• Notes everywhere. Add notes to result rows and cells, entities, graph nodes, endpoints, indicators, telemetry rows and the hunt itself (under Notes on the Brief tab). Notes are saved and shared, show who wrote them, and appear in exports and reports. See Tags and notes.

• Threat Indicators and Tags on more than rows. Entities, graph nodes, endpoints and hunts can now be tagged Suspicious, Compromised, IOC · Confirmed and the rest, not only result rows.

• Scout suggests, you decide. Scout suggests tags with a confidence and a reason, and you accept or dismiss each one. A suggestion isn't evidence until it's accepted. Notes Scout writes carry a Scout badge.

• Investigation timeline. A new Timeline view on every hunt: your curated, UTC timeline of the incident. Add events with Add to timeline… from result rows, entities, endpoints and entity timelines, by hand, or with Suggest from tagged evidence. See Investigation timeline.

• Tracker spreadsheet. The hunt's .xlsx export is now an incident-tracking workbook: a master timeline, then Investigated Systems, Malware & Tools, Compromised Accounts, Network Indicators, Exfiltration, Evidence, Action Items, Case Notes and more, with status colours derived from your tags and timeline. See Tracker spreadsheet.

• Pick a report template, download as Word. Choose the template for each report: Threat hunt report, the new Incident / hunt investigation report, or your organization's own. Download the report as a Word document (.docx) or Markdown (.md). Reports now draw on your timeline, notes and tags, and flag unverified claims and drafts written on open hunts. See Hunt reports.

• Reports in the Activity feed. A new Reports pill lists every hunt's latest report, with its version, Draft / Final, template, quality flags and snapshots. Filter by draft or final and by template; open, download or export from the row; open a report's Versions and Snapshots in the side panel. Reports stay out of All Activity. See Reports.

• Report versions. Every generate and regenerate is a new version, and older versions are kept read-only. Open or download any version as .docx or .md, and see who generated it, when, and how (by hand, regenerated, by Scout or on hunt close). See Versions and snapshots.

• Tracker spreadsheet snapshots, opt-in. Exports still store nothing. Tick Save a snapshot (with an optional label) in the export dialog, or Also save a spreadsheet snapshot when you generate or regenerate a report, to keep the workbook on the hunt, paired with that report version. List, download and delete snapshots from Versions & snapshots. Snapshots follow the hunt's access and are removed with sample data. See Snapshots.

• "Am I ready to write this up?" Ask Scout in a hunt and it checks what's missing before writing the report: evidence not on the timeline, untagged IOCs, open leads, a missing verdict. See Write up a hunt with Scout.

• Sample data page. Example Corp sample data now has its own page in the docs and its own section in Settings › [Organization] › Sample data: what it includes, Pause for new sample alerts, a Remove automatically date and Remove sample data, which lists what goes and what stays before you confirm. Sample data is removed automatically 14 days after your own data starts arriving. See Sample data.

• Guided hunts on Example Corp. Start this hunt on a Try a hunt on Example Corp card adds the card's suggested queries as query cells. Once you've started one, the card offers Resume, and a card for a part of the story that hasn't happened yet says when it will be available.

• Organization profile. Describe your environment — products and data sources, size, business domain, cloud providers, security tools, compliance frameworks — on the organization's Overview, or during setup. Scout uses it to recommend hunts and spot telemetry gaps. See Organization profile.

• Record & close in one step. The verdict cell asks for a one-line rationale, and Record & close hunt records the verdict and closes the hunt together; Record only keeps it open. After a reopen, the verdicts the hunt was closed on read Superseded. See Verdicts.

• Undo and restore archived cells. Archiving a cell offers Undo, and an archived cell has Restore.

• {{parameter}} prompts in the notebook. A query cell with unfilled parameters asks for them inline before it runs.

• OR in searches. Join words or phrases with a capital OR to find events that contain any of them. Search these N values on pasted text now uses it. See Search telemetry.

• Scripts and Actions (beta, rolling out). Library › Scripts to review scripts and Sign and publish them, with a second person required for high-risk versions. Library › Actions for saved endpoint actions with an approval policy, rollout and expiry. Activity › Actions lists runs, with approve, pause, resume, stop and retry. On an endpoint, Respond › Saved Actions and Save as Action. See Actions and runs.

• Response actions on the investigation timeline. A hunt's Timeline lists the isolate, release, kill, script and file-collection runs on its endpoints beside your own entries, with who requested and approved each, the reason and the outcome (Succeeded, Failed, Awaiting approval, …). They're read-only, Show response actions hides them, and the tracker workbook includes them. See Investigation timeline.

• A customer copy of the tracker workbook. The export dialog asks Who is it for? Internal (working copy) is unchanged; Customer copy turns analyst names into initials, leaves out emails, case notes, internal plan steps and raw step results, keeps only tagged evidence, and says who prepared it. See Tracker spreadsheet.

• "Why this fired." A hunt a watcher opened explains itself under Provenance and in the watcher's note in the notebook: the watcher and its rule, a summary such as "11 signals from 4 sources over 2 days", Linked by chips for what the signals share, and the signals grouped by day. It replaces What fired this. See Hunt views.

• Linked identities. Hunt › Brief, the finding panel and the graph panel for an IP or host show which accounts signed in from those addresses or to those hosts — "Signed in from 203.0.113.201 on 6 Oct · 2 failed attempts" — each with a Sign-in events link. See Entity timeline.

• Map for Search results. Search results that carry a location, such as Okta or Entra ID sign-ins, get the Map view, and Map plots coordinates in nested fields too. See Search telemetry.

• SigNoz connections. Connect SigNoz and query it in SigNoz Query (JSON) or SigNoz SQL (ClickHouse); Scout can write SigNoz queries too. See Connections.

• Scout fixes broken cells. Check why / Why no rows? on an empty result, Fill with Scout for missing parameters, Rebuild query on a cell with no query, Review approvals with Scout from Needs you (safe groups pre-selected, likely duplicates flagged) and Use Scout's draft on the verdict cell. Nothing is saved, approved or run until you do it. "N claims unsupported" now highlights the sentences. See Approvals.

• Updated terms. Our Terms of Service and Privacy Policy were updated on 10 October 2026. You'll be asked to accept them the next time you open Huntbase.

Improvements

• A query typed on Auto runs. On the Auto language, in a query tab or on Home, SQL, SPL, KQL and other queries run in their own language instead of going to Scout. For SQL, Auto picks the dialect from the tables the query names and the connections in scope.

• One set of approval words. Approve & run when approving starts a run, Approve otherwise, and Approve step on a checkpoint (under Your approval is needed). Accept task is gone. Endpoint proposals in Needs you show Review and are approved on their own card.

• Needs you follows the notebook. Items are listed in notebook order, with the verdict last.

• Honest Run all. The button says what it will do, such as Run 2 · 6 need approval, and its tooltip lists where it will stop.

• Scout plans behind one gate. When Scout plans a hunt in Guide or Collaborator, the plan is query steps behind one approval checkpoint, and nothing runs before you approve it.

• Closing a hunt settles it. Steps waiting for approval are rejected, running steps stop, and the hunt leaves Needs you. New Explorer tabs no longer attach to a closed hunt, and a closed hunt offers no reruns.

• Scout: Guide / Collaborator / Operator. The hunt header's mode chip names Scout, so it no longer reads like a sharing role. When the header is short of space, its chips fold into +N and the title keeps its room.

• Scout Summary sticks to the hunt. A hunt's Scout Summary is written from its own cells: hypothesis, queries and row counts, notes and verdict.

• Sample hunts are Example Corp's. Sample hunts are owned by Example Corp (sample) and are read-only, and the hunt menu offers Add from Library…, Import YAML and Triggers… only to people who can edit the hunt.

• Sample connections don't mark products Connected. In Add a source, products only Example Corp has a connection for show a Sample chip and stay under Available. Sample connections are in scope for queries.

• Connection setup says why Continue is off, and a reloaded link keeps the product you picked.

• Pulse links show the whole picture. Links from Pulse into triage keep Pulse's time window and show the whole team's hunts.

• The approver can end live response that their approval started. See Files and console.

• Live tail checks access. A live tail ends if you lose access to an organization it covers.

• Better template search. Library and ⌘/Ctrl+K template search match on words first and only add close matches in meaning.

• Keyboard. ⌘⏎ / Ctrl+⏎ runs the focused notebook cell, the same keys as inside the editor (⇧⏎ still works outside an editor). Arrow keys, Home and End move along Explorer's tab bar. Shortcut hints show Ctrl on Windows and Linux.

• Sentence case. Menus and the command palette use sentence case: New query, New hunt, Quick actions, Recent queries. Field and column labels keep acronyms: Client IP, Event ID. The app now uses the Geist and Geist Mono fonts, and copy follows one style: Sign in / Sign out, and Activity feed in sentence case.

• Tooltips open and close the same way everywhere.

• Watchers say why they're quarantined. The quarantine banner shows Manual release required and why — for example, it tripped 3 times in 7 days, and only the first 2 trips release on their own — plus Trips in 7 days and how many matches were dropped this hour over the hourly digest cap. See Quarantined watchers.

• Matches held below the severity floor. Watcher rows and the drawer say "N matches held below your High threshold in the last 7 days · View", Activity has a Held below the threshold section with a shortcut to Change the severity floor, and watcher findings now reach the bell and Needs attention.

• Watcher severity and the floor, separately. The severity chip shows the watcher's own severity, the organization's floor shows as Fires at ≥ Low, and hunts a watcher opens keep the watcher's severity.

• Off watchers say what switching on would do. Ready · off is now Data ready · off, with a tooltip on Shadow and On, and Settings › Watchers no longer shows an Off watcher as Armed.

• Library › Watchers and Intelligence › Watcher health. Library › Detections is now Library › Watchers, and Intelligence › Detections is now Watcher health; old links redirect. A watcher is the rule; a detection is what it produces. See Watcher health.

• More SigmaHQ rules compile — about 3,140 of 3,302, up from about 2,330, with gains across Okta, GCP, GitHub, Kubernetes, Duo, Entra ID / Microsoft 365, Sysmon, Zeek, auditd, Windows channels and more. See SigmaHQ rules.

• Scope picker groups. For service providers, the scope picker groups organizations under Customers of your provider, Your organization and Personal (Only you).

• Recent queries: Mine / Everyone. Explorer's Recent queries shows your own queries by default, including ones Scout ran for you; Everyone shows the rest.

• "New events delayed since …" Telemetry › Sources and Search say when new events aren't landing yet. They're kept and appear once processing catches up.

• Side panels lead with what matters. Finding, graph entity, collection, action, threat, feed and watcher panels open on key facts, name affected hosts, link related hunts and findings, tuck ids under Identifiers, and keep their header in place as you scroll. Collection runs show Requested by and the Reason, and label the hash Archive SHA-256, for checking the download.

• Panels say when loading failed. Notifications and the hunt flow panel show Couldn't load … with Try again instead of an empty state, and Scout no longer says "Analyzing results…" while idle.

• One message when Huntbase is unreachable: "Can't reach Huntbase right now. We'll keep retrying." with Retry now, instead of every panel failing on its own.

• Export all endpoint activity. Endpoints › Activity's Export this page is now Export all N, which exports every row matching the filters, up to 10,000.

• Connections. New connection opens the full catalog; the inventory has filter chips with counts (Can't be queried, Needs attention, …) and a List / By product switch; the failing-connections banner has Show all N.

• Consistent menus. The endpoint header has Respond ▾ (Investigate / Undo / Contain), each header has one ⋯ menu, and row actions sit in a sticky last column.

• More room for results. Events over time folds to a one-line sparkline (folded by default in Table view), and your choice is remembered.

• Readability. Text meets WCAG AA contrast in light and dark mode.

• Clearer hunt state. A paused Run all reads like Cancel paused run (6/16 · 3 waiting for approval); tasks being worked on show as in progress, not running; a checkpoint asks for approval only once the run reaches it; partial runs show their rows with a Partial badge and the reason; and a failed cell says when the problem is access to a connection rather than the query.

• Reports. The report screen says what generating it added to the hunt; data sources the hunt never queried are flagged; unapproved proposals stay out of the evidence; durations are checked against the timeline; and report tables use the page width.

Bug Fixes

• Activity feed summary cards count every hunt in the window, and sample rows carry the Sample chip.
• Notification settings no longer fail to load when a new category, such as Inbox, appears.
• Start hunt from an inbox message creates the hunt in that message's organization.
• Typing fast in a query editor no longer drops characters.
• Your chosen organization is kept across a reload.
• Editing or deleting a query schedule now takes effect.
• Date-range presets such as Last 7 days respond to clicks again.
• Check against history on a watcher no longer times out, and backtest samples show the time, host and what matched.
• A fleet query that returned rows no longer ends as failed, and an invalid query no longer marks a connection unhealthy.
• The hunt entity graph no longer shows duplicate device and IP nodes, and labels nodes by value instead of column name.
• Watcher started a hunt notifications link to the hunt, the new-message pop-up no longer shows raw {{…}} placeholders, and inbox Run query opens with the right connection selected.
• Lapsed Scout proposals show as lapsed, not failed.
• Coverage and threat drawers update as soon as a watcher is switched on or off, entity panels name the real intel feed (for example ThreatFox), and Scout's indicator lookup recognises community-feed indicators.
• Intel retro-hunts also search your own lakes, and the maximum threat level is honoured on API-mode MISP feeds.
• Hunt titles are no longer cut short with "…", and exports get sensible file names.
• Endpoint check rows count in Results and can be tagged, and Add to timeline… fills in the host, time and id.
• Activity feed digest tiles say what they count, type pills keep their own time window, and Pulse reads "So far" for All time.
• Smaller fixes: lake results say "N stores", not "1 connection"; a long unmapped-columns notice collapses; the collect-file dialog no longer opens with an error; an empty Search can't be submitted; run links open in Query mode; Library framework counts match the list; and a connection's run-history chip says Responding.

• Added live response: Endpoint Control can open a short-lived, encrypted, outbound-only channel to an endpoint. Console commands then return in well under a second, and actions run in about a second instead of waiting for the next check-in. Sessions start from a signed, single-use ticket, are capacity-limited per environment and end automatically. If the channel drops, delivery falls back to normal check-ins.
• Response actions can now be dispatched to endpoints from Endpoint Control, and each result is reconciled against the action that was sent.
• Scripts can now be scoped to individual environments, and a new script can be deployed to several environments at once.
• Safe mode can now be set per environment from Endpoint Control. Turning it on blocks response actions on endpoints and ends any live sessions.
• Log destinations can now be configured per environment, and different kinds of data can be sent to different destinations.
• Collected files can now be permanently removed, including their stored contents. Retention now also reclaims storage from deleted collections.
• Added a per-environment breakdown of endpoint agent versions.
• The console is now available in 13 languages, and your language choice follows you across devices.

Improvements

• Refreshed the console's look and sign-in page, and added more console commands.
• Status logs can now be filtered by severity, and the dashboard now shows errors reported by endpoint agents instead of a failed-enrollment count.
• Email addresses can now be used as usernames, which makes single sign-on simpler.
• Enrollment packages are now built for multiple processor architectures.
• Endpoint last-seen times reach connected Huntbase workspaces faster, with less load on the server.
• Retired the legacy admin interface. All management now happens in the current console, and background cleanup continues automatically.
• Endpoint Control no longer relaxes the endpoint agent's extension safety checks. Extensions must be owned by an administrator and not writable by other users.
• Interactive console and file browser results are never forwarded to your log destinations.

Bug Fixes

• Fixed console and file browser sessions timing out because of stale cached data.
• Fixed an error when tagging endpoints, and incorrect expiry times on enrollment packages.
• Fixed response actions sent from Endpoint Control being rejected by endpoints, and scripts reporting success without running.
• Fixed safe-mode changes occasionally being lost when settings were updated at the same time.
• Strengthened protections around cross-environment access to settings and statistics, stored log destination credentials, and file quarantine on the endpoint agent. The sign-in page no longer lists environments.

• Endpoints (beta). A new top-level workspace for the hosts you manage through Endpoint Control. Your scope decides which fleets you see — one per Endpoint Control connection — and a fleet switcher moves between All fleets and one fleet. Six tabs: Overview, Endpoints, Collections, Activity, Access and Deploy. See Endpoints overview.
• Fleet health at a glance. The Overview tab counts Online, Stale and Offline endpoints, charts check-ins, breaks the fleet down by platform and agent version, lists recently enrolled endpoints, and flags what Needs attention — an install link about to expire, endpoints offline for over 7 days, endpoints behind on their version.
• One table for every endpoint, across fleets: filter by status, platform and tag, search by hostname, IP, UUID or serial, see 24 hours of activity per row, and Tag, Run query on these, Collect file or Remove in bulk. When a selection spans fleets, the action applies to the endpoints you are allowed to act on and says how many are skipped. See Endpoints and endpoint details.
• A page per endpoint: identity, hardware, activity, tags, Logs, Open in Explorer, and Seen in hunts — the hunts whose results included it. Run query opens a query tab targeted at exactly that endpoint; a Targeting N endpoints banner warns if the targeting is edited away and offers Restore targeting.
• Collect file. Pull a file from one or more endpoints into a bucket your organization owns. Each run shows per-endpoint status, size, the SHA-256 of the stored archive and Download. See Collect files.
• Storage destinations in Settings: an S3 or S3-compatible bucket you own, with Test connection, a write-only access key and one Default. File collections need one. See Organization management.
• Endpoint access. A Responder role lets someone collect files, browse files and run console commands without being a connection admin. Grant it on a whole fleet, or grant Viewer, Operator or Responder on a tag — "responder on everything tagged finance". Only tags in a folder marked Access-bearing can carry access. See Access and activity.
• An audit trail per fleet. The Activity tab lists every hands-on operation — who, what, on which endpoints, with what outcome — including denied attempts and work done by Scout, a schedule or a watcher on someone's behalf. Command text is recorded; console output and file contents never are.
• Files and Console (beta, separate rollout). Browse an endpoint's file system and run read-only commands and osquery SELECTs on it, live. Sessions start only when you click start, end when you leave, and everything in them is recorded under your name. File retrieval from the console is refused — use Collect file. See Files and console.
• One new tab (beta). + in Explorer's tab bar opens a New tab with one input and four shapes: Auto, Chat, Query and Hunt. Auto says what Enter will do before you press it: a question goes to Scout, a single value or field:value text searches your telemetry, and KQL for the Huntbase data lake runs. Any other query language opens in Query and waits for ⌘/Ctrl+Enter, and Auto never starts a hunt by itself. Pick a shape with Ctrl+Shift+1–4 or a slash command (/chat, /query, /kql, /osquery, /search, /hunt). The ▾ next to + still lists New chat, New query, Search telemetry and New hunt, and Home uses the same input. See Open a new tab.
• Search (Huntbase Lake) (beta). Browse is now a query language, first in Query's language pill. Type words, "quoted phrases", -word, field:value, -field:value or field:*, and press Enter; an empty search shows every event in the window. A search is saved as a query, so it has a run list, Add to hunt and a schedule, and a search tab's Search / Query toggle shows the KQL it compiles to. Filters you click in a search apply at once. /search, /browse and ?new=browse links open it. See Search telemetry.
• Paste and drafts (beta). Paste a block of text or drop a text file and choose what to do with it: Ask Scout about it, Search these N values, Hunt over it or Put in Query. What you type in a new tab survives a reload, and a short draft in a closed tab comes back from Jump back in.
• Refine a query in place (beta). Re-running an edited query updates the same tab; Run in new tab (⌥⌘Enter / Alt+Ctrl+Enter) keeps the old results. Run N of N with ◀ ▶ steps through earlier runs without running them again, and Edit from this run brings one back into the bar. After a run the bar shrinks to one row; click it, or press / or ⌘/Ctrl+E, to expand it. See Refine a query in place.
• Filters wait for Apply (beta). On queries that run on your connections, values you click in the results queue as chips, and Apply N filters adds them all and runs the query once.
• Add to hunt (beta). Add query results, a Scout answer or a graph node to the hunt picked in the tab bar, another hunt, or New hunt from this. An added query tab stays linked to its step, and later runs update it. See Add work to a hunt.
• Scout sees what you're asking about (beta). Asking about a row, a graph node, an event in a search or a hunt step goes to Scout in the dock with that item attached. The dock offers Summarize results instead of analyzing every run, and Open as chat tab moves a conversation into its own tab. See Ask about what's on screen.

Improvements

• Endpoint Control speaks one vocabulary. The connection page and the Deploy tab now say Install on endpoints, Uninstall from endpoints, Install link secret and Manage link. Install and uninstall commands, and the secret, are shown only to fleet admins; everyone else sees when the link expires and whom to ask. See Endpoint Control.
• With Endpoints enabled, an Endpoint Control connection's page shows a compact Fleet card with Open in Endpoints in place of the two-tab panel.
• Fleets that serve more than one organization are marked Shared and are view-only.
• A hunt query cell opened with Open as tab stays linked to its step: runs in the tab update the cell instead of adding a new one, and a run from the notebook or Flow view shows up in the tab. See Add, move and remove cells.
• New notebook cells, including telemetry and endpoint cells, hang off the step they follow instead of starting a new branch in the Flow view.
• @ mentions reach Scout as the entities and insights themselves, not just their names.
• Entity and query template lookup moved to the command palette (⌘/Ctrl+K). Picking an entity opens its graph and picking a template opens it ready to run. Search "…" in entities and queries opens the full grouped search, and Search telemetry for "…" searches your telemetry. The query bar's Auto language no longer searches entities; it hands your description to Scout. See The command palette.
• Column settings in query results belong to each tab.
• The query editor now loads from Huntbase itself, so a blocked content delivery network no longer leaves it stuck on loading. If it takes more than a few seconds, a plain text box stands in, with Retry, until it's ready.

Bug Fixes

• Changing only the time range of a query and running it again now runs over the new window.
• A /query or /knowledge prefix in chat applies to one message; the next message goes to Scout as usual.
• Enter picks the highlighted @ mention instead of sending the message.
• Choosing not to send from an inbox message leaves the prompt in the chat box as an editable draft.
• A query template's page now lists the schedules attached to it.
• Esc that closes a menu, or is typed in an editor, no longer also leaves full view or closes the details panel.
• ⌘/Ctrl+K opens the command palette with Caps Lock on and on non-Latin keyboard layouts.
• In a hunt notebook, a / b with no cell focused adds the cell at the end.

• Hunts open on a notebook. A hunt is now a folder in Explorer — Notebook, Results, Flow and Entities views behind one switcher, plus its report and chats — and it opens on the notebook: the steps as an ordered list of cells, each saying what it found (12 rows, No rows, Failed) with the output underneath. Sections group cells, notes sit between them, and the flow graph is one click away rather than the landing page. See Hunts.
• Fix failed steps in place. A failed cell shows its error with Fix with Scout, Edit and Retry; cells that failed for the same reason say so. Scout's fix is a new cell that replaces the original (v2 of N), so the record stays intact. Scout's schema probes fold into a Discovery strip.
• Verdicts are a log. The verdict cell offers Confirmed, Nothing found, Inconclusive and False positive, with the server's guard rails explained inline. Recording a verdict no longer closes the hunt: keep hunting, record again, and every entry stays. Scout adds draft verdicts as the hunt progresses.
• Needs you, in order. The notebook's right pane lists what is waiting — failed cells, checkpoints, approvals, the verdict — ranked by the server, with Next to walk through them and Approve & run on checkpoints from the list. The hunts list and the triage lane use the same ranking.
• Edit cells where they are. Query cells edit inline with the same editor as the query workspace; insert above or below, move up or down, archive, or delete a cell that never ran. Keyboard: j / k, a / b, ⇧⏎. New cells appear the moment you click.
• The dock is a rail of views. One view at a time — Workspace, Chats, Queries, Library, Scout — instead of a stack of panels. Workspace is a tree: every hunt is a folder that expands into its notebook, flow, results, entities, evidence, report and chats, with pins, needs-you counts and a find field; Stores and Schedules sit beneath. Every view ends with an Ask Scout strip. See Explorer overview.
• Library, for this hunt. Inside a hunt the dock's Library view leads with Suggested for this hunt, each template with Add to hunt.

Improvements

• Hunt rows in the Activity Feed show a per-step Cells strip, a derived state (Checkpoint waiting, N failed, Needs verdict…), a Needs you count, and whether a hunt with a verdict is open or closed.
• Closed hunts and hunts you cannot edit say so in the notebook, with Reopen hunt for the owner.
• The hunt header counts cells, matching the notebook; the flow's node cards say what a step found rather than that it ran, and a dashed v2 edge links a replaced step to its replacement.
• Results opens even before any step has produced rows, and lands on the cell you came from; Show scaffold and Show archived reveal rows the grid hides by default.
• The notebook's side pane is the same resizable panel the entity explorer uses, and becomes a sheet on narrow screens.

Bug Fixes

• Flagging a result row from the flag column now writes one organization-wide flagged tag, so every analyst sees the same flags. Previously the first click was rejected.
• Starting a new chat from the dock always opens a fresh conversation and no longer steers the dock to an empty Scout view.
• Template suggestions appear again when you type in a new query cell.

• Endpoint details now show recent activity, the configuration the endpoint actually receives, health metrics, uptime and the approximate location of the endpoint's IP address.
• Added a read-only console and file browser for individual endpoints. While a session is open, the endpoint checks in every few seconds, and it returns to its normal interval when the session ends.
• Redesigned the query and file-collection views, with clearer status, per-endpoint progress and controls.
• The endpoint agent can now carry out response actions: run a signed script, stop a process, quarantine or restore a file, delete a file, and isolate or release an endpoint's network. Each action needs a signed, single-use, short-lived authorization. Actions support a dry-run mode, a safe-mode switch and rate limits, and every action is recorded in an audit trail on the endpoint.
• Endpoint Control now delivers endpoint agent extensions and their per-environment settings to enrolled endpoints automatically, and supports larger agent packages.

Improvements

• Added refresh buttons to tables, and the dashboard now shows endpoint activity per environment.
• The server now keeps serving cached data, and reports a degraded status, during brief backend database interruptions.

Bug Fixes

• Fixed saves in the console failing with a security-token error when the same account was signed in elsewhere or a tab had been open for a long time.
• Fixed an issue where saving an environment's agent flags was rejected as invalid.
• Fixed the endpoint agent extension restarting repeatedly when the agent ran with verbose logging enabled.
• Fixed active endpoints sometimes showing as inactive, and the 24-hour activity tile showing incorrect data.

• Data lake (beta). Query telemetry that lives in a data lake, two ways: point Huntbase at an Apache Iceberg store you already own, or ship logs straight to Huntbase from Fluent Bit, Vector, rsyslog or syslog-ng. A lake store shows its provisioning progress step by step and says clearly whether it is in federation — that is, whether lake queries actually read it. See Data lake.

• KQL (Huntbase Lake) is a new query language in Explorer. It needs no connection: one query searches every lake store available to you at once. See Query languages.

• Telemetry ingest keys, minted per shipper with ready-to-paste configuration for four log shippers and a reachability check you can run before involving any secret.

• Results say what the run actually searched. A lake run reports how many stores it read, which of them were excluded — a warning, because excluded stores make your results incomplete — and any row cap that was applied. Rows carry the store they came from, and you can narrow to one store from a row.

• Watchers is now a top-level page (previously under Settings), rebuilt for a catalog of thousands: search across names, descriptions, ATT&CK techniques and rule text; filters that show how many watchers are in each bucket; grouping by state, severity, plane or tactic; and a virtualized list. See Watchers.

• Watchers run Off, in Shadow, or On. Shadow evaluates a watcher and records it to the digest without opening a hunt or notifying anyone — the safe way to find out whether a rule is noisy. New watchers are created in Shadow, and turning one on is a separate, deliberate click.

• Per-organization watcher enablement is now visible. A watcher's state, severity floor, action and hunt mode belong to one organization; the page has an organization picker, and each watcher has a Deployment tab showing its state in every organization you can see.

• Write your own watchers as Sigma rules. The editor compiles as you type, shows which data surface the rule binds to and which fields that surface actually provides, and can backtest a draft over your own history before it is saved.

• Watcher history. Every edit to a watcher is kept as a version with a note, and the History tab diffs any version against the rule running now. An earlier rule can be restored — saved as a new version rather than a rewind — and firings are labelled with the version that fired.

• Set every organization at once from a watcher's Deployment tab, with each organization answering for itself: one refusal doesn't silently take the others down with it, and an organization that can't run the watcher says why.

• Watcher activity: fired, suppressed, entities touched and hunts opened over 7, 14 or 30 days, with daily bars and the recent firings.

• Connections is built around what you have. The page now opens on a list of your own connections — with health you can sort by, a filter for the ones that need attention, and your ingest keys underneath — instead of a catalog of 158 products with your connections hidden behind per-product counters. Adding a source is its own tab, which opens with the three ways in.

• The Connections page says which way the data moves. Products are split into query sources (Huntbase holds a credential and calls the vendor when a query runs) and data destinations (a store Huntbase reads directly, which is the side that accepts a log shipper), with a filter for each and a badge on the card.

• Send telemetry to Huntbase without a store of your own. A card on the Connections page — and in onboarding — mints an ingest key, shows the endpoint, generates the shipper config, and says whether anything has actually arrived on the keys you have. Previously this path existed but was only reachable from an Iceberg store's connection page.

• Crowded entity graphs fold up. More than ten neighbours of the same type on one node now draw as a single collection node badged with the count — click it to open the crowd, or turn grouping off from the toolbar. The results table still lists everything, and the legend counts members rather than shapes.

Improvements

• One hunt workspace. An empty hunt opens with three doors — have Scout plan it, ask a question, or add from the Library — with the Scout mode selector beside them. Clicking a step opens one side panel with Overview, Results and Activity tabs instead of taking over the canvas, and a step's query is edited with the same editor as the query workspace, with Run (save then run) and Save without running. Scout stays reachable from the canvas toolbar, the hypothesis offers Suggest / Regenerate, and plain English typed into a hunt offers Ask Scout rather than becoming a broken step.
• Library while hunting. A query template's details panel offers Add to hunt while a hunt is active, and the hunt's own template registry is reachable from its ⋯ menu, canvas and empty state. The platform filter is a compact picker.
• Panels remember themselves. Whether a query tab's details panel is open is remembered per tab rather than carried in the address, and the dock and canvas toggles persist between sessions.
• Creating a connection is now a page, not a modal. Four steps — Product, Details, Connect, Verify — with a rail that tells you which credential to fetch from the vendor before you start. The connection is checked as soon as it is created, and a failed check can be fixed, retried or discarded without leaving the page. Your progress lives in the page's address, so you can come back to it or hand the link to whoever holds the credential. Onboarding now uses the same components.
• Onboarding asks the real question. The connect step now offers both ways in as equals — connect a source, or send us telemetry — and either one completes it.
• Watcher readiness is stated, not implied. Each watcher says whether it is Armed, Needs data (with the specific missing source), or whether the readiness check itself could not answer — three different things that used to look the same.
• Backtest counts are honest. Where a rule uses a construct the historical query can only approximate, the count is shown with a ≥ and labelled a floor. Watchers with no retrospective form say why instead of showing a button that does nothing.
• Suppression counts distinguish "nothing measured this" from zero.

Bug Fixes

• Fixed a query result set with no connection being reported as a failed connection, which made a successful lake run look like a failure.
• The Activity Feed's Queries tab now labels lake and entity-graph queries Data Lake instead of flagging them as having no connections.
• A hunt query step's Applicable connections list now matches the step's product, not just its query language — a CrowdStrike step no longer lists every steampipe connection in the organization.
• Column layouts in a hunt step's results table are now remembered per step; resizing columns on one step no longer changes another step's table.
• Fixed a page-header update loop on the watchers page that could prevent navigating away from it.

• Hunt playbooks import and export as hunt.md, and CACAO playbooks can be imported, so a playbook can be reviewed, versioned and shared outside Huntbase.
• Ask Scout about the entity graph. Open a graph and ask a question about what is on the canvas without leaving it; chips now seed a graph rather than a search.
• A "what now" worklist on the Explorer landing surface, so opening Explorer starts with what is worth working on rather than an empty tab.
• Map view for query results. Results with geographic fields render on a real map, alongside the table, chart and other shape-aware views.
• Results can stay pinned open beside any view, so you can read the rows and a chart at the same time.
• Graph fan-outs run from the Library as estate checks — a question asked across your estate — instead of being forced into the shape of a query.
• A searchable filter panel in the Library, with filters for language, owner and platform.
• Template-driven hunt reports, plus an organization report-template editor, so reports come out in your own format. Scout shows a report card when it queues one.
• A Template tab in the query details panel, showing the template a run came from.
• Insights show where they came from. Watcher-raised insights and hunts name the watcher that raised them, and the Activity Feed can filter by origin and triage state on the server.

Improvements

• The Activity Feed is built for auto-hunt scale: server-side sort and origin/triage filters, campaign roll-ups from the server, multi-select type filters, a board view of the whole pipeline, collapsed concluded columns, and archiving a hunt or query from the list it appears in.
• Honest result counts. Query results now say what they actually measured — including when a scoped filter is why a result is empty — rather than presenting a number that reads as complete.
• One query workspace. Query, hunt and graph tabs now share one frame, one query bar and one panel mechanism; panel open/close behaves the same everywhere; tabs are coloured by subject and say how your query was read.
• The hunt canvas became a workspace: clicking a step opens its query in the viewport, you can ask a question without leaving the hunt, node detail lives on the shared panel, and there is one clear first action on an empty hunt.
• Outbound links are checked against a trust policy before they open, including links derived from event data.
• Entities: account and user are now separate entity types, named-object lists render as chips instead of raw JSON, and the entity detail panel matches the insight panel.
• Discovered schemas explain themselves. On a dynamic-schema connection, table descriptions can be edited (badged User Modified, with Discard user edits to revert), and discovery errors are shown on the connection and on the table that failed.
• Provider coverage is driven by what is actually available, not by what a definition claims.
• Restoring a closed Explorer tab restores one tab, not two, and ?graph= works when Explorer is already open.
• Upgraded to React 19.

Bug Fixes

• Fixed hunts counting entities they were tagged with rather than the ones they observed.
• Fixed the Activity Feed showing organizations under "Run by" instead of the person who ran it.
• Fixed the feed fabricating a severity and status for insights that had none.
• Fixed Cypher query templates being gated on having a connection, which they don't need.
• Fixed graph canvases showing tenancy edges, and finding nodes going unlabelled.
• Fixed tags being requested for resources the API cannot address.
• Fixed the docked Scout chat losing its chain of thought, and hunt-panel navigation from the dock.
• Fixed Scout resource references not resolving on historical runs.
• Fixed detail-panel titles truncating identifiers.
• Fixed creating a hunt from the top navigation not routing to Explorer.
• Fixed an edited query re-running in place instead of opening its own tab.

• Scout can now discover and query data stored in connected object storage (such as Azure Blob Storage and Amazon S3), including CSV and log files, with a status card on the connection page showing schema sync progress.
• Simplified pricing: Huntbase now offers two plans — Personal and Teams — both free.
• The find/lookup tool is now built directly into the query bar in Explorer, so you no longer need a separate panel to look things up while writing a query.

Improvements

• KQL queries now get proper syntax highlighting in the query editor.
• Queries against Azure Log Analytics connections using KQL now run natively for more reliable results.
• Running a query template from the Library now opens it directly in a new Explorer tab instead of a separate wizard, making it faster to get from a template to a working query.

Bug Fixes

• Fixed an issue where re-running a query could show leftover results from the previous run instead of the new one.
• Fixed the Library and query search so they only show templates and results for connections you actually have access to.
• Fixed an issue where editing and re-running a query overwrote your current tab instead of opening a new one.
• Fixed the Activity Feed so related query runs from a single submission are grouped together instead of listed separately.
• Fixed an error that could occur when creating a query from a template without adding extra query content.
• Fixed an error that could prevent Watchers from being created.
• Fixed autocomplete suggestions for Endpoint Control queries so table names now resolve correctly.
• Fixed an error creating connections that don't require authentication.
• Fixed several billing reliability issues, including incorrect handling of billing email and stale plans reappearing after removal.
• Fixed an issue where creating a query without explicitly specifying a connection could fail instead of auto-selecting a suitable one.
• Fixed the "processing entities" indicator getting stuck indefinitely on queries that don't extract entities.
• Fixed an error that could prevent hunts from being created for certain newly added users.

• Added Watchers: admin-authored rules that continuously watch your security graph and, on a match, automatically start a hunt, raise an alert, add to a daily digest, or tag data for later use.
• Hunts and queries are now private to their creator by default. Org admins can grant broader visibility or explicit sharing as needed.
• Insight details now show enrichment from CVE and MITRE ATT&CK data directly in the panel, and fixed a bug where insight descriptions sometimes failed to display at all.
• Added a general-purpose webhook for ingesting OCSF-formatted alerts, making it easier to connect external detection sources into Huntbase.
• The hunt workspace now has a Provenance view showing what triggered a hunt (a watcher, an insight, a template, or a manual start), along with a refreshed hunt canvas.
• Queries, runs, and hunts now show who created them — a teammate or Scout — with a creator filter in the activity feed.
• Redesigned the Library with a persistent sidebar for browsing by content type (queries, collections, actions, hunt playbooks), plus faster loading.
• Scout can now reference entities inline in chat as clickable chips that open the entity card, for both public threat-intel entities and your own tenant's entities.
• Overhauled Scout's threat-hunting approach with improved plan and hypothesis quality, added tradecraft guidance, and memory that carries context across related hunts.
• Scout now remembers your last-selected initiative (effort) level and uses it as the default for new chats.

Improvements

• Removed a confusing, non-functional time-travel slider from the entity detail panel.
• The home screen's Ask box now matches the full chat input, including the initiative selector.
• Fixed several places where Scout's analysis notes, findings, and monitoring messages displayed raw markdown instead of formatted text.
• Cleaned up naming for query languages in the library, removing a redundant, confusingly-labeled option.
• Scout's query suggestions now use only the connections that are actually applicable to a given query.
• Improved the performance and stability of the security graph as data volumes scale.
• Improved overall app stability and responsiveness under heavy load.

Bug Fixes

• Fixed a blank detail panel when viewing analytic nodes in the hunt flow.
• Fixed query runs failing for connections that don't require credentials, such as public data sources.
• Fixed Endpoint Control query runs sometimes showing as complete before all results had finished loading, or getting stuck/marked failed while still running.
• Fixed several issues in the query workspace where switching between runs or queries could get stuck, flicker, or lose your place in the browser URL.
• Fixed "Open in tab" from the hunt panel not loading a query's previous results.
• Fixed hunts created from Scout chat sometimes not appearing in the conversation.
• Fixed org admins and owners not always being able to see hunts, queries, and runs created by other members of their team.
• Fixed a data-lookup mismatch that caused entity extraction to miss data for a large share of endpoint queries.
• Strengthened tenant data isolation on export and data-read endpoints.
• Catalog-provided watchers are now off by default, so they no longer unexpectedly re-enable after platform updates.
• Fixed queries added to an in-progress hunt sometimes being tagged with the wrong query language.
• Added a clear error message instead of a crash when a hunt step references a deleted query.

• Scout can now work directly inside the hunt workspace — drafting hypotheses, creating and running hunt sessions, and streaming its analysis live as it works.
• Added Explore, a free-text search across entities and saved queries, with rich detail previews and pivots to related data.
• The query library and query bar now support natural-language search, with Scout stepping in to help find or build the right query when nothing matches.
• Added Watchers — admin-defined graph patterns that can automatically start a hunt, raise a finding, or flag data when a match occurs.
• Scout can now search and browse the web to enrich its analysis, controllable at the organization or user level.
• Query templates can now specify which operating systems they support, so endpoint queries only run on compatible devices.
• Added the ability to view and create schedules for query templates directly from the library.
• New per-connection sync settings let you enable or disable scheduled queries for a connection, with upfront visibility into what will run.
• Introduced an invite-only early access mode, showing a "coming soon" plan view for teams not yet onboarded.

Improvements

• Scout chat now shows live status of suggested queries and prompts follow-up analysis when a query finishes or fails.
• Added quick "New Search" and "New Chat" shortcuts to the feed creation menu.
• Entity and node detail panels are more organized, showing triage info, related context, and provenance, with long lists (like threat intel) now capped with a "show more" option.
• Rerunning a query now reruns it in place and shows full run history instead of creating a duplicate query.
• Added the ability to edit and retry failed queries directly from Scout chat.
• Public threat-intelligence data (CVEs, CPEs, IOCs, and more) now refreshes automatically and covers more sources.
• Improved the Azure Log Analytics connector to match capabilities already available for Elasticsearch connections.
• Emails from Huntbase — notifications, invites, and account emails — now use consistent Huntbase branding.

Bug Fixes

• Fixed an issue where team invite links could fail for new members without an existing account.
• Fixed scheduled query results not always appearing in the activity feed, and a related crash affecting endpoint query runs.
• Fixed endpoint query runs that could get stuck showing as "running" indefinitely.
• Fixed saved query results occasionally getting stuck on a loading screen when revisited.
• Fixed Scout sometimes giving inaccurate answers about CVEs or techniques not yet in the graph, by requiring exact matches for known identifiers.
• Fixed Scout asking for parameters that were already provided, and removed stray formatting artifacts from its chat responses.
• Fixed a display issue where certain entities (e.g. CVEs) incorrectly showed as a generic "Public" type.
• Fixed the query bar's search dropdown not reopening after running a deeper search.
• Fixed an issue where a query's last-run time wasn't always saved correctly.
• Fixed an error that could prevent starting a hunt session for some organizations.
• Fixed occasional slow responses caused by database connections not being released promptly.
• Fixed platform admins being unable to create platform-owned query templates.

• Added a signed-script execution platform: register trusted scripts, deploy them to endpoints by environment, tag, or individual device, and review their run history and current state.
• Redesigned the fleet management interface with a refreshed look, bulk actions (multi-select archive/delete) across environments, tags, operators, and endpoints, and clearer, tabbed workflows for enrollment, configuration, and certificates.
• Added support for tagging and untagging endpoints directly, with tags now visible throughout fleet views.
• Added visibility into query results per endpoint, so you can see which specific endpoints completed or failed a query, not just aggregate totals.
• Added support for the latest endpoint agent release, expanding device compatibility.

Improvements

• Faster, more efficient fleet syncing for integrations — only changed or newly enrolled/removed endpoints need to be fetched on each check, instead of the full fleet every time.

Bug Fixes

• Fixed an issue that could unexpectedly sign users out of the console shortly after logging in.
• Fixed macOS enrollment failing to restart correctly for non-administrator users.
• Fixed a timing issue that could produce inaccurate query completion/error counts under concurrent load.
• Fixed query environment lookups, made version checks opt-in, and made signed-script content viewable after deployment.
• Strengthened protections around authentication, cross-environment data access, and enrollment endpoints to guard against abuse.

• The Explorer is now the single home for hunts, queries, chat, and entity graphs, with a unified Activity Feed as the index (list, card, and kanban views).
• Added first-run guided product tours to help new users get oriented across the app.
• Redesigned the Library with richer template cards, more filter options, and a fuller detail view; hunt playbooks now share the same browsing experience.
• Overhauled the query results table: per-column filters, a global search box, a more compact toolbar, and a time histogram.
• Added inline query editing directly in chat, query preview cards, and the hunt canvas.
• Added support for ES|QL, AQL (QRadar), and MySQL as native query languages, and separated real ES|QL execution from the older Lucene-style query option.
• Added a "Scout access" toggle so connection owners can control whether Scout can use a given connection.
• Added a proactive "test connection" check and smarter, auto-populated configuration fields when setting up connections; connections that don't require authentication are now supported.
• Endpoint Control queries can now target endpoints by tag, operating system, or hostname — individually or combined — with per-endpoint tag management from the fleet view, plus a per-host status breakdown for running queries.
• Added insight-driven hunting: incoming threat intelligence can automatically trigger investigations, and public threat-intel entities (CVEs, ATT&CK techniques, and more) are now unified with your own data in the security graph.
• Reworked hunt creation into an instant "new file"-style flow: hunts open immediately as an editable draft, can be discarded if unused, and can be imported or exported as YAML.
• The hunt canvas now supports full node editing — create, edit, run, and delete — from a detail side panel, and dragging a connector onto empty canvas creates a new, already-attached node.
• Hunts can now be linked to structured reference entities (ATT&CK techniques/tactics, CVEs, threat actors, malware), separate from entities observed in results.
• Explorer tabs now persist across page reloads, and recently closed tabs can be reopened.
• Added a page-size control to Activity Feed results, and the Queries tab now shows one row per query with expandable run history instead of one row per run.
• Added bulk-discard of draft hunts directly from the Activity Feed.

Improvements

• Query result rows are easier to read: internal system fields are hidden, nested data is flattened, and source-provided tags are now visually distinguished from your own tags.
• Query notifications now include the query's name.
• Connection error messages are clearer and safer, without exposing internal technical details.
• Detail panels for hunts, queries, runs, and graph entities now share a consistent layout.
• Simplified the entity graph by removing underused multi-select and path-finding tools.

Bug Fixes

• Fixed an issue where viewing an endpoint in the security graph didn't surface the query that had observed it.
• Fixed several cases where a query's status or an endpoint run appeared stuck "Running" or kept polling indefinitely after completion.
• Fixed chat responses not auto-scrolling into view while streaming.
• Fixed the Library page occasionally reloading unexpectedly during normal use.
• Fixed an error when viewing endpoint connection targeting details.
• Fixed endpoint enrollment secret retrieval failing in some environments.
• Fixed admin-invited users still being prompted to choose a subscription plan.
• Fixed several billing issues, including discount codes, free-plan signup, and plan updates.
• Fixed the time-range filter appearing on query types where it had no effect.
• Fixed a case where the app could get stuck after a new version was deployed, requiring a manual refresh.
• Fixed duplicate hunts occasionally being created when a request was slow to respond.
• Fixed the new-hunt tab losing focus during creation.
• Fixed entity graph navigation and display of list-valued attributes on related nodes.
• Strengthened access-control checks to prevent cross-organization data access and to keep platform administrators scoped to their intended resources.

• Added support for writing and running native SPL, KQL, and ES-DSL queries directly against Splunk, Microsoft Sentinel, and Elasticsearch connections, with full syntax highlighting for these plus Cypher and STIX in the query editor.
• Added a Re-run action for hunt workspace nodes, with an option to cascade the re-run through downstream steps, plus a Regenerate action that has Scout rewrite a query node's SQL.
• You can now drag to connect two existing nodes in the hunt workspace canvas.
• Redesigned the Explorer into a tabbed workspace for hunts, chats, and queries, and added support for deep-linking directly to a specific query and run.
• Redesigned the query creation dialog into a guided, step-by-step wizard.
• Huntbase now checks that a query's tables are compatible with your selected connections before running it, catching mismatches earlier.
• Query schedules can now be set to run once at a specific time, with an optional expiration.
• Added an in-app feedback button so you can send feedback from anywhere in Huntbase.
• Scout can now automatically analyze your query results as soon as they finish running, suggesting follow-up questions and letting you continue chatting about the data without re-running a query.
• Added an "Ask Scout" option when you type a natural-language question in the query bar, instead of it being treated as a literal query.
• Scout chat now queues follow-up questions submitted while a response is still in progress, instead of dropping or overlapping them.
• Added the ability to cancel a running endpoint query, with clearer indication of when a run will expire.
• You can now turn free-form notes into a structured insight with Scout's help, and track its review status (needs review, approved, dismissed).
• Redesigned connection creation into a guided, resumable step-by-step wizard.
• Added an Entity Explorer for visually investigating and pivoting across hosts, users, and other entities in the security graph, including historical time-travel and a live feed.
• Added a single unified input for asking Scout, running a query, or searching.
• Added support for inviting colleagues to Huntbase and accepting organization invitations, with terms-of-service acceptance during signup.
• Redesigned onboarding with a unified layout and clearer progress tracking.

Improvements

• Improved the query editor's first-run experience: clearer input styling, accurate run attribution, a working export button, a relabeled primary action, and a live progress indicator while a query runs.
• Cleaned up the Activity Feed to show only events (queries, insights, hunts) by default, with entities available in their own view.
• Fixed numerous Explorer navigation issues so breadcrumbs, tab links, chat history, and URL sharing behave consistently.
• Scout query recommendation cards now run reliably with a single click and display correct syntax highlighting.
• Improved template library search to match on full query content, not just titles.
• Connection owners can now rotate, extend, or expire their own endpoint enrollment and removal links.
• The connection detail page now shows and lets you edit connection-specific configuration fields.
• Chat history now shows whether a conversation relates to a hunt or a query, with badges and smart navigation to the right place.
• Added a button to expand query results to a full-tab view.
• Query history now shows the human-readable name of who ran each query.
• Added a warning when running a query across multiple organizations with incompatible connection types.
• Query editors now suggest datasets and tables based on the selected query language.
• Locked the query-language selector while a template is active, to prevent accidentally switching languages mid-edit.
• Scout's reasoning steps now display above its response in chat instead of below.

Bug Fixes

• Fixed queries with search terms containing quotes generating invalid SQL.
• Fixed some connections not appearing in list views due to a permissions sync issue.
• Fixed the query schedules tab appearing empty when navigating from certain links.
• Fixed the endpoint fleet page layout, an error loading agents, and unreadable install/remove commands.
• Fixed several reliability issues in running and correlating queries across connections.
• Fixed task and hypothesis nodes appearing without names on the hunt canvas.
• Fixed Scout-triggered queries occasionally failing silently without running.
• Fixed missing connections between queries, runs, and results in the security graph for some executions.
• Fixed the "Save as Template" action so it works consistently everywhere a query can be created or edited.
• Fixed running a saved template sometimes opening Scout chat instead of executing directly, and corrected labels distinguishing Scout-suggested, library, and custom queries.
• Fixed queries with an explicit query language (Endpoint Control, STIX, Cypher) sometimes being routed to the wrong query engine.
• Fixed a bug where creating a new organization could fail to complete.
• Fixed file paths and command lines in endpoint query results displaying with extra escape characters.
• Fixed duplicate rows occasionally appearing in the Activity Feed.
• Fixed Scout occasionally showing raw technical text instead of its clarification question in chat.
• Fixed Scout being unable to find connections for certain endpoint products when running queries.
• Fixed duplicate responses sometimes appearing when submitting a question from the launchpad.
• Fixed Scout occasionally getting stuck in a loop while searching for matching datasets.
• Fixed running or editing a saved query template sometimes showing an empty query body.
• Strengthened access-control checks so organization owners consistently have full permissions on their connections.
• Fixed progress indicators showing zero completed connections for non-endpoint queries.

• Added single sign-on support so users can log in through their organization's identity provider, with proper session handling on logout.
• Introduced a redesigned admin interface for managing your fleet, users, and permissions with a more modern, streamlined experience.
• Added fine-grained, per-environment permission controls — admins can add or remove users, reset passwords, and grant access across all environments at once.
• Queries and file collection requests now default to all active endpoints when no specific targets are chosen, and support bulk actions.

Improvements

• Simplified the login flow by removing unnecessary environment requirements.
• Improved the endpoint picker used when targeting queries and file collection, with combined hostname/UUID search, typeahead suggestions, and support for entering multiple endpoints at once.
• Streamlined the layout for creating new file-collection requests to match the query creation experience.
• Refined navigation and controls to better respect each user's role and permissions.
• Session tokens are now rotated on every login for stronger session security.
• Expanded compatibility with the latest endpoint agent version.

Bug Fixes

• Fixed an issue where logging out didn't fully clear session state in some cases.
• Fixed an issue where the audit log page could trigger unnecessary repeated loading.
• Fixed environment name validation so renaming an environment can no longer collide with an existing one.
• Fixed a race condition that could cause inaccurate query execution counters.
• Fixed an issue preventing macOS endpoint agents from reloading correctly during quick enrollment for non-root users.
• Fixed handling of oversized requests so they now return a proper error instead of failing unexpectedly.
• Closed several security gaps related to authentication, session handling, and cross-environment data access, and resolved a rate-limiting bypass and a user-enumeration timing issue.

• Connections can now be temporarily disabled without deleting them, pausing data collection while keeping the configuration intact.
• Hunt recommendations now indicate whether a hunt can run automatically or needs analyst judgment, along with the reasoning behind each suggestion.
• You can now create a tag directly from the right-click menu while tagging results, instead of switching to a separate tag manager.
• Added 24 new pre-built hunts covering credential-access and lateral-movement techniques, mapped to MITRE ATT&CK.
• Notifications now persist in a bell drawer with full context and follow-up actions, instead of disappearing after a few seconds.
• Findings reports now support structured columns (entity, IOC, technique, recommended action, owner, status) and can be exported to CSV for handoff to incident response.
• The hunt workspace now shows when Scout revises a hypothesis or proposes an alternative investigative path, along with supporting evidence.
• The Library has been split into separate Templates and Playbooks sections, with structured tag filtering, a framework filter, and a list/card view toggle.
• The entity feed and security graph now show accurate counts per entity type, and public entities (CVEs, MITRE techniques, CWEs, IOCs) are indexed more reliably.
• Running queries can now be cancelled in place, from both the query workspace and Scout chat.
• The insight panel now shows related hunts that were triggered from that insight.
• Hunts in the activity feed now display a severity level.
• Query steps in the hunt workspace now show full query details (content, source, connections, parameters) in the side panel, and clearly flag cases where Scout couldn't generate a query due to missing data.
• AI-generated summaries now appear on insights.
• Added a Kanban board view for hunts with drag-and-drop status changes, alongside the existing list view.

Improvements

• The chat query action is now labeled "Ask Scout" for clarity, with fixes to related response handling.
• Hunts started automatically now open immediately instead of waiting on background processing.
• Improved reliability of endpoint query connections.
• Numerous polish fixes across the query workspace and results view, including clearer run-status wording and better connection-loading behavior.
• Numerous polish fixes across the Library's browsing and detail views.
• Removed a non-functional file-attachment button from chat to avoid confusion.

Bug Fixes

• Fixed row tagging failing for certain data sources due to unstable row identifiers.
• Fixed right-click tagging sometimes acting on the wrong row when a different row was already selected.
• Fixed query results with nested data (e.g., profile fields, endpoint metadata) displaying as raw object text instead of readable values.
• Fixed endpoint queries not reaching any endpoints when no specific fleet or host was selected.
• Fixed a crash in the hunt timeline when an unrecognized activity type was returned.
• Fixed confirmation dialogs appearing behind their parent dialog.
• Fixed the Clear button in the activity feed's bulk-selection toolbar not actually clearing the selection.
• Fixed Scout's reasoning trace not appearing when navigating directly to a hunt.
• Fixed the Library and template detail pages becoming unscrollable, cutting off content.
• Fixed the Summarize button re-enabling before the AI summary had actually finished generating, which could trigger duplicate requests.
• Fixed deleted organizations and inactive connections occasionally still appearing in lists.
• Fixed public entities (CVEs, MITRE techniques, etc.) sometimes being excluded from the feed and recommendations.
• Fixed entity catalog record counts and version numbers displaying as blank in the admin view.
• Fixed the Use Template action not working for templates beyond the first page of results.
• Strengthened access-control checks around organization and connection management.

• Added the Hunt Flow Graph — an interactive diagram showing every step of a hunt — along with hunt-scoped chat history and a consistent history drawer.
• The activity feed now generates AI summaries for entities and insights, and loads noticeably faster.
• Introduced the Hunt Template Platform: build reusable playbooks in the Library and run them as templated hunts with branching logic.
• Revamped the query search experience with live streaming results, field-distribution insights, a dataset picker, and quick access to recent templates.
• Added Connection Statistics, letting you view usage stats, run history, related hunts, and event timelines for each connection.
• Query notifications now link directly to the relevant run, and runs triggered together are grouped in the activity feed so they're easier to follow.
• Unified Scout and automated hunts into a single AI investigation experience, with a new way to trigger a Scout investigation directly and more reliable query generation.
• Platform admins can now create simulated connections for testing and demos without connecting real data sources.

Improvements

• Query details pages load faster with lazy-loaded tabs, and the launchpad now defaults to Scout mode.
• The Library now defaults to card view, supports multi-select filtering by product, and shows clearer breadcrumbs.
• Cleaned up icon and category-label styling across connections and the rest of the app for a more consistent look.
• Chat result cards now appear after the response finishes streaming, instead of popping in mid-message.

Bug Fixes

• Fixed Endpoint Control queries not respecting the selected host/fleet targeting, which could cause them to run against all endpoints instead.
• Fixed several activity feed issues, including a panel freeze when viewing insight details, incorrect counts, missing owner/source information, and broken links.
• Fixed broken links and repeated error loops that could occur after clicking a query from the activity feed or opening a missing result page.
• Fixed the Replay button on the hunt flow canvas not working, and stopped the replay panel from covering canvas controls.
• Fixed row and cell tagging not working on the query details Results tab.
• Fixed tooltips appearing behind dialogs, duplicate "New query" buttons, and scroll issues in scope selectors.
• Fixed a bug that could cause repeated redirects to the sign-in page right after logging in.
• Fixed an issue where personal queries and connections could be missing from lists when viewing combined personal and organization scopes.
• Fixed errors that could occur when loading entities or searching tags.
• Fixed hunt node cards crashing when an automated hunt returned an unexpected status type.
• Removed a non-functional organization notifications setting and fixed an incorrect breadcrumb on the hunt detail page.

• Endpoint configurations can now be rolled out gradually to a percentage of your fleet before promoting to all endpoints, making it safer to test changes before a full rollout.
• Added single sign-on (SSO) support for the Endpoint Control admin console, including secure PKCE-based login flows.
• Endpoint configurations can now be received from external configuration management workflows, making it easier to keep fleet configs in sync with your existing processes.

Improvements

• Improved performance for live queries and file collection targeting large groups of tagged endpoints, reducing load and speeding up response times at scale.
• Simplified the sign-out experience for SSO users.
• Clearer messaging in the admin interface when editing is disabled for a configuration.

Bug Fixes

• Fixed an issue that incorrectly required a client secret when PKCE-based sign-in was enabled.
• Fixed audit log entries so sign-in events correctly record the originating IP address.
• Hardened file upload handling to prevent issues from oversized compressed files.

• Added billing and subscription management, with multiple plan tiers, self-serve checkout, and support for managed service provider (MSSP) accounts.
• Hunt sessions now support action nodes: browse the artifact library, configure and preview an action, then run it — with built-in approval controls for sensitive steps. Also introduced a unified template library covering query, collection, and action templates.
• Added a unified Activity Feed that brings hunts, queries, insights, entities, and actions together in a single, filterable view.
• Introduced auto-hunt: high-confidence threat intel insights can now automatically kick off an investigation, with Scout planning and running the needed queries.
• Added AI-powered Summarize and Discover actions to entity and insight detail panels.
• Scout now has full visibility into the queries run and their results within a hunt session, giving more relevant answers when chatting.
• Any authenticated user can now create an organization, without needing platform admin approval.

Improvements

• Streamlined account onboarding: plan selection now happens before organization setup, added a "who is this for" step, and clarified terminology throughout.
• Improved mobile responsiveness of account and organization settings pages.
• Redesigned sidebar navigation so opening one panel automatically collapses the others, for a cleaner workspace.
• Cleaned up terminology and UI consistency across the app, including renaming "Detections" to "Findings/Insights" and "Hunt Template" to "Hunt," and standardizing "New" action buttons across list views.
• "View in Explorer" links now open full-page detail views for entities and insights instead of failing to load.
• Applied security patches addressing several third-party library vulnerabilities.

Bug Fixes

• Fixed the billing plans page showing only yearly options instead of all available plans, and fixed an error that could occur when creating an organization during onboarding.
• Fixed severity badges appearing blank for certain values and removed a non-functional Quick Hunt button.
• Fixed the connections list not refreshing after adding a new connection, along with missing breadcrumbs and hunt filter issues.
• Fixed entity detail panels showing raw IDs instead of names, and hunt session cards missing avatar initials.
• Fixed the query dialog's language selector resetting unexpectedly and the endpoint targeting panel failing to appear for custom queries.
• Fixed entity-related query lookups, source labels, Scout mode selection, and the new node button in the hunt workspace.
• Fixed entities not appearing after being added, and entity detail pages showing missing or incomplete information.
• Fixed duplicate entities being created during data ingestion.
• Fixed certain queries failing to run due to a plugin configuration issue.
• Fixed an issue where confirmation messages could be missing after an AI action completed.

• Scout can now run autonomous hunt investigations end-to-end — generating hypotheses, checking progress and re-planning as needed, and writing up findings in a report.
• Added support for scheduled hunt runs with an approval step, plus a framework for executing multi-step hunt actions.
• You can now manually create and edit entity cards and insights directly in the security graph.

Improvements

• Nodes in the security graph are now bigger and easier to see, with related entities clustering more tightly together for a clearer view.

• The Endpoint Control server now checks for new releases and notifies administrators when an upgrade is available.
• Added support for the latest endpoint agent version.

Bug Fixes

• Fixed an issue where removing an environment from the fleet view did not take effect.
• Fixed an issue where updates to a rollout's configuration were not being applied.

• Added a tagging system for organizing hunts, queries, and other resources — create personal, organization, or platform-wide tags and vocabularies, quickly assign free-form tags without setup, and find things faster with a new tag picker.
• Added an interactive graph view within the hunt workspace that visualizes a session's queries, extracted entities, and how they relate to one another.
• Scout now streams its answers and reasoning in real time as it works, powered by a more capable agent that dynamically chooses the right tools for each question.
• Scout can now analyze previously run query results directly — summarizing, aggregating, and answering follow-up analytical questions about your data without needing to re-run a query.
• You can now manage endpoint monitoring agents — deploy, remove, and view fleet status — directly from a connection's detail page.
• The Entities view now shows accurate total counts and a name column, and supports server-side sorting and filtering.

Improvements

• Notification emails for queries, exports, and agent runs now use a cleaner, easier-to-read HTML format instead of plain text.
• Query failure notifications now appear in-app by default instead of being sent by email.
• Error messages in the Entities and Insights views are now clearer and no longer expose technical details.

Bug Fixes

• Fixed an issue where scheduled hunt runs sometimes didn't show up in the Runs list, and where personal schedules could fail to be created.
• Fixed a bug that could cause the Runs list to appear empty.
• Fixed pagination and sorting issues in the Entities list so browsing large entity sets works correctly.
• Fixed an issue causing entity search reindexing to silently fail, ensuring entities stay searchable and up to date.
• Fixed an issue where opening certain query details incorrectly showed a "not found" error.
• Fixed bugs affecting product query template imports and connection setup validation.
• Fixed a server error that could occur when submitting invalid connection configuration; you'll now see a clear validation message instead.

• Hunt Sessions: a new dedicated workspace for organizing and tracking full threat hunt investigations, including an Inbox for triaging incoming alerts and promoting them into hunts.
• Explorer v2 and an interactive graph explorer for visually navigating entities and their relationships in your security graph.
• A new notification center with real-time in-app alerts, email delivery, and customizable preferences per channel.
• Federated entity search across your own data and public threat-intelligence sources (CVE, ATT&CK, MITRE ATLAS, and more), along with a redesigned command palette for faster navigation.
• Scout now shows its reasoning step-by-step while investigating, automatically names hunt sessions, extracts structured entities from query results, and lets you leave feedback on its runs.
• Added asynchronous export for large result sets, with a dedicated download page and a notification when your export is ready.

Improvements

• Added rate limiting to help keep the platform stable and responsive during high-traffic periods.
• Watchers: the query schedules tab now shows live, accurate schedule status pulled directly from the backend.
• Improved entity browsing with clearer loading states and more reliable search results.

Bug Fixes

• Fixed an issue causing Scout requests to fail due to a cross-origin error.
• Fixed navigation and performance issues in Scout sessions, including incorrect breadcrumbs and an infinite loading loop.
• Fixed connections and library pages getting stuck in a loading state.
• Fixed chat and hunt session issues affecting message display, scrolling, header layout, and transitions between workflow steps.
• Fixed an issue where querying a table without a connected integration returned a generic error instead of a clear message.
• Fixed an issue where queries could incorrectly fail with an access error for connections the user legitimately owned.
• Strengthened access-control checks so connection details are only visible within the correct organization scope.

• Added a new Insights view for reviewing detection findings (e.g. from EDR tools) with severity filtering and a detail panel linking to related entities and MITRE ATT&CK mappings.
• Scout can now proactively review and triage incoming security alerts as part of an investigation workflow.
• Added CSV and JSON export for query results, including large result sets.
• Introduced a new Workbench experience with a redesigned layout, chat, and workflow interface.
• Added a queries sidebar in the hunt workspace that groups your queries by status (running, completed, failed).
• Endpoint Control queries now report per-node progress and errors, and support streaming CSV/JSON export for large runs.
• Added filters (by product, type, and tag) to the query Library, and category grouping for connections.
• Organization owners can now delete their organization from settings, with a confirmation step.
• Added self-serve subscription management — view your plan, update it, or cancel directly from settings.
• Added parameter autocomplete and auto-closing brackets when writing query parameters in the query editor.
• Added a bot-protection check to sensitive forms to help block automated abuse.

Improvements

• Query runs are now more resilient — transient connection issues are automatically retried, and failures show clearer error messages.
• Refreshed the admin panel with global lists, multi-select, and bulk actions across products and extensions.
• Settings now displays legal/policy links and current version information.
• The app now shows a friendly error screen instead of a blank page if something goes wrong unexpectedly.
• Replaced silent failures with clear error notifications when an action doesn't succeed.
• Clearer warnings and error messages when you don't have permission to access an organization-owned connection.
• Query Library templates can now be filtered by multiple values at once.
• Query details now show the source template name (with a link) and whether the query has been modified from the original.
• Connection and product pages now use readable URLs instead of long ID strings.
• Streamlined the Scout workspace to a single, simplified workflow.

Bug Fixes

• Fixed incorrect product, connection, and organization counts shown in query results.
• Fixed inaccurate result counts and run status for Endpoint Control queries.
• Fixed the running animation getting stuck after a query run failed.
• Fixed an issue that could expose internal error details in some API responses.
• Strengthened access controls to prevent unauthorized changes to shared query schemas and mappings.
• Strengthened access-control checks on account and organization settings to prevent unauthorized privilege changes.
• Fixed an issue where Scout's parallel investigation tasks could interfere with one another.
• Fixed the run detail view showing placeholder data instead of real query results.

• Service accounts can now be granted fine-grained permissions (read, query, carve, admin) on a per-environment basis, giving teams tighter control over automated access.
• Global admin accounts can now sign in to the API directly, without first needing to select an environment.
• Added a new admin interface for managing configuration rollouts across the fleet.

Improvements

• Added support for the latest endpoint agent version.
• Improved the performance of live query targeting through faster tag lookups.

Bug Fixes

• Fixed an issue where fleet and platform data could be filtered incorrectly across environments, ensuring views and queries only return data for the correct environment.
• Fixed an issue where editing an environment could incorrectly filter hostnames.
• Hardened input handling when creating new environments and viewing on-demand query results to prevent malformed or unsafe input.

• Added admin tools for setting up Endpoint Control environments and assigning them to organizations and users.
• Endpoint queries now show a live list of platforms pulled from your connected agents, instead of a fixed list.
• Added a graph view for exploring how entities are connected, with configurable depth and result limits.
• Query templates can now include entity-extraction configuration, editable directly from the template UI.
• Added a tabbed queries view (Queries, Schedules, Runs) with inline run, delete, and schedule controls.
• Added the ability to test webhooks, rotate webhook secrets, and view webhook delivery statistics.

Improvements

• Standardized query parameters to a single {{param}} syntax across the editor for clarity.
• Improved inline editing (including multi-line fields) and pagination in organization tables.
• Added support for setting an organization's domain in account settings.
• Streamlined template creation: support for multiple owners, DSL selection, and clearer success confirmation.
• Improved loading indicators throughout the app.
• Improved the entity detail view with better-formatted attributes, timestamps, and copy actions.
• Query results tables now scroll within the page, show connection ownership, group results by query, and no longer display misleading statistics.
• Connection setup now supports credential configuration during YAML import, and fixed default values not registering correctly in connection forms.
• Refreshed the app's visual theme and color palette.
• Improved error messages when Endpoint Control connection settings are missing or invalid.
• Simplified the launchpad by removing unused quick-action shortcuts.
• Removed an in-app survey prompt.

Bug Fixes

• Fixed an issue that could intermittently cause queries using stored credentials to fail.
• Fixed an issue preventing endpoint query templates from running correctly.
• Fixed an issue where users without any connections were shown query options they couldn't actually use.
• Fixed incorrect organization counts shown in query results.
• Fixed a permissions issue that could prevent users from viewing webhooks for connections they own.
• Fixed inaccurate search results and an error in the admin organization list.
• Applied security updates to underlying libraries to address potential vulnerabilities.

• Added support for endpoint queries via Endpoint Control connections, including endpoint statistics (total, online, and inactive counts) on connection details.
• Query results now display extracted entities, such as hosts, users, and IPs, in a dedicated column.
• Queries can now be run directly through Scout, with session tracking to group related queries together and review execution history.

Improvements

• Product detail pages now show descriptions and website links, with expandable text for longer descriptions and refined admin dialogs and forms.
• Query templates now support multiple questions instead of a single question.
• Refreshed the visual design with an updated color palette across light and dark modes.
• Queries now display the specific connections they ran against, and access to templates and queries is limited to the connections each user is permitted to use.
• Improved the accuracy of platform detection when searching for query templates.

Bug Fixes

• Fixed delays and inconsistencies in endpoint query result processing, including missing or miscounted results.
• Fixed an issue that could prevent new organizations from completing setup.
• Applied security updates to strengthen platform dependencies against known vulnerabilities.

• Added per-environment configuration for log and file-upload handling, so admins can now customize these settings independently for each environment from the admin UI.
• Added support for delivering endpoint query results to an additional log destination.

Improvements

• Improved filtering of status logs to reduce noise in endpoint result streams.

Bug Fixes

• Fixed an issue that could allow an expired authentication token to be reused.
• Fixed an issue that could cause errors when processing certain log data from endpoints.

• Added support for normalized, cross-product query surfaces — write one parameterized query that automatically adapts across your connected products (e.g., AWS, GCP, Azure, GitHub, Shodan, certificate data), showing only the parameters relevant to your active connections.
• Endpoint Control queries are now available as their own query type in the query editor, alongside existing query languages.
• Library views now display extracted entities for each query result, along with the query owner's name.
• Added support for connecting products using multiple authentication methods, giving more flexibility when setting up connections.

Improvements

• Redesigned the navigation menu for a cleaner layout and easier access to sections of the app.
• Query creation now correctly limits execution to the connections you actually select, and remembers your manual selections when connection data refreshes.
• Query validation now shows clear, actionable error messages and suggestions, and blocks running a query until issues are resolved.
• Deleting a saved credential now shows a clearer confirmation dialog before removing it.

Bug Fixes

• Fixed an issue where looking up query surfaces by name could incorrectly return a "not found" error.
• Fixed a bug where GitHub-based queries could fail due to credentials not loading correctly.
• Fixed query submission issues affecting navigation to results and parameter handling.

• Scout can now automatically extract entities from query results, enriching entity cards and the security graph with more context.

Bug Fixes

• Fixed reliability issues with endpoint queries, including a problem that prevented some personal queries from running and issues with how results were reported back.