Key concepts & glossary

This page defines the terms used throughout the Huntbase docs and shows how work flows through the product. Skim it once; come back when a word in the app is unfamiliar.

Surfaces

Explorer and tabs

Explorer is Huntbase's home. On the left is the dock — a rail of views: Workspace (a tree of your hunts, stores and schedules), Chats, Queries, Library and Scout. Beside it is a tabbed workspace: the pinned Home tab holds the launcher and the What now worklist, and every piece of work you open becomes a tab. Tabs come in five kinds — query, chat, hunt, hunt node, and hunt report — and stay open until you close them, so a running query keeps streaming while you read a chat. Most tabs have a URL, so you can share or bookmark them. See Explorer overview.

Scout

Scout is Huntbase's AI assistant. You talk to it in plain language; it plans, writes and runs queries, extracts entities and insights, summarises results, and proposes next steps. How much it does on its own is up to you (see Initiative below). See Chatting with Scout.

Activity Feed

The Activity Feed is the team's shared record of hunts, insights, entities, and queries. Filter by kind, time range, and type; open any row in a side panel; and act on it (start a hunt, review an insight, rerun a query). See Activity Feed.

Pulse

Pulse is the outcomes dashboard: how many hunts ran, how many confirmed a threat, how much was automated, and how your hunting practice is maturing over time. See Pulse.

Library

The Library holds reusable content: hunt playbooks and query templates. See Hunt playbooks and Query templates.

Conversations and hunts

Term	Meaning
Chat session	One conversation with Scout, opened as a chat tab in Explorer. It keeps its own history, queries, and stash. Chats are lightweight: ask, get an answer, move on.
Hunt	A structured investigation (a hunt session). In Explorer it is a folder — Notebook, Results, Flow, Entities, a Report and its chats — with a title, a hypothesis, a scope, and a verdict. Hunts are the unit that Pulse counts.
Notebook	A hunt's primary view: its steps as an ordered list of cells, each showing what it found. Cells can be inserted, moved, archived or deleted, and are grouped under section headings; notes sit between them.
Cell / hunt node	One step in a hunt: a query, a task, an action, a checkpoint, a detection. The same step is a cell in the notebook and a node in the flow. Nodes branch, so the Flow view draws a graph.
Checkpoint	A point where Scout stops and waits for your decision before continuing (Approve & run, Refine, or Abort).
Verdict	The hunt's conclusion — Confirmed, Nothing found, Inconclusive or False positive — recorded in the notebook's verdict cell. Verdicts are a log: Scout adds drafts as the hunt progresses, you record the real one, and recording does not close the hunt.
Hunt report	The written outcome of a hunt: verdict, findings, evidence, and next actions. Opens as its own tab.
Hunt playbook	A reusable hunt definition in the Library. Launching a playbook creates a new hunt pre-populated with its steps.
Initiative	How proactive Scout is in a chat: Ask first, Balanced, or Proactive. In a hunt the equivalent setting is the mode: Guide, Collaborator, or Operator.

Queries and results

Term	Meaning
Query	The logic for a search, written in one of the supported languages: Auto (natural language), SQLite, osquery, Cypher, SPL, KQL, ES|QL, ES DSL, or STIX 2.1. See Query languages.
Run	One execution of a query against one or more connections at a point in time. Runs have a status (queued, running, done, failed, or cancelled), a row count, and timing.
Result set	The rows a run returned. You browse them in a query tab and can export them.
Query template	A saved, optionally parameterised query in the Library that anyone in scope can run in Explorer or schedule.
Schedule	A recurring run of a query template. Schedules live on the template's Schedules tab. See Schedules.
Query stash	The list of queries Scout has written or run in a chat, kept in a side panel so you can rerun or open any of them.

Entities and insights

Term	Meaning
Entity	A thing you can pivot on: a host, user, IP address, domain, file hash, CVE, technique, and so on. Entities are extracted from results and linked to the run and query that found them (their provenance). Each entity has a detail panel with Information and Relationships tabs.
Insight	A finding worth attention: a detection, an anomaly, or a conclusion Scout or an analyst recorded. Insights carry a severity, a source, and links to entities and hunts.
Review state	Where an insight is in triage: Needs review → Approved → Hunt started, or Dismissed at any point before a hunt starts.
Watcher	A standing rule that watches your events, your entity graph, or a window over earlier signals — and starts a hunt, raises a finding, adds to a digest or tags the graph when it matches. Runs Off, in Shadow (evaluated but silent) or On. See Watchers.

Connections and scope

Term	Meaning
Product	Something Huntbase can integrate with: a SIEM, an EDR, a cloud provider, an identity provider, a threat intelligence source. The catalog under Connections lists them.
Connection	A configured instance of a product with its own credentials and settings. You can have several connections to the same product. Queries run against connections. See Connections.
Data lake	Telemetry queried from an Iceberg store you own, or shipped to Huntbase directly, rather than reached through a connection. See Data lake.
Endpoint Control	Huntbase's osquery fleet management. Install on your hosts, then query them like any other connection. Each Endpoint Control connection is one fleet. See Endpoint Control.
Endpoints	The workspace for the hosts in your fleets: health, details and logs, file collection, access and the audit trail (beta). See Endpoints overview.
Scope	Whose data you are working in. You work in one or more organizations, and usually also have a private Personal scope — an organization can turn personal scope off for its members. Connections, queries, chats, hunts, and insights all belong to a scope.
Target selector	The control in the page header where you pick one or more scopes, or All Contexts. Everything on screen — feed rows, connections, Scout's answers — is filtered to the selected scopes. If you narrow the scope after a tab loaded, the tab is marked so you know its contents may be out of date.

The query lifecycle

Ask or write  →  Run  →  Results  →  Entities / Insights  →  Save or schedule

1. Ask or write — Ask Scout in plain language, write a query in the Query launcher, or run a template from the Library.
2. Run — The query executes against the selected connections. Scout may show a confirm-execution card first, depending on your initiative level.
3. Results — Rows stream into a query tab where you can pivot, filter, and export.
4. Entities / Insights — Extracted objects and findings appear in the side panel, in chat cards, and in the Activity Feed.
5. Save or schedule — Keep the query as a template, and schedule it if it should run again.

The hunt lifecycle

Question  →  Hunt  →  Cells & checkpoints  ⇄  Verdict  →  Report  →  Pulse

1. Question — A chat with Scout, an entity's Hunt now button, a playbook, an insight, or a watcher raises something worth structured work.
2. Hunt — A hunt session is created with a subject or hypothesis and a scope, seeded from wherever it started, and opens on its notebook.
3. Cells & checkpoints — You and Scout add steps: queries, tasks, actions. Scout runs what your chosen mode allows and pauses at checkpoints for your decision. When a step fails, Fix with Scout writes a replacement beneath it.
4. Verdict — Record what you concluded. The hunt stays open, so plan and run again if the verdict changes; the log keeps every entry.
5. Report — Scout writes the hunt up; you share or export it, then close the hunt.
6. Pulse — The outcome is counted alongside every other hunt in your scope.

Data flow

Products ── Connections ── Queries / Runs ── Results
                                              │
                          Entities ◄──────────┼──────────► Insights
                              │               │               │
                              └──── Chats & Hunts (Scout) ────┘
                                              │
                          Activity Feed ◄─────┴─────► Pulse

Connections bring products in. Queries run against them and return results. Entities and insights are extracted from results and from Scout's own reasoning. Chats and hunts tie the pieces into investigations, and the Activity Feed and Pulse are where the team sees the whole picture.

Data standards

• OCSF — Huntbase normalises event data using the Open Cybersecurity Schema Framework where a product supports it. See OCSF schema.
• STIX 2.1 — Supported as one of the query languages, for pattern-based indicator queries. See Query languages.

Next steps

• Explorer overview — the tabbed workspace in detail
• Chatting with Scout — modes, initiative, and what Scout shows you
• Hunts — sessions, modes, checkpoints, and reports
• Activity Feed — browsing everything the team produced