Skip to main content

Changelog — August 17 – 30, 2026

New Features​

  • Data lake (beta). Query telemetry that lives in a data lake, two ways: point Huntbase at an Apache Iceberg store you already own, or ship logs straight to Huntbase from Fluent Bit, Vector, rsyslog or syslog-ng. A lake store shows its provisioning progress step by step and says clearly whether it is in federation — that is, whether lake queries actually read it. See Data lake.

  • KQL (Huntbase Lake) is a new query language in Explorer. It needs no connection: one query searches every lake store available to you at once. See Query languages.

  • Telemetry ingest keys, minted per shipper with ready-to-paste configuration for four log shippers and a reachability check you can run before involving any secret.

  • Results say what the run actually searched. A lake run reports how many stores it read, which of them were excluded — a warning, because excluded stores make your results incomplete — and any row cap that was applied. Rows carry the store they came from, and you can narrow to one store from a row.

  • Watchers is now a top-level page (previously under Settings), rebuilt for a catalog of thousands: search across names, descriptions, ATT&CK techniques and rule text; filters that show how many watchers are in each bucket; grouping by state, severity, plane or tactic; and a virtualized list. See Watchers.

  • Watchers run Off, in Shadow, or On. Shadow evaluates a watcher and records it to the digest without opening a hunt or notifying anyone — the safe way to find out whether a rule is noisy. New watchers are created in Shadow, and turning one on is a separate, deliberate click.

  • Per-organization watcher enablement is now visible. A watcher's state, severity floor, action and hunt mode belong to one organization; the page has an organization picker, and each watcher has a Deployment tab showing its state in every organization you can see.

  • Write your own watchers as Sigma rules. The editor compiles as you type, shows which data surface the rule binds to and which fields that surface actually provides, and can backtest a draft over your own history before it is saved.

  • Watcher history. Every edit to a watcher is kept as a version with a note, and the History tab diffs any version against the rule running now. An earlier rule can be restored — saved as a new version rather than a rewind — and firings are labelled with the version that fired.

  • Set every organization at once from a watcher's Deployment tab, with each organization answering for itself: one refusal doesn't silently take the others down with it, and an organization that can't run the watcher says why.

  • Watcher activity: fired, suppressed, entities touched and hunts opened over 7, 14 or 30 days, with daily bars and the recent firings.

  • Connections is built around what you have. The page now opens on a list of your own connections — with health you can sort by, a filter for the ones that need attention, and your ingest keys underneath — instead of a catalog of 158 products with your connections hidden behind per-product counters. Adding a source is its own tab, which opens with the three ways in.

  • The Connections page says which way the data moves. Products are split into query sources (Huntbase holds a credential and calls the vendor when a query runs) and data destinations (a store Huntbase reads directly, which is the side that accepts a log shipper), with a filter for each and a badge on the card.

  • Send telemetry to Huntbase without a store of your own. A card on the Connections page — and in onboarding — mints an ingest key, shows the endpoint, generates the shipper config, and says whether anything has actually arrived on the keys you have. Previously this path existed but was only reachable from an Iceberg store's connection page.

  • Crowded entity graphs fold up. More than ten neighbours of the same type on one node now draw as a single collection node badged with the count — click it to open the crowd, or turn grouping off from the toolbar. The results table still lists everything, and the legend counts members rather than shapes.

Improvements​

  • One hunt workspace. An empty hunt opens with three doors — have Scout plan it, ask a question, or add from the Library — with the Scout mode selector beside them. Clicking a step opens one side panel with Overview, Results and Activity tabs instead of taking over the canvas, and a step's query is edited with the same editor as the query workspace, with Run (save then run) and Save without running. Scout stays reachable from the canvas toolbar, the hypothesis offers Suggest / Regenerate, and plain English typed into a hunt offers Ask Scout rather than becoming a broken step.
  • Library while hunting. A query template's details panel offers Add to hunt while a hunt is active, and the hunt's own template registry is reachable from its ⋯ menu, canvas and empty state. The platform filter is a compact picker.
  • Panels remember themselves. Whether a query tab's details panel is open is remembered per tab rather than carried in the address, and the dock and canvas toggles persist between sessions.
  • Creating a connection is now a page, not a modal. Four steps — Product, Details, Connect, Verify — with a rail that tells you which credential to fetch from the vendor before you start. The connection is checked as soon as it is created, and a failed check can be fixed, retried or discarded without leaving the page. Your progress lives in the page's address, so you can come back to it or hand the link to whoever holds the credential. Onboarding now uses the same components.
  • Onboarding asks the real question. The connect step now offers both ways in as equals — connect a source, or send us telemetry — and either one completes it.
  • Watcher readiness is stated, not implied. Each watcher says whether it is Armed, Needs data (with the specific missing source), or whether the readiness check itself could not answer — three different things that used to look the same.
  • Backtest counts are honest. Where a rule uses a construct the historical query can only approximate, the count is shown with a ≥ and labelled a floor. Watchers with no retrospective form say why instead of showing a button that does nothing.
  • Suppression counts distinguish "nothing measured this" from zero.

Bug Fixes​

  • Fixed a query result set with no connection being reported as a failed connection, which made a successful lake run look like a failure.
  • The Activity Feed's Queries tab now labels lake and entity-graph queries Data Lake instead of flagging them as having no connections.
  • A hunt query step's Applicable connections list now matches the step's product, not just its query language — a CrowdStrike step no longer lists every steampipe connection in the organization.
  • Column layouts in a hunt step's results table are now remembered per step; resizing columns on one step no longer changes another step's table.
  • Fixed a page-header update loop on the watchers page that could prevent navigating away from it.