TL;DR: Huntbase now groups its content into content packs: named, versioned sets of queries, watchers, hunt playbooks, report templates, compliance checks and the knowledge Scout cites, each built for one job. Instead of switching on dozens of items one at a time, you enable a pack, choose how much of it runs, and Huntbase sets it up across your connections. Updates arrive without overwriting your changes, you can roll back, and you decide who manages each pack. The first two optional packs are AI Security and Identity Threats.

→ Open Library › Packs

Why packs

Huntbase ships a lot of content. Today that's more than 12,500 items: thousands of query templates across 165 products, watchers, hunt playbooks, endpoint scripts and actions, evidence collections, compliance checks and the security knowledge Scout cites. All of it was already in your Library. What was missing was a way to say "I want to cover this threat" and get the right set of those items running, together, without knowing in advance which 40 of them that means.

A pack answers that. It's the unit we design content in, and now it's the unit you switch on.

What's in a pack

Each pack has its own page in Library › Packs with five tabs:

• Overview: what the pack is for, what enabling it will run, the sources it needs, and the packs it's built on
• Contents: every item, grouped by kind, with a switch on each item that can run
• Changelog: every version and what changed
• Licence and trust: the licence, any third-party content, who publishes it and what it may do (for example "runs read-only queries" or "may propose endpoint actions, which ask for approval first")
• Access: who in your organisation can manage it

Enabling a pack doesn't add or hide anything in the Library. It decides what runs: which watchers are on and which inventories and queries are scheduled on your connections.

Enabling a pack

Click Enable and pick a preset:

Before you confirm, the preview shows how many watchers and scheduled queries the preset turns on, which connections they run on, and roughly how many runs a day that adds up to. Setup happens in the background, so a pack with hundreds of items doesn't hold up the page.

Haven't connected a source yet? Enable the pack anyway. Items that need it show Waiting for a source and start on their own when you connect one.

Here's what that saves with the AI Security pack:

Your changes survive updates

Packs are versioned, and we keep improving them. That's only useful if an update doesn't throw away the tuning your team has done, so customisation and updates were built together:

• Customise without copying. Change an item's schedule, or a watcher's severity, hunt mode or what it does when it matches. Your change sits on top of the pack and is marked Customised. Changes you make on the Watchers or Schedules pages are picked up the same way.
• Choose an update policy. Install patch releases automatically (the default), install all non-breaking releases automatically, or review every update.
• Review updates. The review screen shows what updates automatically, what merges cleanly with your changes, and the few items where you and the pack changed the same thing. For those you keep yours, take ours, or use the suggested merge.
• Pin and roll back. Pin a pack to a version, or roll back to an earlier one. Your customisations, detections, findings and hunt results stay either way.

Nothing you changed is deleted without asking.

Who can manage which pack

Packs follow your organisation's roles and teams. Everyone can browse packs. Owners and admins can manage them. Custom roles and team access can grant Content packs: Manage for every pack or limited to particular packs. For example, give your identity team control of the Identity Threats pack without touching AI Security. Each pack's Access tab lists exactly who can change it.

Optional packs carry their own licence. The first time someone enables one, an organisation admin accepts it, and Huntbase records who accepted it and when.

The first optional packs

AI Security finds the AI tools, models, agents and MCP servers in use in your organisation. Six endpoint inventories run on macOS, Linux and Windows:

• MCP server configuration files for Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Gemini CLI and Codex
• running MCP server processes
• local LLM runtimes, flagging any listening on all interfaces
• local model files
• and more

It adds queries for Anthropic, OpenAI, Bedrock, Vertex AI and Azure AI, a watcher for remote MCP servers, and ten hunts for AI-assisted intrusion, coding-agent abuse and shadow AI. Ask Scout "which MCP servers are configured on our laptops?" and it answers from the pack's inventories.

Identity Threats detects and hunts account takeover across Okta, Microsoft Entra ID and Google Workspace. Its scheduled queries cover:

• MFA fatigue
• risky and impossible-travel sign-ins
• OAuth consent grants
• privileged role assignments
• new application credentials
• legacy authentication
• admins without MFA
• domain-wide delegation

It also brings identity correlation watchers, 26 hunts for token theft, session hijacking, consent phishing and password spraying, and an identity incident review report template.

Compliance framework packs for SOC 2, ISO 27001, Cyber Essentials and NIS2 are available to every organisation. Enabling one switches on that framework's compliance package and schedules its checks.

Everything else Huntbase already gives you is now organised into built-in packs: core, detections, threat intelligence feeds, security knowledge, the endpoint packs, and one integration pack per product category (cloud, identity, SaaS, EDR and XDR, SIEM and logs, and so on). They're always on, and their pages show exactly what each one contains.

What packs unlock for partners

Managed security providers running Huntbase for several clients can roll out the same packs to each client organisation, set each client's update policy, and use per-pack permissions to decide which analysts can change what. Every organisation keeps its own customisations, so one client's tuning never leaks into another's.

Customers get new detection content as pack updates, not as one-off changes. When you tell us a hunt is missing or a query is noisy, the fix arrives as a new version with a changelog. You can review it, merge it with your own tuning and roll it back if needed.

Technology and content partners: every pack declares its publisher, licence, third-party content and what it's allowed to do, and every release is versioned and checked against published checksums before it's installed. That's the groundwork for content from people other than us. If you have detections, hunts or compliance mappings you'd like Huntbase customers to be able to switch on, talk to us.

Try it

Open Library › Packs, pick a pack and look at its Overview to see what it would run for you. If an optional pack shows Not available, ask us and we'll make it available to your organisation.

• Content packs docs
• AI Security pack
• Identity Threats pack

Never hunt alone.