Connections

Connections link a product from the Huntbase catalog (an EDR, SIEM, cloud account, object storage bucket, ticketing tool, and so on) to your own deployment of it. Once a connection exists you can query it from the query workspace, let Scout reason over it, and use it in hunts.

Open Connections from the sidebar. The page has two tabs, matching the two things people come here to do.

Your connections

A list of the connections you have — not the catalog. Each row shows the connection and its product, which direction the data moves, which organization owns it, its health, and which query languages it supports.

• The Health column sorts by severity, so one click on the header brings the problems to the top.
• The filter narrows to Needs attention, Query sources or Destinations. "Needs attention" means a connection has recent consecutive failures or is disabled — a connection that has simply never been checked is not counted, because unknown is not the same as broken.
• Click a row to open its product page, where the connection can be edited, tested or deleted.

Telemetry ingest keys are listed underneath, because a key is the same kind of thing as a connection: a way data reaches Huntbase that you own and might revoke. See Data lake.

The line above the tabs is the summary: how many connections you have, how they split between query sources and destinations, how many ingest keys are active and whether anything has arrived on them. When something needs attention it appears there as a button that takes you straight to the filtered list.

Which way does the data move?

There are two ways Huntbase sees your data, and most estates use both.

	What it means	What you need
Query source	Huntbase holds a credential and calls the vendor when a query runs. Nothing is copied here until you ask a question — and the answer is only as complete as what that API will return.	A token or key from the vendor.
Data destination	Data is written into a store Huntbase reads directly: an Apache Iceberg lake you own, or Huntbase's own managed store. This is the side that accepts a log shipper.	A store, or nothing at all — see below.

Every connection row says which it is, and a destination's product card is badged DESTINATION in place of its category.

Add a source

The second tab opens with the three ways in:

Choice	What it does
Connect a source we query	Browse the catalog below and pick a product.
Point us at a lake you own	Goes straight to setup for an Apache Iceberg store.
Send us telemetry	Shows the ingest endpoint — full URL, host, port, path, and the auth header — plus a curl that checks it is reachable, and a button to mint a key.

Sending telemetry to Huntbase

You do not need a store of your own. Send us telemetry mints a telemetry ingest key and generates ready-to-paste configuration for Fluent Bit, Vector, rsyslog or syslog-ng. Events land in Huntbase's managed store and are queryable with KQL (Huntbase Lake) alongside everything else.

The card shows the endpoint before you mint anything, and the reachability check needs no key — so you can run it from the machine that will do the shipping first. For the full path, including shipping into a lake you own, see Data lake.

note

If you cannot see any ingest keys, that may be because your role cannot list them rather than because none exist.

Browse the catalog

Beneath the three choices, the catalog is filtered on three independent axes that compose:

Filter	Shows
All / Connected / Available	Everything, products with a connection in your scope, or products you have not connected.
All products / Query sources / Data destinations	Which direction the product's data moves.
Grid / By category	Layout only.

• Use the search box in the page header to find products by name, vendor or tag.
• Each product card shows the logo, name and category (or DESTINATION), plus a connection counter. Click the counter for that product's connections with their health chips; disabled and simulated connections are marked.
• Click a card to open the product page.

tip

The Target selector affects the catalog too. When you filter to a specific organization or user, products without a connection in that scope are shown separately as out of scope.

Create a connection

Click New connection — from the Connections page, or from a product page to start with that product already chosen. Setup opens as its own page, and the steps depend on the product you pick: Product → Details → Connect → Verify. Connect only appears when the product needs settings or credentials.

The page keeps your progress in its own address. You can close the tab, refresh, use your browser's Back button, or send the link to whoever holds the credentials — the draft is waiting where you left it. Your secrets are the one thing not carried in the link, so anyone resuming it enters those themselves.

1. Product (and owner)

• Pick the Product from the grid. Search matches the product name, the vendor and its categories, and products you already have a connection to are marked Connected.
• Choose the Owner. This decides who can use the connection and the data it produces:

Owner	Who can use it
Organization	Members of that organization.
Personal	Only you. Not offered if an organization you belong to has turned personal scope off.

• For endpoint products such as osctrl, also pick the Environment your agents will enrol into. If no environment is available to you, request access rather than choosing a different owner.
• If the product ships with content packs, the page tells you which queries will sync automatically on the new connection. You can turn these off later from the connection page (see Synchronisation settings).

2. Details

Give the connection a Name — one is suggested for you and you can change it (for example Production CrowdStrike) — and an optional Description.

3. Connect (only if the product needs it)

One step covers both halves of reaching the product:

• Where it lives — the product's own settings (API endpoint, tenant, region and similar). Optional expert settings sit under Advanced, which opens itself if anything in there is required or already filled.
• What it will accept — the Method the product offers, a Credential label (for example Production API Key), and the secrets themselves. Some products offer a no-authentication method; choose it to continue without credentials.

The right-hand rail lists what you need to fetch from the vendor first — which kind of token, which permissions it needs, and the common mistakes — for the products we have guidance for.

You can choose I'll do this later and finish the connection without credentials. It is created, but it cannot run until they are added, and it carries a short setup checklist saying exactly what is outstanding.

4. Verify

Review what will be created — each section links back to the step that owns it, so fixing a typo doesn't mean walking backwards through the whole flow — then click Create & check.

The connection is created and immediately checked, without leaving the page:

Result	What you see
Passed	The connection is healthy and ready to query.
Failed	The reason, with Fix the details, Check again and Discard connection. Discarding deletes the connection that was just created, so a wrong credential doesn't leave anything behind.
No result	The check was accepted but nothing answered within a minute. The connection exists; check it again from its own page.
Can't be checked	Some products declare no connection test. Nothing has confirmed the credential — the first query you run against it will.

note

Data lake stores are the exception: creating one does not provision it. See Data lake for what happens after Create & check on those.

Several connections per product

You can create as many connections to the same product as you need — separate tenants, regions or environments, for example. Each connection has its own configuration, credentials, health and stats.

The connection page

Open a connection from the catalog popover or from a product page. The header shows the product, the connection name (click it to edit inline), the health chip, the owner, and badges such as Disabled, simulated or Not indexed where they apply. If you own the connection you can also:

• flip the Enabled / Disabled switch to make the connection active or inactive (you are asked to confirm), and
• click Enable Scout access / Disable Scout access to control whether Scout can use this connection.

Health

The health chip has four states:

Chip	Meaning
Connected	Recent runs or tests against this connection succeeded.
Degraded	Recent runs are partly failing.
Error	Recent runs are failing; hover the chip to see the number of consecutive failures.
Unknown	No health information yet.

A Last sync value in the metadata strip shows how long ago the connection last synchronised, alongside Created, Owner and the copyable Connection ID.

Test the connection

For products that support it, a Test connection button appears near the top of the page (and in the Credentials modal). The test uses the connection's default credential; the result arrives as a notification and as an inline pass/fail summary. If no result arrives, the button reports a timeout and lets you try again. New connections are checked automatically as they are created — this button is for re-checking one later.

Statistics

The stats panel summarises activity for a window of 24 hours, 7 days or 30 days. It shows when the last successful run happened, the error rate, latency (p50 and p95, once enough samples exist), and cards for Queries run, Result rows, Entities extracted (with a by-type breakdown) and Hunts using it, plus a Runs over time sparkline.

Description and Configuration

• Description — edit inline. For dynamic-schema connections the description is inferred by Scout from the content unless you edit it yourself.
• Configuration — the product's settings. Click Edit, change values, then Save (or Cancel). Optional fields sit under an Advanced disclosure.

Credentials

Click the Credentials card to open Connection Credentials. The table lists each credential's Label, Auth Mode, Status and Created date, with a Default badge on the one in use.

• Add Credential / Add Another Credential — choose the Authentication Mode, enter a Label and the required secrets, then click Create Credential.
• Use the star action on a row to set it as the default for this connection.
• Use the trash action to delete a credential (you are warned if it is the last one).

Secrets are not shown again after you save them.

Synchronisation settings (content packs)

Products that ship with content packs show a Synchronisation Settings card with the number of queries configured and whether syncing is Enabled or Disabled. Open it to see each pack's queries and their cadence, and use the switch to turn synchronisation on or off for this connection.

Discovered Schema

Connections with a dynamic schema — for example object storage sources such as Amazon S3 or Azure Blob Storage — show a Discovered Schema card. Scout infers the tables and fields from the connection's content.

• The card shows the sync status (Syncing, Completed, Failed or Idle), Total Tables, Processed, Failed and Last Sync.
• Click Sync Schema to run discovery (or re-run it after new files land).
• Expand a table to see its fields and edit its description. Scout infers descriptions unless you edit them; an edited table is badged User Modified, and Discard user edits returns it to the inferred description after a confirmation.
• If discovery failed, the error appears under the card's notice; a table that could not be read shows its own error when expanded, and its description can still be edited.

Webhooks

The Webhooks card shows how many ingestion endpoints are active or paused on this connection and opens the Event Ingestion & Webhooks modal. See Webhooks (event ingestion).

Endpoint Control

osctrl connections show an additional Fleet Status / Fleet Management panel. See Endpoint Control (osctrl).

Delete a connection

Scroll to the Danger Zone and click Delete Connection, then confirm. This permanently removes the connection and its associated data and cannot be undone.

Next steps

• Endpoint Control (osctrl) — deploy osquery agents and manage your fleet
• Webhooks (event ingestion) — push events from external products into Huntbase
• Data lake — bring your own Iceberg store, or ship logs straight to Huntbase
• Query workspace — run queries against your connected sources