Platform · Threat Intelligence
Your knowledge
and ours.
Intelligence matters when it meets your data. Bring your own TAXII and MISP feeds, retro-hunt indicators across your history, and see what is relevant to you.
[ipv4-addr:value = '185.220.101.47'] OR [file:hashes.'SHA-256' = '9f2c…a41e'] OR [domain-name:value = 'cdn-update-check.net']
| Connection | Translated to | Matches | Status |
|---|---|---|---|
| huntbase (lake) | KQL | 2 | Done |
| acme-iceberg | KQL | 5 | Done |
| Sentinel | KQL | 0 | Done |
| Splunk | SPL | 1 | Done |
| Elastic | ES|QL | — | Running |
Write once, sweep everywhere
Write a STIX 2.1 pattern once. Huntbase sweeps every connection in one run and hands back the matches.
One graph that remembers
Indicators, CVEs, ATT&CK techniques and the groups behind them, joined to your devices, users and hunts.
Your feeds, your history
Connect private TAXII 2.1 and MISP feeds. Look indicators up in bulk and retro-hunt them across what you already store.
02Relationships graph
Public intelligence, joined to your environment.
Public intelligence arrives with its relationships already drawn, and your own entities sit beside it. Open the canvas and ask Scout what it sees.
- ATT&CK, whole. Techniques, groups and software as first-class entities, not just tags.
- Vulnerabilities explained. A CVE arrives with its weakness and affected products, so a finding explains itself.
- Briefings that respect TLP. Scout's threat briefings follow TLP markings. TLP:RED never leaves Huntbase.
- Ours means public. Huntbase brings public intelligence and tradecraft. Scout doesn't train shared models on your data.
- T1003.001 · OS Credential Dumping: LSASStechniquePublic
- G0016 · APT29uses T1003.001Public
- S0002 · Mimikatzimplements T1003.001Public
- CVE-2026-2231enables · CWE-269Public
- 185.220.101.47indicator · seen from WKS-2231Public
- WKS-2231device · Acme CorpYours
- m.reyesuser · logged on WKS-2231Yours
- H-118hunt · confirmed threatYours
03Every indicator
Indicators keep their context.
Markings stay attached
TLP and statement (copyright) markings are kept with each indicator and shown on it.
Revoked means revoked
STIX versioning and revocation are followed per indicator, so a revoked indicator stops matching.
The producer, on every indicator
Each indicator shows who produced it, from its STIX Identity.
IP ranges, matched live
CIDR ranges are matched live against incoming telemetry, as well as in retro-hunts.
Over the API
Feeds, indicators and lookups are available over the API with API keys, for automation.
OASIS interop tested
Tested against the 24 OASIS STIX 2.1 consumer interoperability test cases, over TAXII 2.1.
04In the loop
Intelligence that starts hunts.
A high-confidence indicator match opens a hunt. A sweep becomes a hunt; a hunt becomes a watcher; the watcher fires on the next indicator.
- No repeats. Repeat matches are deduplicated.
- Alerts capped. Indicator alerts are capped per hour.
- Blocklists as sightings. Bulk blocklist feeds are recorded as sightings without alerting, so millions of indicators don't flood your queue.
- Your bar, per feed. Analysts set the confidence bar for each feed.
Open by design
STIX 2.1
Write a pattern once; sweep every connection.
CACAO v2
Playbook export for partners, as JSON or YAML.
MITRE ATT&CK
Techniques, groups, software, mitigations and campaigns in the graph.
CVE · CWE · CAPEC · CPE
The vulnerability chain as linked public entities.
Questions
Frequently asked questions
Can I bring my own intelligence feeds?
Yes. Connect private TAXII 2.1 and MISP feeds alongside the public intelligence Huntbase provides.
Can I check a list of indicators at once?
Yes. Look indicators up in bulk, and retro-hunt them across your stored history to see whether they were already in your environment.
How does Huntbase decide which threats matter to us?
Threats are scored for relevance to your environment, and an ATT&CK coverage heatmap shows where your detections and hunts are thin.
How are TLP markings handled?
TLP and statement (copyright) markings are kept with each indicator and shown on it. Scout's briefings respect TLP, and intelligence marked TLP:RED never leaves Huntbase.
Does Huntbase learn from other customers' data?
No. Huntbase brings public intelligence and its own tradecraft. Scout doesn't train shared models on your data.
Your knowledge.
Our intelligence.
One graph.
Sweep new intelligence as soon as it lands. Your analysts decide what it means.
- 01Sign up
- 02Run a guided hunt on the sample workspace, no connector needed
- 03Connect your own sources when you're ready
