Inbox
The Inbox is one place for everything addressed to you. Its folders split what waits on your decision from what is only for your information:
| Folder | What's in it | Count |
|---|---|---|
| Needs you | Detections to judge, approvals and hunts paused on you, each decided in place. The Inbox opens here. See Needs you. | The number of items waiting on you |
| Mentions & assigned | Notifications that name you: someone mentioned you or assigned you a task. | Unread |
| Updates | Every other notification: finished queries, hunt plans, exports, watcher events, team activity. | Unread |
| Messages | Messages from Scout and Huntbase: threat intel, hunt suggestions, product updates, onboarding tips and requests for information. | Unread |
| Done | Notifications and messages you archived, with Restore. | — |
Only the Needs you number is counted in the header, the navigation and the bell, so "Inbox 12" means twelve decisions are waiting. Reading an update or a message never changes it.
Open it
- Click Inbox in the navigation menu. With the new navigation it sits under Investigate, and the header's Inbox button, which shows the Needs you count, opens it too.
- In the classic layout, click the bell in the page header for a peek at Needs you, then Open Inbox. The bell's footer also links to Updates and Messages.
- Press ⌘K / Ctrl+K and type
inbox,needs you,approvalsornotifications.
Old links still work: Needs you links open the Needs you folder, the Notifications page opens Updates, and a link to a message opens it in Messages.
The layout
On a wide screen the Inbox reads like email: the folder rail on the left, the list in the middle, and the open item on the right. Under Needs you, the rail also lists its lanes (Detections to judge, Approvals, Paused on you), plus Relevant threats where threat intel is available and Older than 14 days; those last two aren't counted. Under Messages, it lists Pinned and Snoozed.
On a narrow screen the folders become a row of buttons at the top. Opening an item replaces the list; Back to the list returns to it.
Every folder uses the same row: whether it's unread (a dot, and a bold title), the type, a severity word where there is one (Critical, High), the sender or source, the customer where you manage several, the title, one short line of detail and the age (Just now, 12m, 5h, 6d, then the date; hover for the full date). Under the title, small badges add Scout's draft, Pinned, Snoozed or Done.
The open item uses the same frame in every folder too: a line with its type, severity, source and age, the title, then a row of actions, the body, and, for anything you decide, the decision bar fixed at the bottom. Each action's tooltip shows its key, for example Archive (e).
Needs you
Needs you is your to-do list. Pick an item and its card opens beside the list, with what Scout drafted, the evidence and the decision buttons, so you can confirm a detection, approve a step or resume a hunt without leaving the Inbox. Group the list by Priority, Watcher or Hunt, and decide several items at once. See Needs you for how triage works.
An item counts as read once you open it. That's remembered in this browser and never changes the count.
Relevant threats
Relevant threats lists the threats seen in your data, exploiting software you run, or aimed at you (see Relevant threats). Open a threat to see its badges and why it matters, with Hunt this (or Open hunt) and Open details. For a threat actor or malware, the pane also shows its ATT&CK techniques by coverage state and its top three gaps: the techniques nothing is watching and no recent hunt answered, those you hold data for first. Each gap has Hunt this and Watch for this, so you can close it without leaving the Inbox.
All customers (MSSPs)
If you manage two or more customer organisations, Needs you has an All customers view: everything waiting on you across your customers, in one list. Open it from All customers under Needs you in the folder rail, or choose All customers (Needs you across N customers) in the Scope picker. All customers is a view, not a scope: choosing it opens the Inbox and doesn't change the organisation you're working in.
- Customer rail. Each customer shows how many items are waiting, how many are Critical, and how long the oldest has waited, with a dot against the response target: green under 1 hour, amber under 4 hours, red at 4 hours or more. A customer Huntbase couldn't read shows Couldn't be read, never 0. Click a customer to narrow the list to it.
- Same threat across customers. When the same detection (the same watcher and the same thing seen) is waiting at two or more customers, it's grouped into one row, for example Katana C2 contact · 3 customers, with each customer's chip. Triage each expands it into one row per customer. Only detections to judge are grouped; approvals and paused hunts are always listed one by one.
- The rest, by priority: severity, then oldest. Every row carries its customer's name and colour.
All customers is for reading: you can't record verdicts or take bulk actions from it. Opening an item first switches the scope to that customer, then opens the item in that customer's own Needs you, so every decision you make is recorded for the right customer. Each customer is read with your own access to it, exactly as if you switched to each one in turn: a customer whose managed access has ended doesn't appear.
While you work in a customer, the triage card shows a banner such as Customer Northwind Logistics · via Acme MSSP · waiting 3 hours, with the same dot and an All customers link back.
Mentions & assigned and Updates
These folders hold your notifications for the organization you're working in. Click a notification to read it in the right-hand pane, where it's marked read; its button opens what it refers to, such as a hunt, a query, an export or an invitation.
| Control | What it does |
|---|---|
| Unread only | Shows only unread notifications. |
| Mark all read | Marks every notification in the folder read. |
| Gear icon | Opens your notification preferences. |
| Mark unread (u) | Marks the open notification unread again. |
| Archive (e) | Moves the open notification to Done. |
| ⋯ › Turn off "…" | Stops that kind of notification. |
Load more at the bottom of the list fetches older notifications.
Done
Done opens on Decided (Decided today): the detections, approvals and hunts you decided in this session, each with its verdict and your reason, plus hunts whose recorded verdict changed today. The hunts that came with the Example Corp sample data are left out: their verdicts were recorded when the sample was installed. A decision leaves Needs you, and every count, as soon as you make it; Undo puts it back. Switch to Notifications or Messages at the top for what you archived. Restore (or e) puts a notification back in its folder; an archived message goes back with Move to inbox.
Messages
The Messages folder is rolling out and may not be enabled for your organization yet.
Messages holds messages addressed to you: threat intel and hunt suggestions from Scout, product updates and announcements from Huntbase, onboarding tips, and requests for information. Many messages carry an action, such as Start hunt, Ask Scout or Run in explorer, so you can act on a message without leaving it.
Messages are personal. They come from every organization you belong to, and the Scope selector doesn't filter them. A message about one organization shows that organization's name as a chip in the list and as a badge on the message. If you leave an organization, its messages leave your Inbox.
| Sub-folder | What's in it |
|---|---|
| Messages | Messages that aren't archived or snoozed. |
| Pinned | Messages you starred. |
| Snoozed | Messages hidden until a time you chose. |
The message list
Each row shows the sender, the subject, a one-line preview and when it was sent. Unread messages are bold. A pinned message has a star. A snoozed one says Snoozed until and the date. ✓ Done means you've already completed one of the message's actions.
The list loads 30 messages at a time. Click Load more at the bottom for the next page.
The toolbar above the list:
| Control | What it does |
|---|---|
| Search | Filters by subject and preview as you type. |
| Unread | Shows only unread messages. |
| Type | Filters by category: Threat Intel, Suggestions, Product Updates, Onboarding, Requests for Info, Conversations or Announcements. |
| Mark all read | Marks every message in the folder read, within the Type filter. |
| Refresh | Fetches the latest messages. New messages also arrive on their own. |
Tick the checkbox on a row, or the one at the top for the whole page, to act on several messages at once: mark them read or unread, archive (or unarchive) them, or delete them.
Reading a message
Click a message to open it in the reading pane. It's marked read after a second. The header shows the category, the sender, the organization if there is one and when it was sent, then the subject and the actions: Pin, Snooze, Mark unread / Mark read, Archive / Restore and Delete. An action the message's body already shows isn't repeated in the bar. If the message expires, a notice says when.
Links to other Huntbase pages open in the app. A link to an outside website first opens a Leaving Huntbase dialog with the address defanged, because a link in a message hasn't been checked and may be an indicator itself. Click Open anyway to follow it, or copy the address instead.
Senders
| Avatar | Sender |
|---|---|
| Blue robot | Scout |
| Violet building | Huntbase |
| Initials or photo | A person |
Act on a message
Hover a row, or use the buttons above an open message:
| Action | What it does |
|---|---|
| Pin | Stars the message and adds it to Pinned. |
| Mark as read / Mark as unread | Toggles the unread state. |
| Snooze | Hides the message until a time you choose. See Snooze. |
| Archive | Moves it to Done. Move to inbox brings it back. |
| Delete | Removes it from your Inbox. From the reading pane, you confirm first. From the list or the keyboard, it's deleted straight away. |
Snooze
Choose when the message comes back:
- Later today, in three hours
- Tomorrow, at 9:00 AM
- This weekend, Saturday at 9:00 AM
- Next week, Monday at 9:00 AM
- Pick date & time…, up to 90 days ahead
When the time comes, the message returns to the top of Messages as unread, and you get a Snoozed message returned to your inbox toast. Snoozing a pinned or archived message moves it out of Pinned or Done. Archiving a snoozed message cancels the snooze. To bring one back early, open Snooze and pick Unsnooze (return to inbox).
Message actions
A message can carry action buttons, in its text or in a bar at the bottom. The sender chooses each button's label. Once you've done an action, its button changes, for example to Hunt started, Submitted or Opened. Some actions can only be done once.
| Action | What happens |
|---|---|
| Start a hunt | Creates a hunt, from a playbook or from the hypothesis in the message, and opens it in Explorer. Scout drives it. |
| Ask Scout | Opens a Scout chat in Explorer with the message's prompt. Usually the prompt is sent at once. Some messages leave it in the chat box as a draft, for you to edit and send. |
| Run a query | Opens a new query tab with the query, its language and its connections filled in. It doesn't run until you click Run. |
| Open a page | Opens a connection, hunt, playbook, watcher, query or library item. A quarantined watcher opens on its Deploy tab, under Response. |
| Continue a chat | Reopens an earlier Scout chat. |
| Fill out a form | Scrolls to a form in the message. See Forms. |
| External link | Opens a website in a new tab. The button shows an arrow. |
| Dismiss | Archives the message. |
A query in a message appears as a card with the query itself, its language and how many connections it uses. Click the copy button to copy the query, or the card's button to open it in Explorer.
When a message belongs to one of your organizations, starting a hunt, asking Scout, running a query or opening a page first switches your scope to that organization. The hunt, chat or query tab is created there.
Forms
Some messages, such as requests for information, include a short form. Required fields are marked with *. Click the submit button to send your answers. If you open the message again, your earlier answers are filled in and you can update them.
Scout's draft on a detection
The Inbox's Needs you folder holds the detections, hunts and checkpoints waiting on your verdict (see Needs you). Open one and its card leads with Scout's draft, Scout's suggested verdict, before the evidence and the verdict buttons.
- When Scout has written a draft, it reads Likely and the verdict, with Scout's summary.
- When a detection has a hunt (for example one started with Hunt this) and that hunt's checks have reached a verdict, the box is headed Scout's draft (from the hunt's checks) and shows that verdict line, the same one the hunt shows. See How the checks' verdict is decided.
- When the detection's hunt hasn't reached a verdict yet, the box says so. Record your verdict, or open the hunt.
- When there's no hunt and no draft, the box says no draft verdict is attached. Record your verdict, or click Hunt this to have Scout investigate.
The draft is a suggestion. Your verdict is the one that counts, and once you record it the card shows your decision in place of the draft.
Keyboard shortcuts
These work while the Inbox is open and you aren't typing in a field. The same keys mean the same thing in every folder.
| Key | Action |
|---|---|
| j / k | Next / previous item |
| e | Archive (in Done, restore) |
| u | Mark unread and go back to the list (in every folder, Messages included) |
| Esc | Close the open item |
Needs you adds its triage keys (c, b, f, l, i to pick a verdict, h to hunt, x to select, z to undo); see Keys. Messages adds s to pin or unpin, # to delete without confirming, and / to search. h doesn't snooze; use Snooze in the message's actions.
New messages and notifications
Notifications and messages arrive while you're signed in. A new message shows a toast with the sender and subject, and Open to read it. You don't get the toast while you're on the Inbox, or for low-priority messages. See Notifications for how notifications reach you.
The Inbox also shows up in other places:
- Explorer previews the Needs you folder in its Needs you worklist, with up to three unread messages under Messages. While the worklist is collapsed, the line under the greeting says how many items need you and how many new messages you have.
- The bell (classic layout) peeks at Needs you, with Open Inbox, Updates and Messages in its footer.
To choose how you hear about new messages, open Settings › Personal › Notifications and use the Inbox table. You can turn off the in-app alerts for new and returning messages. Email, where you turn it on, is a short "you have a new message" nudge, sent only for messages the sender marked for email. See Notification preferences.
Next steps
- Needs you: judge detections, approve steps and resume hunts from the Inbox
- Notifications: what triggers a notification, and your preferences
- Explorer: where hunts, chats and queries from a message open
- Hunts: what happens after you start a hunt from a message