Organization management
An organization is a shared space for a team: its connections, hunts, insights, playbooks, tags, and watchers are visible to its members and kept separate from your personal work and from other organizations. You can belong to several organizations, and each has its own owners, admins, and members.
![Settings › [Organization] › Overview showing Organization settings, Quick actions, and Danger zone](/assets/images/settings-org-overview-efbc40997053ecdf225d0f2a6334ef8b.png)
Create an organization
- Open Settings (navigation menu › User Profile).
- In the sidebar, open the Organization dropdown and choose Create Organization.
- Enter an Organization Name (letters, numbers, spaces, and underscores). Optionally set an Organization Domain such as
acme.com— it is pre-filled from your email address. - Click Create Organization.
You become the organization's owner and are taken to its settings. Names are unique across Huntbase; if yours is taken you are asked to pick another. Domain-based joining is configured afterwards from Membership Settings (below).
You are also offered Create your organization during first-time onboarding, where only the name is needed.
Overview
Settings › [Organization] › Overview shows the organization's settings. What you can change depends on your role:
- Organization Name — owners edit it inline; admins and members see it read-only.
- Quick actions (owners and admins) — Membership Settings and Security Settings, described below.
- Danger zone (owners only) — Delete organization.
Membership Settings
Controls how people join and who can be invited. The dialog shows the organization's email domain and two checkboxes:
| Setting | Effect |
|---|---|
| Any user with a @domain email address can join | People with a matching email domain can join automatically. |
| Users without a @domain email address cannot be invited | Restricts invitations to matching email domains. |
Click Save changes to apply.
Security Settings
- Everyone in this organization must enable 2FA — requires two-factor authentication for all members.
- Require 2FA by date (optional) — appears when the requirement is on; sets a deadline by which members must have 2FA enabled.
Click Save changes to apply. Members enable 2FA from Personal settings.
Delete organization
Owners can delete the organization from the Danger zone. The Delete organization dialog explains that all members, settings, and associated data are removed, and asks you to type the organization's name to confirm. This cannot be undone.
Members
Settings › [Organization] › Members lists everyone in the organization.
Invite someone
Owners and admins see Invite Member. In the Invite User dialog enter the Email address, choose a Role, and send. The invitee receives an email and appears under Pending Invites until they accept.
Member table
| Column | Notes |
|---|---|
| Your own row is marked. | |
| Status | Active or Inactive. |
| Role | Owners and admins can change a member's role from the select in this column (only roles they are allowed to assign are offered). |
| Action | Remove removes another member; on your own row it reads Leave. Both ask for confirmation. |
Use the search box to filter by email; the table is paginated.
Pending and expired invites
Owners and admins also see two more tabs:
- Pending Invites — email, role, and when each invite Expires, with a Revoke action per row.
- Expired Invites — email, role, and when each invite Expired, for reference.
Roles
| Role | In Huntbase |
|---|---|
| Owner | Everything an admin can do, plus rename and delete the organization. |
| Admin | Invite, change roles, and remove members; manage membership and security settings; access Billing, Usage, Tags, Watchers, and Audit Log; manage Storage destinations. |
| Member | Work inside the organization's scope and see Overview and Members read-only. |
There is no dedicated transfer-ownership control; roles are changed from the Role select in the member table.
Tags
Settings › [Organization] › Tags (owners and admins) manages Organization Tags — shared tag folders visible to every member. Create folders with New folder, add and color tags inside them, and delete folders you no longer need. Changes affect everyone in the organization. Personal tag folders live under Personal settings.
Access-bearing tag folders
This feature is currently rolling out and may not be enabled for your organization.
Tags in an Access-bearing folder can carry endpoint access: someone granted a role on one of them can reach every endpoint that carries it, including endpoints tagged later. Access itself is granted under Endpoints → Access — see Access and activity. Only organization folders can be access-bearing, and only organization admins can change the setting; everyone else just sees the Access-bearing badge on the folder.
- Turn it on: click Make access-bearing on the folder and confirm. From then on, only people who can manage endpoint access can assign that folder's tags to endpoints — because assigning one gives people access. Nothing changes until access is granted on a tag.
- Turn it off: click Access-bearing on the folder. The confirmation warns: "Every endpoint-access grant on this folder's tags will be deleted, on every fleet. People who reach endpoints only through those tags lose that access straight away." Click Delete grants and turn off to go ahead. The tags and what they are attached to stay as they are, but turning the setting back on later does not bring the grants back.
Storage destinations
This feature is currently rolling out and may not be enabled for your organization.
Settings › [Organization] › Storage destinations is where files collected from endpoints are stored: an S3 or S3-compatible bucket you own. Files are never kept by Huntbase. File collections use the Default destination, and until one destination is the default and has an access key, collecting files is blocked.
Organization admins manage destinations. Other members see the list as View only, so they can tell whether one exists.
Add a destination
- Click Add destination.
- Fill in the form:
| Field | What to enter |
|---|---|
| Name | A label for the destination, such as "Evidence bucket". |
| Bucket | The bucket name. |
| Folder (optional) | A folder inside the bucket to store files under. |
| Region | The bucket's region. |
| Custom endpoint URL (optional) | Leave empty for AWS S3. Set it for S3-compatible services such as MinIO, Cloudflare R2 or Backblaze B2. |
| Path-style addressing | Address the bucket as /bucket/key. Required by MinIO. |
| Access key ID and Secret access key | Use a key that can only write to, read from and delete in this bucket. |
- Click Add destination, then Test connection. The result reads Connection works or Connection failed with the reason.
The secret access key is write-only: it is stored securely and never shown again. The list only says Access key set or No access key.
Change a destination
Open the destination's more-actions menu:
| Action | What it does |
|---|---|
| Edit | Change the name, bucket and other settings. The access key isn't shown or changed here. |
| Replace access key | Enter a new key. It replaces the current one immediately. |
| Make default | Use this destination for file collections. There is one default. |
| Delete | Removes the destination and its stored access key. Files already in the bucket are not deleted, but Huntbase can no longer create download links for them. Deleting the default blocks file collections until another destination is made the default. |
Watchers
Settings › [Organization] › Watchers (owners and admins) turns watchers on for this specific organization and tunes how they act. The Watchers page does the same across every organization you can see, and is where you write your own.
Audit Log
Settings › [Organization] › Audit Log (owners and admins) shows activity and changes made to the organization.
| Control | Purpose |
|---|---|
| Search audit logs… | Free-text search across entries |
| Event type | All Events or a specific event type |
| User | All Users or a specific actor |
The table columns are Event, Description, Performed By, and Date, with paging at the bottom.
Scope and data isolation
The header Target selector decides which organizations' data you are working in. Selecting an organization shows its connections, hunts, insights, playbooks, and tags; selecting Personal shows only your own; All Contexts shows everything you can access. Data belongs to the scope it was created in and is not visible to other organizations. See Settings overview for how the selector works.
Billing and usage
Owners and admins also see Billing and Usage for the organization while those features are rolling out. See Billing & plans.
Next steps
- Watchers — enable and tune watchers for the organization
- Billing & plans — organization subscriptions
- Connections — add data sources to the organization's scope
- Settings overview — sidebar and Target selector