inconclusive or False positive — recorded in the notebook's verdict cell. Verdicts are a log: Scout adds drafts as the hunt progresses, you record the real one, and recording does not close the hunt.
Hunt report	The written outcome of a hunt: verdict, findings, evidence, and next actions. Opens as its own tab.
Hunt playbook	A reusable hunt definition in the Library. Launching a playbook creates a new hunt pre-populated with its steps.
Initiative	How proactive Scout is in a chat: Ask first, Balanced, or Proactive. In a hunt the equivalent setting is the mode: Guide, Collaborator, or Operator.

Queries and results

Term	Meaning
Query	The logic for a search, written in one of the supported languages: Auto (natural language), SQLite, osquery, Cypher, SPL, KQL, ES|QL, ES DSL, or STIX 2.1. See Query languages.
Run	One execution of a query against one or more connections at a point in time. Runs have a status (queued, running, done, failed, or cancelled), a row count, and timing.
Result set	The rows a run returned. You browse them in a query tab and can export them.
Query template	A saved, optionally parameterised query in the Library that anyone in scope can run in Explorer or schedule.
Schedule	A recurring run of a query template. Schedules live on the template's Schedules tab. See Schedules.
Query stash	The list of queries Scout has written or run in a chat, kept in a side panel so you can rerun or open any of them.
Search	Search the telemetry you ship, then filter it by clicking values. It's a query language, Search (Huntbase Lake), and a mode of a query tab (formerly Browse). Huntbase writes the search as a query. A view is the sources, time range, filters and search you are looking at. You can save a view, share it with Scout, or pin it to a hunt. See Search telemetry.

Entities and insights

Term	Meaning
Entity	A thing you can pivot on: a host, user, IP address, domain, file hash, CVE, technique, and so on. Entities are extracted from results and linked to the run and query that found them (their provenance). Each entity has a detail panel with Information and Relationships tabs.
Insight	A finding worth attention: a detection, an anomaly, or a conclusion Scout or an analyst recorded. Insights carry a severity, a source, and links to entities and hunts.
Review state	Where an insight is in triage: Needs review → Approved → Hunt started, or Dismissed at any point before a hunt starts.
Watcher	The rule: logic Huntbase runs for you (a saved query, a rule built from a Sigma rule, a threshold, a graph pattern) over your events, your entity graph, or a window over earlier signals. When it matches, the watcher fires — and starts a hunt, raises a finding, adds to a digest or tags the graph. Runs Off, in Shadow (evaluated but silent) or On. See Watchers; the catalog is Library › Watchers and how each one performs is Intelligence › Watcher health.
Detection	What a watcher produces, never the rule itself. A watcher fires; a firing can create a detection, which triggers a hunt or another workflow. Detections from connected products (an EDR alert, for example) arrive as insights.

Connections and scope

Term	Meaning
Product	Something Huntbase can integrate with: a SIEM, an EDR, a cloud provider, an identity provider, a threat intelligence source. The catalog under Connections lists them.
Connection	A configured instance of a product with its own credentials and settings. You can have several connections to the same product. Queries run against connections. See Connections.
Data lake	Telemetry queried from an Iceberg store you own, or shipped to Huntbase directly, rather than reached through a connection. See Data lake.
Telemetry source	One telemetry ingest key and the shipper that sends on it. Each source has a status: Receiving, Quiet, Rejecting, Never seen or Revoked. See Telemetry.
Endpoint Control	Huntbase's osquery fleet management. Install on your hosts, then query them like any other connection. Each Endpoint Control connection is one fleet. See Endpoint Control.
Endpoints	The workspace for the hosts in your fleets: health, details and logs, file collection, access and the audit trail (beta). See Endpoints overview.
Scope	Whose data you are working in. You work in one or more organizations, and usually also have a private Personal scope — an organization can turn personal scope off for its members. Connections, queries, chats, hunts, and insights all belong to a scope.
Scope selector	The control in the page header (labelled Scope:) where you pick the one scope you are working in. Everything on screen — feed rows, connections, Scout's answers — is filtered to that scope. If you change the scope after a tab loaded, the tab is marked so you know its contents may be out of date.

The query lifecycle

Ask or write  →  Run  →  Results  →  Entities / Insights  →  Save or schedule

1. Ask or write — Ask Scout in plain language, write a query in the Query launcher, or run a template from the Library.
2. Run — The query executes against the selected connections. Scout may show a confirm-execution card first, depending on your initiative level.
3. Results — Rows stream into a query tab where you can pivot, filter, and export.
4. Entities / Insights — Extracted objects and findings appear in the side panel, in chat cards, and in the Activity Feed.
5. Save or schedule — Keep the query as a template, and schedule it if it should run again.

The hunt lifecycle

Question  →  Hunt  →  Cells & checkpoints  ⇄  Verdict  →  Report  →  Pulse

1. Question — A chat with Scout, an entity's Hunt now button, a playbook, an insight, or a watcher raises something worth structured work.
2. Hunt — A hunt session is created with a subject or hypothesis and a scope, seeded from wherever it started, and opens on its notebook.
3. Cells & checkpoints — You and Scout add steps: queries, tasks, actions. Scout runs what your chosen mode allows and pauses at checkpoints for your decision. When a step fails, Fix with Scout writes a replacement beneath it.
4. Verdict — Record what you concluded. The hunt stays open, so plan and run again if the verdict changes; the log keeps every entry.
5. Report — Scout writes the hunt up; you share or export it, then close the hunt.
6. Pulse — The outcome is counted alongside every other hunt in your scope.

Data flow

Products ── Connections ── Queries / Runs ── Results
                                              │
                          Entities ◄──────────┼──────────► Insights
                              │               │               │
                              └──── Chats & Hunts (Scout) ────┘
                                              │
                          Activity Feed ◄─────┴─────► Pulse

Connections bring products in. Queries run against them and return results. Entities and insights are extracted from results and from Scout's own reasoning. Chats and hunts tie the pieces into investigations, and the Activity Feed and Pulse are where the team sees the whole picture.

Data standards

• OCSF — Huntbase normalises event data using the Open Cybersecurity Schema Framework where a product supports it. See OCSF schema.
• STIX 2.1 — Supported as one of the query languages, for pattern-based indicator queries. See Query languages.

Next steps

• Explorer overview — the tabbed workspace in detail
• Chatting with Scout — modes, initiative, and what Scout shows you
• Hunts — sessions, modes, checkpoints, and reports
• Activity Feed — browsing everything the team produced