Platform · Threat Hunting

The threat hunting platform
that ends in a verdict.

A hunt starts with your hypothesis, runs as far as you allow, and ends with a verdict. Try it first in the Example Corp sample workspace.

Sign upWatch Scout hunt
Hypothesis-drivenCheckpointshunt.mdCACAO v2Sample workspaceHunts BETA
Hunt H-118 · rundll32 from Office
  1. HypothesisOffice spawning rundll32 is loading a remote payload on finance hosts
  2. Queryprocess_activity · parent WINWORD.EXE, child rundll32.exe · 30d
  3. AnalyticCluster by command line and destination · 2 hosts, 1 pattern
  4. CheckpointMandatory · confirm scope before live collection
  5. TaskCollect process tree from WKS-2231
  6. DetectionDraft Sigma watcher from confirmed pattern

Checkpoint · Mandatory

Two finance hosts match. Proceed to live collection on WKS-2231 and LT-0917?

ProceedDismiss findingsChange directionExpand scopeAbort

Coverage you can prove

Every hunt keeps a verdict log and a timeline, even when it finds nothing. Quiet is a result, not a shrug.

Checkpoints you set

Mandatory checkpoints stop the hunt until you rule. Advisory ones let it run. You set Scout's reach.

Playbooks you own

Save any hunt as a versioned playbook. Import and export hunt.md or CACAO v2, or start from more than 240 playbooks on the Huntbase Hub.

02Report, playbook, trigger

The hunt ends. The knowledge does not.

Every hunt closes with a report you can export to Word or Markdown: findings, evidence, recommended actions, owners and open questions. Save it as a playbook and arm it to run again.

  • Triggers. Arm a playbook to run when a watcher fires, above a severity you choose.
  • Schedules. Run coverage hunts hourly, daily or weekly, without anyone remembering to start them.
  • Readiness before you run. A playbook lists the sources it needs and whether this organisation has them connected.
Hunt report · H-118

Verdict

Confirmed threat

Dismissed

3 false positives

Open questions

1

EntityTechniqueRecommended actionOwner
WKS-2231T1218.011Isolate and imagem.reyes
LT-0917T1218.011Reset credentialsj.okafor
Save to Library as playbook · v1hunt.mdCACAO v2 JSONYAML

03In the loop

Every hunt leaves something behind.

A confirmed pattern becomes a watcher. A verdict closes the insight that started it. The next hunt starts from what this one learned.

Detection EngineeringSigma you write, test and version.
AI Alert TriageEvery finding pre-read by Scout.
Endpoint ControlEarly accessLive answers from every host.
ScoutAn AI partner you can trust.

Open by design

MITRE ATT&CK

Technique badges on findings and playbooks.

CACAO v2

Import and export playbooks as JSON or YAML.

hunt.md

Plain Markdown, so a playbook can live in git. Browse more than 240 published hunts on the Huntbase Hub.

Huntbase Hubhunt.md spec

Questions

Frequently asked questions

Can I try it without connecting my data?

Yes. Huntbase includes a sample workspace, Example Corp, with guided hunts, so you can run a hunt before you connect anything.

What does a hunt leave behind?

A verdict log, a timeline of what was asked and found, and a report you can export as Word (.docx) or Markdown. A confirmed pattern can become a watcher.

Can I bring hunts I already have?

Yes. Hunts import and export as hunt.md, an open Markdown format, and as CACAO v2 playbooks. The Huntbase Hub has more than 240 published hunt playbooks to start from.

How much does Scout do on its own?

As much as you allow. Choose Guide, Collaborator or Operator mode, and set checkpoints. Mandatory checkpoints stop the hunt until you decide. Nothing runs without your approval.

Start with a hypothesis.
End with a verdict.

Start in the sample workspace, or connect your own data and hunt today.

Sign upWatch Scout huntOr book a demo
  1. 01Sign up
  2. 02Run a guided hunt on the sample workspace, no connector needed
  3. 03Connect your own sources when you're ready