Quickstart

This guide takes you from a new account to your first Scout answer and your first hunt. With sample data it takes a few minutes; connecting your own source adds whatever that source needs for credentials.

Prerequisites

• A Huntbase account. Sign up or accept an invitation from a teammate.
• Optionally, credentials for a product you want to query (an API key, OAuth access, or a service account, depending on the product). You can start with sample data instead.
• A current browser (Chrome, Firefox, Safari, or Edge).

Step 1: Sign up and complete onboarding

Create your account at app.huntbase.io/auth/sign-up. You confirm your email address on Huntbase's sign-in pages as part of signing up.

The first time you sign in, a Before you continue dialog asks you to review and accept the Terms of Service and the policies linked beside it. Tick the box and click Accept & continue. The product-updates checkbox below it is optional. If you choose Decline & sign out, you can't use Huntbase until you accept.

Huntbase then sets you up in three screens. The progress bar at the top shows Organisation, Get data in and First hunt, and you can go Back at any point. The menu at the top left shows who you are signed in as and lets you Sign out or switch account.

1. Set up your organisation — Huntbase accounts work inside an organisation, so you create one here even if you are the only member for now. The Organisation name is filled in from your email domain; change it if you like. Optionally add teammates' email addresses under Invite teammates (separate several with commas or new lines). They are invited as members once the organisation exists, and you can change their roles later in Settings › Members. Click Continue.

2. Get data in — Pick one of three ways to give Huntbase something to hunt over. You can add the others any time.

   • Connect a tool — pick your SIEM, EDR, cloud account or data lake from the list. Setting one up opens the full setup page and brings you back here when it's done. See Step 2.
   • Send logs — point a log shipper at Huntbase Lake. No store of your own needed. See Send your first events.
   • Try with sample data — turns on Example Corp's sample data and takes you straight to your first hunt. Nothing to set up.

   Click Continue once a source is connected or logs are arriving, or Skip for now — set up later in Connections.

3. Run your first hunt — The Your first hunt card offers one hunt picked for the data you have (or the Example Corp sample hunt). Click Start this hunt. Under Other ways to start you can instead Run a query (pick a query template and open it in Explorer), Start a blank hunt, or choose I'll explore on my own. See Your first hunt.

When you finish, you land in Explorer, Huntbase's home.

Joining by invitation. Open the link in the invitation email and choose Create account and join (or Sign in as your address if you already have an account). When you come back from signing up or signing in, you join the organisation automatically — there is no second confirmation. If you were invited to an organisation that's already set up, you skip straight to Your first hunt; its admins manage connections and ingest keys. If you already use Huntbase and were invited to another organisation, you go straight to Explorer in that organisation.

Buying through Google Cloud Marketplace. After you link your purchase to an organisation, Continue to Huntbase takes you to Get data in for that organisation rather than back to the start.

Send your first events

The Send your first events page gets telemetry flowing into Huntbase Lake. You don't need a store of your own. It has three parts, each ticked off as you go:

1. Create an ingest key — click New key on the Send telemetry to Huntbase card and give it a source label. Copy the token. It's shown only once.
2. Configure your shipper — paste the config shown when you created the key into Fluent Bit, Vector, rsyslog or syslog-ng, then start the shipper.
3. Wait for the first event — the page starts listening as soon as the key exists and updates the moment an event is accepted. It then says how many events arrived, when the first one came and from which host. Browse them opens them in Search telemetry, and Continue moves on.

If nothing has arrived after 10 minutes, the page stops waiting and says so. It shows the command that checks your host can reach Huntbase, and Keep waiting starts listening again. If a source is already sending, the page says Already receiving from source, and you can add another or continue.

You can always move on with Skip for now. If nothing is connected yet, the page explains that Huntbase needs something to search and offers sample data or Connect a source instead.

note

Some Huntbase deployments also offer a personal path: a Who is this for? screen before step 1, where Just for me skips the organisation screen and For my team continues as above. The same screen lists any invitations waiting for you. Sign-ups at app.huntbase.io always create or join an organisation, and go straight to step 1 when there's no invitation to accept.

note

Sign-up, sign-in, password reset, and multi-factor authentication happen on Huntbase's own sign-in pages. You return to the app automatically when you are done.

If your account is missing details that sign-in requires, Huntbase shows Finish setting up your account. Click Complete your profile to fill them in on the sign-in pages. You then come back to Huntbase and carry on to where you were going.

Step 2: Connect a data source

Scout can only answer questions about data it can reach. There are two ways to give it some, and either is enough to get started:

• Connect a source we query — a SIEM, an EDR, a cloud account, or an Apache Iceberg lake you already own. Steps below.
• Send us telemetry — no store of your own needed. On the Telemetry page, use New ingest key to mint an ingest key; it generates the config for Fluent Bit, Vector, rsyslog or syslog-ng. See Data lake. Once events arrive, Search telemetry shows them, and the Telemetry Overview shows whether each source is still sending.

To connect a source:

1. Open Connections from the navigation.
2. Click New connection.
3. Pick your product from the grid. The right-hand rail lists what you need to fetch from the vendor first — which kind of token, and what it needs access to.
4. Name it, choose which organization owns it, then fill in where it lives and the credential.
5. Click Create & check. The connection is created and checked straight away; if the check fails you can fix the details, try again, or discard it without leaving the page. (If you saved it without a key, the button says Create and nothing is checked until you add one.)

Don't have the credential to hand? The page keeps your progress in its address, so you can close it and come back, or send the link to whoever does.

If your source is a fleet of endpoints rather than a SaaS product, set up Endpoint Control from Endpoints instead: choose your agent address and request it there (see Get Endpoint Control). If your data already lives in a data lake, or you would rather ship logs than expose a store, see Data lake. Otherwise Connections and Endpoint Control have the full walkthroughs.

If you see a plan notice such as "Endpoint Control is included on the Professional plan and above", your plan doesn't include that capability: See plans opens Billing. If you see Request access where you expected ingest keys, your plan includes it but it has not been switched on for your organization yet — see Data lake for what the request does. For Endpoint Control you see Set up Endpoint Control instead, which opens Get Endpoint Control.

Step 3: Ask Scout your first question

Back on Explorer, there is one ask box. The line under it says what Enter will do; for a question, that's asking Scout.

1. Type a question in plain language, for example:
   • "Show me failed logins in the last 24 hours."
   • "Which hosts talked to a newly registered domain this week?"
   • "List users who were added to an admin group in the last 7 days."
2. Optionally set how much Scout does on its own using the selector under the input: Guide (the default), Collaborator, or Operator. Huntbase remembers your choice for new chats.
3. Press Enter.

If the line offers something else first, such as looking up a value you pasted, press Tab until it says it will ask Scout, or choose Ask Scout under Treat as. See The ask box.

note

If Explorer shows an Ask / Query toggle above the input instead, leave it on Ask and press Enter or click Ask Scout.

A new chat opens. Scout shows its reasoning as a series of steps, works out a query, picks connections, and runs it. Depending on your initiative level it may first ask a clarifying question or show a confirm execution card where you can review and edit the query before it runs.

tip

You can also type /query at the start of the input to switch the same box into Query mode, or /knowledge to search your knowledge sources. See Chatting with Scout.

Step 4: Open the results in a query tab

When the run completes, Scout posts a Scout Analysis card with the row count, a summary, and key findings, followed by follow-up queries and hunt ideas. Click See Results on the execution card to open the run in a query tab in Explorer.

In the query tab you can read the results table, edit the query and run it again, change the time window and connections, and save the query as a template. See Query workspace.

Step 5: Look at entities and insights

Scout and the query workspace pull entities (hosts, users, IPs, domains, hashes, CVEs and more) and insights (findings) out of results.

• Entity and insight cards appear in the chat when Scout mentions them.
• Selecting an entity in a query tab opens the side panel with Information and Relationships tabs, showing details, tags, provenance (which run and query found it), related queries, and a relationship graph.
• Insights show a review state (Needs review, Approved, Hunt started, or Dismissed) that your team updates as it works through them.

Activity collects everything the team has produced across hunts, insights, entities, and queries. See Entities and Insights.

Step 6: Start your first hunt

When a question turns into an investigation, promote it to a hunt so the steps, findings, and report are kept together.

• In a chat, under one of Scout's answers, open Add to hunt ▾ and choose New hunt from this. The hunt is named after your question, the chat is linked to it, and what Scout already ran comes across as cells. The hunt opens in front of the chat.
• In a chat, when Scout offers a Hypothesis Draft, click Start hunt. Scout creates the hunt from the conversation and posts a Hunt session created card; Show hunt opens it beside the chat.
• From an entity in the Inspector, open Add to hunt ▾ and choose New hunt from this… to start a hunt seeded with that entity.
• Choose New › Hunt in the page header, or click New hunt (+) in the dock's Workspace view, for a blank hunt.

The hunt opens on its notebook. Type what you are hunting in the Plan block, then pick a door: Have Scout plan it, Write a query, or Add from Library — or ask Scout a question in the Scout panel. Choose how much Scout does on its own — Guide, Collaborator, or Operator — with the Scout mode chip in the hunt header, and approve checkpoints as they appear, in the hunt or in your Inbox's Needs you folder. When you know the answer, choose Conclude and pick a verdict: Confirmed, Benign, False positive, Clear or Inconclusive. See Hunts.

Where to go next

You now have a connection, a chat, a query tab, and a hunt. From here:

• Browse the Content library for hunt playbooks and query templates you can run without writing anything.
• Check your Inbox for what needs you: detections to judge, approvals and paused hunts.
• Set up Watchers so new insights start hunts or notify you automatically.
• Check Pulse after a week to see what your hunting has produced.

Next steps

• Key concepts — the vocabulary the rest of these docs use
• Explorer overview — the navigation, the Explorer page, and the command palette
• Hunt playbooks — launch a ready-made hunt
• Watchers — standing rules that create detections and start hunts automatically