Connections

Connections link a product from the Huntbase catalog (an EDR, SIEM, cloud account, object storage bucket, ticketing tool, and so on) to your own deployment of it. Once a connection exists you can query it from the query workspace, let Scout reason over it, and use it in hunts.

Open Connections from the navigation (under Set up). The page is your list of connections. New connection in the header switches it to the Add a source view, and Back to your connections returns to the list. If you have no connections yet, the page opens on Add a source. Whether data is arriving from each telemetry source you ship is on the Telemetry page. Old links to Connections › Telemetry open it.

Your connections

A list of the connections you have — not the catalog. Each row shows the connection and its product, which direction the data moves, which organization owns it, its status, and which query languages it supports. The status is one chip, in the same words the connection page uses (see Status).

• The Status column sorts by severity, so one click on the header brings the problems to the top.
• The filter narrows to Can't be queried, Needs attention, Query sources or Destinations. "Can't be queried" counts connections that are Failing or Not configured. "Needs attention" counts those, plus connections that are Degraded or Disabled, or whose key expires within a week or has expired. A connection that has simply never been checked is not counted, because unknown is not the same as broken.
• When two connections share a name, the list adds the product and a short id, for example Splunk 1 · Splunk · 2304fe, so you can tell them apart. The query bar's connection picker and run failure lists do the same.
• Click a row to open that connection, where it can be edited, checked again or deleted.

When any connections can't be queried or need a look, a banner above the list says how many, for example 3 connections can't be queried, 1 needs a look. It counts the same way as the filter, so the banner and the filter always agree. Details lists the worst connections first, each with its status and why. Show all N filters the list to them.

A lake store is a lake you own that Huntbase reads. Huntbase never sends events to it: every ingest key sends to the Huntbase data lake. Whether queries read each lake is on Telemetry › Destinations.

Where the Telemetry page is available, ingest keys are managed on Telemetry › Sources. Otherwise Telemetry ingest keys are listed underneath your connections, because a key is the same kind of thing as a connection: a way data reaches Huntbase that you own and might revoke. See Data lake.

The line at the top of the page is the summary: how many connections you have, how they split between query sources and destinations, how many ingest keys are active and whether anything has arrived on them. The banner below it covers anything that needs attention.

Which way does the data move?

There are two ways Huntbase sees your data, and most estates use both.

	What it means	What you need
Query source	Huntbase holds a credential and calls the vendor when a query runs. Nothing is copied here until you ask a question — and the answer is only as complete as what that API will return.	A token or key from the vendor.
Destination	A lake you own that Huntbase reads directly, in place. Huntbase never writes to it: telemetry you ship with an ingest key goes to the Huntbase data lake.	An Apache Iceberg store, or nothing at all if you only ship telemetry — see below.

Every connection row says which it is, and a destination's product card is badged DESTINATION in place of its category.

Add a source

Click New connection in the page header. The Add a source view opens with the three ways in:

Choice	What it does
Connect a source we query	Browse the catalog below and pick a product.
Point us at a lake you own	Goes straight to setup for an Apache Iceberg store.
Send us telemetry	Where the Telemetry page is available, Set it up in Telemetry opens Telemetry › Sources. Otherwise it shows the ingest endpoint — full URL, host, port, path, and the auth header — plus a curl that checks it is reachable, and a button to mint a key.

Sending telemetry to Huntbase

You do not need a store of your own. A telemetry ingest key comes with ready-to-paste configuration for Fluent Bit, Vector, rsyslog or syslog-ng. Create one with New ingest key on the Telemetry page, or from Send us telemetry where that page isn't available. Events land in Huntbase's managed store and are queryable with KQL (Huntbase Lake) alongside everything else.

The endpoint is shown before you mint anything (on Telemetry › Sources, under Ingest endpoint), and the reachability check needs no key — so you can run it from the machine that will do the shipping first. For the full path, and for bringing a lake of your own that Huntbase queries in place, see Data lake.

note

If you cannot see any ingest keys, that may be because your role cannot list them rather than because none exist.

Browse the catalog

Beneath the three choices, the catalog is filtered on three independent axes that compose:

Filter	Shows
All / Connected / Available	Everything, products with a connection in your scope, or products you have not connected. The catalog opens on Connected once you have a connection, otherwise on All. Sample data connections don't count: a product only Example Corp has a connection for shows a Sample chip and stays under Available. When some of your own connections have failing queries or are switched off, N of yours need attention appears beside the filter; click it for the list filtered to Needs attention.
All products / Query sources / Data destinations	Which direction the product's data moves.
Grid / By category	Layout only.

• Use the search box in the page header to find products by name, vendor or tag.
• Each product card shows the logo, name and category (or DESTINATION), plus a connection counter. Huntbase's own products say By Huntbase. Click the counter for that product's connections, each with its status chip and owner (Organisation or Personal); disabled and Simulated connections are marked. Click a connection's name to open it.
• Click a card to open the product page. It says what the product is for, then two figures: Connections (with how many are in the current scope) and Need attention (degraded, failing, not configured, switched off, or a key due). Below them, Connections lists every connection to the product with its status chip.

tip

The Scope selector affects the catalog too. When you filter to a specific organization or user, products without a connection in that scope are shown separately as out of scope.

Create a connection

Pick a product in the catalog and click New connection on its product page to start with that product already chosen. To start from the Product step instead, open the ▾ beside New connection on the Connections page and choose Guided setup…. Setup opens as its own page, and the steps depend on the product you pick: Product → Details → Connect → Verify. Connect only appears when the product needs settings or credentials.

The page keeps your progress in its own address. You can close the tab, refresh, use your browser's Back button, or send the link to whoever holds the credentials — the draft is waiting where you left it. Your secrets are the one thing not carried in the link, so anyone resuming it enters those themselves. A link that has lost its product starts again at the Product step.

When Continue is off, the line beside it says what's missing — for example Give the connection a name or Fill in and the required fields still empty.

1. Product (and owner)

• Pick the Product from the grid. Search matches the product name, the vendor and its categories, and products you already have a connection to are marked Connected. A product that only has a sample connection is marked Sample instead.
• Choose the Owner. This decides who can use the connection and the data it produces:

Owner	Who can use it
Organization	Members of that organization.
Personal	Only you. Not offered if an organization you belong to has turned personal scope off.

• Endpoint Control has no set-up steps here. Picking it sends you to Endpoints to set it up, or connects your fleet once it is ready. See Endpoint Control.
• If the product ships with synchronised queries, the page tells you which queries will sync automatically on the new connection. You can turn these off later from the connection page (see Product default queries).

2. Details

Give the connection a Name — one is suggested for you and you can change it (for example Production CrowdStrike) — and an optional Description.

3. Connect (only if the product needs it)

One step covers both halves of reaching the product:

• Where it lives — the product's own settings (API endpoint, tenant, region and similar). Optional expert settings sit under Advanced, which opens itself if anything in there is required or already filled.
• What it will accept — the Method the product offers, a Credential label (for example Production API Key), and the secrets themselves. Some products offer a no-authentication method; choose it to continue without credentials.

The right-hand rail lists what you need to fetch from the vendor first — which kind of token, which permissions it needs, and the common mistakes — for the products we have guidance for.

You can choose I'll do this later and finish the connection without credentials. It is created, but it cannot run until they are added, and it carries a short setup checklist saying exactly what is outstanding.

4. Verify

Review what will be created — each section links back to the step that owns it, so fixing a typo doesn't mean walking backwards through the whole flow. The Settings section lists only the settings that apply; an empty optional one reads Not set. Then click the button. Its label, and the note beside it, say what happens next:

Button	When	What happens
Create & check	You entered a key and the product has a connection test.	The product's connection test runs straight away.
Create & check	You entered a key and the product has no test of its own.	Huntbase tries a sample query instead. If that can't confirm the connection, the next step says so, and a query from the Explorer is the real check.
Create	You chose I'll do this later, so there is no key.	The connection is saved with nothing to check yet. Add the key takes you to the connection page.
Create & set up	A lake store, with its key entered.	Huntbase sets up the catalog straight away; see Data lake. Without a key the button reads Create, and set-up starts once you add the key.

Where a check runs, it happens without leaving the page:

Result	What you see
Passed	The connection works. Query it in the Explorer opens a query tab on it.
Failed	The reason, with Fix the details, Check again and Discard connection. Discarding deletes the connection that was just created, so a wrong credential doesn't leave anything behind.
No result	The check was accepted but nothing answered within a minute. The connection exists; check it again from its own page.
Can't be checked	Nothing could confirm the key. The first query you run against it will: Confirm it with a query opens the Explorer.

If anything is still outstanding, a short checklist lists it. It shows only the rows that apply to the product: Settings saved (or Finish the settings), Key saved (or Add a key), and the check, which reads Verified, Check failed, Confirm it with a query or Not checked yet. Products that take no key or no settings have no row for them.

If your organization still has sample data, this step reminds you that it stays until you remove it, and is removed automatically 14 days after your own data starts arriving.

note

Data lake stores are the exception: provisioning is their check. See Data lake for what happens after Create & provision.

Several connections per product

You can create as many connections to the same product as you need — separate tenants, regions or environments, for example. Each connection has its own configuration, credentials, health and stats.

The connection page

Open a connection from the catalog popover or from a product page. The header shows the product, the connection name (click it to edit inline), the owner, and badges such as Disabled, Simulated or Not indexed where they apply. Query this connection opens a new query tab in the Explorer with this connection already picked. If you own the connection you can also:

• flip the Enabled / Disabled switch to make the connection active or inactive (you are asked to confirm), and
• click Enable Scout access / Disable Scout access to control whether Scout can use this connection.

Status

Each connection has one health status, read the same way everywhere: the status line on its page, the status chip in the connection list, on product cards and on the product page, the banner, and the query bar's connection picker. It takes in recent queries, the last connection check, the key and whether the connection is switched on.

Status	Meaning
Working	It answers queries: recent queries succeeded, or a test query returned results.
Degraded	It answers, but recent queries failed or the test query returned no data. If it returned no data, the vendor answered, so check that the account can see the data you want to hunt over.
Failing	It can't answer: several queries in a row failed, the last check failed, or its key has expired.
Not configured	No key has been set, and nothing has worked. Add the key fixes it.
Not checked yet	Nothing has run against it yet. Check it to confirm Huntbase can reach it with its key.
Disabled	Huntbase won't query this connection until it is enabled again.

Below the header, the status line gives the status, then what went wrong in plain words, for example how many queries in a row failed, or that the key was rejected, a permission is missing or the vendor was unreachable. When queries failed, it quotes what the last failed query said. It offers one fix where there is one (for example Check again, Check the settings, which opens the connection's credentials, or replacing the key). A connection that answers but whose recent queries mostly failed reads Most queries fail, not Working, with how many of the recent queries failed. Once a query succeeds after a fix, the warning about earlier failed queries clears; if most earlier queries had failed, the line reads Working again and says how many. While a check runs, it reads Checking…. A product with no automatic check reads Can't be checked: a query is the real test.

When one of your connections turns Failing, an Inbox message says so, with the reason and Open connection. For an organisation's connection it goes to the organisation's admins; for a personal connection, to you. It clears itself once the connection works again. Sample data connections never send one.

Auto-select in the query bar leaves out connections that are Failing, Not configured or Disabled. See Choose connections.

A lake store's status line says Checked by provisioning instead: the Lake store card on the page shows whether the store answers queries.

A Last sync value in the metadata strip shows how long ago the connection last synchronised, alongside Created, Owner and the copyable Connection ID.

Test the connection

For products that support it, a Test connection button appears near the top of the page (and in the Credentials modal). The test uses the connection's default credential; the result arrives as a notification and as an inline pass/fail summary. If no result arrives, the button reports a timeout and lets you try again. New connections are checked automatically as they are created — this button is for re-checking one later.

Statistics

The stats panel summarises activity for a window of 24 hours, 7 days or 30 days. It shows when the last successful run happened, the error rate, latency (p50 and p95, once enough samples exist), and cards for Queries run, Result rows, Entities extracted (with a by-type breakdown) and Hunts using it, plus a Runs over time sparkline.

Description and Configuration

• Description — edit inline. For dynamic-schema connections the description is inferred by Scout from the content unless you edit it yourself.
• Configuration — the product's settings. Click Edit, change values, then Save (or Cancel). Optional fields sit under an Advanced disclosure.

Credentials

Products that take no key, and have none, have no Credentials card.

Click the Credentials card to open Connection Credentials. The table lists each credential's Label, Auth mode, Status and Added date, with a Default badge on the one in use. The credential in use also says when it was last rotated, for example "Last rotated 3 days ago". The Credentials card shows the same line.

• Add Credential / Add Another Credential — choose the Authentication Mode, enter a Label and the required secrets, then click Create Credential.
• Use the star action on a row to set it as the default for this connection.
• Use the trash action to delete a credential (you are warned if it is the last one).

Secrets are not shown again after you save them.

Key expiry

Many vendors issue keys that expire. When you add a credential, you can set the date its key expires in Expires on. Huntbase then warns you before the key stops working:

• In the credentials table, Status turns amber when the key expires within 7 days, and red once it has expired.
• On the Connections list, the connection's row shows Key expires in N days or Key expired, and the connection counts under Needs attention.
• An Inbox message arrives 7 days before the key expires, and another when it has expired. Each is sent once. For a personal connection, the message goes to you. For an organisation's connection, it goes to the organisation's admins. Update credential opens the connection's credentials.

To rotate a key, add the new credential, set it as the default, then delete the old one. If the vendor renewed the same key, change its expiry date instead. Huntbase then reminds you again about the new date.

Product default queries

Products that ship queries which run automatically show a Product default queries card with the number of queries and whether they're Enabled or Disabled for this connection. Open it to see the queries and their cadence, and use the switch to turn them on or off for this connection. These are separate from content packs, which you manage in Content library › Packs.

Packs that use this connection

If your organisation uses content packs, the connection page lists Packs that use this connection: each of your organisation's packs that reads from this connection's product, with how many of its items can run here. Click a pack to open it in Content library › Packs, where you can switch those items on or off.

A pack that needs this product but isn't available to your organisation isn't listed. Its items that need a source show Waiting for a source on the pack page until a matching connection exists.

Discovered Schema

Connections with a dynamic schema — for example object storage sources such as Amazon S3 or Azure Blob Storage — show a Discovered Schema card. Scout infers the tables and fields from the connection's content.

• The card shows the sync status (Syncing, Completed, Failed or Idle), Total Tables, Processed, Failed and Last Sync.
• Click Sync Schema to run discovery (or re-run it after new files land).
• Expand a table to see its fields and edit its description. Scout infers descriptions unless you edit them; an edited table is badged User Modified, and Discard user edits returns it to the inferred description after a confirmation.
• If discovery failed, the error appears under the card's notice; a table that could not be read shows its own error when expanded, and its description can still be edited.

Webhooks

The Webhooks card shows how many ingestion endpoints are active or paused on this connection and opens the Event Ingestion & Webhooks modal. See Webhooks (event ingestion).

Endpoint Control

Endpoint Control connections show a Your fleet card with the agent address, endpoint counts, Install the agent and View endpoints. See Endpoint Control.

Delete a connection

Scroll to the Danger Zone and click Delete Connection, then confirm. This permanently removes the connection and its associated data and cannot be undone.

Next steps

• All integrations — per-product setup: what to create in the vendor's console and which languages each serves
• Endpoint Control — install the endpoint agent and manage your fleet
• Webhooks (event ingestion) — push events from external products into Huntbase
• Data lake — bring your own Iceberg store, or ship logs straight to Huntbase
• Telemetry — whether each telemetry source is sending, and its ingest key
• Search telemetry — see the events your telemetry sources sent