Platform · Scout
Grounded.
Accountable.
Scout plans the hunt, shows every query, cites its evidence and waits for your approval. Choose Guide, Collaborator or Operator mode.
m.reyes
Has anything on the finance hosts talked to the indicator from this morning's insight?
Scout
Two stores cover the finance tag for the last 30 days. I will check network_activity for the indicator and join the hits to enrolled devices. Nothing runs until you confirm.
Show reasoning · 4 steps
Confirm execution
network_activity
| where dst_endpoint.ip == "185.220.101.47" and time > ago(30d)
| join kind=inner devices on src_endpoint.hostname
| where tags has "finance"Knows
Scout reasons from your hosts, users and hunts beside ATT&CK, CVE and indicator intelligence. Your knowledge and ours.
Shows
Every claim cites its evidence: the rows, runs, entities or events behind it. Claims it cannot support are flagged.
Waits
Plans run behind one approval checkpoint. Endpoint actions arrive as approval cards, and a proposal never counts as approval.
02Logs
Every action, in the audit log.
Nothing Scout does is off the record. Every proposal, approval and run lands in the audit log, with the person who allowed it.
- Asks before it acts. Scout shows the query and where it will run. You edit, run or abort.
- What Scout writes. Queries, hypotheses, hunt flows, reports from your template and Sigma watchers from confirmed findings.
- Three ways to ask. Talk to Scout, write the query yourself, or ask what the graph already knows.
- 09:14:02watcherRaised insight · LSASS read by unsigned binary · WKS-2231
- 09:14:05ScoutWrote summary and enrichment for insight
- 09:21:40m.reyesInvestigate → Hunt with Scout · H-118 created
- 09:21:48ScoutProposed hypothesis and 4-node flow
- 09:22:10m.reyesApproved execution · huntbase, acme-iceberg
- 09:22:11ScoutRan query q-4471 · 2 stores · 7 rows · stashed
- 09:25:03ScoutCheckpoint (Mandatory) · waiting for scope decision
- 09:26:30m.reyesProceed · live collection on WKS-2231 approved
03In the loop
One partner across the whole loop.
Scout pre-reads the insight, proposes the hunt, drafts the watcher and writes the report. At every step, the decision is yours.
Questions
Frequently asked questions
Does Scout act without my approval?
No. Scout's plans run behind an approval checkpoint, and you see every query before it runs. When Scout suggests an endpoint action, it appears as an approval card. A proposal never counts as approval.
How do I know Scout's answer is right?
Scout's answers are grounded: each claim cites its evidence, such as rows, runs, entities or events, and claims it cannot support are flagged.
What are Guide, Collaborator and Operator?
Three modes that set how much initiative Scout takes, from guiding you step by step to carrying out a whole plan. In every mode, nothing runs until you approve it.
Does Scout train shared models on our data?
No. Scout doesn't train shared models on your data. Your data stays in your own stores unless you choose to send it to the Huntbase Lake, and Scout sends only the rows it needs to analyse to our model provider.
Your data.
Your knowledge.
Your call.
An investigation partner that shows its work. Every checkpoint, every verdict, yours.
- 01Sign up
- 02Run a guided hunt on the sample workspace, no connector needed
- 03Connect your own sources when you're ready
