Content packs
A content pack is a named, versioned set of Huntbase content that belongs together: the products it needs, query templates and scheduled inventories, watchers, hunt playbooks, report templates, evidence collections, compliance checks and the knowledge Scout cites. Instead of switching on dozens of items one by one, you enable a pack, choose how much of it runs, and Huntbase sets it up for your organisation. When the pack gets a new version, Huntbase updates it for you and keeps your changes.
Packs live in Library › Packs. Each pack has its own page that shows what it contains, what it runs for your organisation, which sources it needs and who publishes it.
Content packs are currently rolling out and may not be enabled for your organisation. Where they aren't enabled, there's no Packs section in the Library.
Kinds of pack
| Kind | Packs | How it's switched on |
|---|---|---|
| Built-in packs | Huntbase core, the integration packs (one per product category, such as Cloud, Identity, SaaS, EDR and XDR, SIEM and logs, Network and email security, Developer, AI providers, Threat intelligence and Vulnerability), Huntbase detections, Threat intelligence feeds, Security knowledge, Getting started, and Endpoint inventory, Endpoint response and Endpoint collection | Always on. Together they hold the content every organisation gets, and can't be disabled. |
| Compliance framework packs | SOC 2, ISO 27001, Cyber Essentials and NIS2 | Available to every organisation. Enabling one enables that framework's compliance package, and disabling it disables the package. |
| Optional packs | AI Security (see AI Security pack) and Identity Threats (see Identity Threats pack) | Huntbase makes the pack available to your organisation, then an organisation admin enables it. |
The compliance framework packs and the compliance packages are the same thing seen from two places. Enabling a package in Library › Compliance shows its pack as enabled, and enabling the pack enables the package. Either way, the result appears on the Compliance pages.
The built-in packs replace the earlier Core and Endpoint Essentials packs. They are a map of what Huntbase already gives every organisation, grouped by what the content does: core holds the shared foundations (normalised data surfaces, entity extraction, security frameworks, report templates), each integration pack holds a category of products and their queries, and the endpoint packs hold the Huntbase endpoint agent's queries, scripts and actions, and collection templates. You manage their items where you always have: watchers on the Watchers page, compliance in Library › Compliance, and query synchronisation on each connection. In a built-in pack, items are read-only and say where they're managed.
What's in a pack
A pack page's Contents tab groups items by kind:
| Kind | What it is | Runs on its own? |
|---|---|---|
| Products | The integrations the pack's content reads from, such as Anthropic or Endpoint Control | No |
| Query templates | Queries in the Library. Inventories and scheduled queries can run on a schedule | Scheduled ones, once switched on |
| Watchers | Standing rules over your data. A watcher that matches generates a detection | Yes, once switched on |
| Compliance checks | Checks mapped to framework controls | They follow their compliance package |
| Hunt playbooks | Reusable hunts | No, only when someone starts one |
| Report templates | Layouts for hunt reports | No, used when a hunt is written up |
| Evidence collections | Sets of files and artefacts to collect from endpoints | No, only when someone starts one |
| Knowledge | Reference material Scout can cite | No |
| Surfaces, extraction and vocabularies | How the pack's data is normalised and tagged | No |
The same item can belong to more than one pack. A compliance check shared by SOC 2 and ISO 27001 is the usual case.
Enabling a pack doesn't hide or add anything in the Library: everything a pack holds is already there for your organisation to browse and use. Enabling decides what runs.
Open a pack
Go to Library › Packs and click a pack. Its page has five tabs:
| Tab | What it shows |
|---|---|
| Overview | What the pack is for, what enabling it runs for your organisation, the sources it needs (Needs these sources) and the packs it's built on (Built on) |
| Contents | Every item, grouped by kind, with a switch and a ⋯ menu on each item that can run (once the pack is enabled) |
| Changelog | The pack's versions and when each was published |
| Licence and trust | The pack's licence, any third-party content it includes, who publishes it, and what it may do |
| Access | Who can manage the pack. See Who can manage a pack. |
The line under the pack's title says whether it's Enabled or Disabled for your organisation. Built-in packs read Built in · always on.
Available and enabled
An optional pack goes through two steps before it runs:
- Available. Huntbase makes the pack available to your organisation. Compliance framework packs are available to everyone.
- Enabled. An organisation admin enables it and chooses what runs.
What runs is what's in packs that are both available and enabled.
If a pack isn't available to your organisation yet, its card in Library › Packs shows Not available, and its page says Ask your Huntbase administrator to make this pack available, with no button. You can still open the pack and read what it contains. To get it, contact Huntbase.
Enable a pack
You need to be an organisation admin, or have Content packs: Manage for this pack (see Permissions by pack). Packs are enabled per organisation, so choose the organisation in the Scope selector first.
-
Open the pack in Library › Packs and click Enable. You can also click Enable on its card.
-
Choose what runs. The first time you enable a pack, pick a preset:
Preset What it switches on Recommended (default) The items the publisher recommends running, usually the pack's watchers and scheduled inventories Everything Every item in the pack that can run Library only Nothing runs. You can switch items on later. As you choose, the preview shows how many watchers, scheduled queries and compliance packages the preset turns on, which of your connections they'll run on, and roughly how many runs a day that adds up to.
-
Click Enable pack.
The pack shows as enabled in Library › Packs and in Settings › [Organization] › Content packs.
If you enable a pack again after disabling it, there's no preset to choose: the items you had switched on start running again, with your customisations.
Settings › [Organization] › Content packs also lists packs that are available but not enabled, under Disabled · available to enable, each with an Enable button. Enabling from there uses the Recommended preset on a first enable. To pick another preset, enable the pack from its page.
What enabling runs
| Item | When the pack is enabled and the item is on |
|---|---|
| Watchers | Switched on for your organisation, the same as switching them on from the Watchers page |
| Scheduled inventories and queries | Scheduled on each of your connections that can run them. See Schedules. |
| Compliance packages | Enabled, and their checks are scheduled. Results appear on Compliance › Overview. |
| Hunt playbooks, report templates, evidence collections, knowledge | Nothing runs. They're in the Library and are used only when someone starts a hunt or collection. |
When you add a connection later, the enabled packs that can use it set up their schedules on it.
Disable a pack
- Open the pack and click Disable.
- The dialog shows how many items that run for your organisation will pause. Click Disable pack.
Everything the pack switched on pauses: watchers stop and schedules are paused, not deleted. Your item switches and customised items are kept, and enabling the pack again brings them back. Detections, findings and hunt results the pack produced stay. While a pack is disabled, its Contents tab shows every item as off, and you can't switch items on or customise them.
You can't disable a built-in pack. Disabling a compliance framework pack disables its compliance package, and its last results are kept.
If Huntbase stops making a pack available to your organisation, the pack stops running in the same way. Its content stays in your Library, and so do its results.
Switch items on and off
When a pack is enabled, its Contents tab shows a switch on every item that can run: watchers and scheduled queries. Turn an item off and Huntbase stops running it for your organisation. Turn it on and it starts again. Switching a scheduled query off pauses its schedules rather than deleting them.
Switches appear only on enabled optional and compliance packs. In a built-in pack, items say where they're managed instead. In a compliance framework pack, the checks follow their package.
An item that can't run for your organisation yet shows Blocked and Can't run: with the reason, for example a watcher Huntbase hasn't made available to your organisation. Blocked items aren't counted in what the pack runs. If an item shows Not started yet. Switch it off and on again to start it. once it's no longer blocked, do that.
Customise pack items
You can change how a pack's items run for your organisation without copying them. Your changes are a layer on top of the pack: they apply to your organisation only, and they're kept when the pack updates.
On the Contents tab, open the ⋯ menu beside an item's switch and choose Customise….
| Item | What you can change |
|---|---|
| Scheduled queries and inventories | Schedule: Follow the pack, a preset (every hour, 2, 6 or 12 hours, daily at 06:00 UTC, weekly) or a Custom cron expression (five fields, in UTC, no more often than every 5 minutes) |
| Watchers | Hunt mode (Guide, Collaborator or Operator), Severity, and When it matches |
Click Save. The item shows a Customised chip, and a customised schedule reads, for example, Every 12 h (customised). Choosing Follow the pack for a field drops your change to it.
You can also change a pack item where you normally would: a watcher on the Watchers page, or a schedule's timing or parameter values on the Schedules page. Huntbase notices the change and keeps it as your customisation, so a pack update never overwrites it silently. Settings › [Organization] › Content packs lists these changes under the pack, for example Local LLM Runtimes: default schedule changed in a schedule.
Compare with pack
Choose Compare with pack from the item's ⋯ menu to see, field by field, what the pack ships beside what runs for your organisation. Fields you haven't changed read Same as pack.
Reset to pack
Choose Reset to pack from the ⋯ menu and confirm. Your changes to the item are dropped, and it follows the pack again, including future updates.
Your own copies
If you duplicate or fork pack content, such as a hunt playbook or a query template, the copy is yours. It shows Based on the pack item and the version it came from, and it doesn't follow pack updates.
Updates
Huntbase publishes new versions of packs. Each pack's Changelog tab says what changed in each version.
Update policy
Each enabled pack has an update policy, set in Settings › [Organization] › Content packs:
| Policy | What happens |
|---|---|
| Patch releases automatically (default) | Fixes install automatically. New features and breaking changes wait for review. |
| All non-breaking releases automatically | Patch and minor releases install automatically. Major versions still wait for review. |
| Review every update | Nothing changes until someone who can manage the pack applies the update. |
The Default update policy card on the same page sets the policy new packs start with. Change one pack's policy on its row.
Automatic updates only apply changes that don't clash with your customisations. Anything that needs a decision waits for review, whatever the policy.
Pin a pack to stop every update, automatic or reviewed, and keep it on its current version. Pinned packs show Pinned. Click Unpin to take updates again.
Review an update
When a new version is waiting, the pack page shows a banner, for example AI Security 1.1.0 is available (you're on 1.0.0), with Review update. The pack's card in Library › Packs shows Update to 1.1.0, and its row in Settings shows 1.1.0 available.
Click Review update. The review screen shows how the update treats each item:
| Count | What it means |
|---|---|
| Update automatically | Items you haven't changed. They take the new version. |
| Merge cleanly with your changes | Items you customised where the pack changed a different part. Both changes are kept. |
| Need your choice | Items where you and the pack changed the same part, and customised items the pack removes |
| New items · removed items | New items follow the preset you chose when you enabled the pack. Removed items you hadn't changed stop running. |
Applied for you lists the items that need no decision.
For each item where you and the pack changed the same part, a card shows Yours (with your changes) beside the pack's new version, and you choose:
- Use suggested merge: Huntbase combines the two. You can edit the suggestion before you apply it.
- Keep mine: your version stays.
- Take 1.1.0 (drops your change): the pack's new version replaces yours.
For each item you customised that the new version removes, choose:
- Keep as my own: it keeps running as your organisation's own item and no longer follows the pack.
- Remove it: it stops running.
Click Apply update. The button shows how many choices are left, for example Apply update (1 to decide), and stays disabled until you've made them all. Not now returns to the pack without changing anything. Nothing you changed is ever deleted without asking.
Roll back
To go back to an earlier version:
- In Settings › [Organization] › Content packs, click Roll back on the pack's row.
- Choose the version to go back to.
- Confirm Roll back to that version.
The pack's items run as they did in that version, and your customisations are kept. Detections, findings and hunt results stay. If you don't want the pack to move forward again straight away, pin it or set its policy to Review every update.
Sources a pack needs
Most packs need data from particular products. The Overview tab lists them under Needs these sources, with Connected next to each one you have. Click Connect next to a missing one to create a connection for it. When a pack lists several sources, any one of them is enough to start, and each one adds what it can see.
You can enable a pack before you connect its sources. Items that need a source you haven't connected show Waiting for a source. They start on their own once you connect one.
Where a Library item came from
A Library item that belongs to a pack shows where it came from, for example From AI Security, on its detail panel, with a link to the pack. An item in several packs lists each one. A customised item shows Customised there too.
Packs elsewhere in Huntbase
- Settings › [Organization] › Content packs lists the organisation's packs, their versions and what they run, with update policy, pinning and rollback. See Organization management.
- A connection's page lists Packs that use this connection. See Connections.
- Scout can find hunt playbooks and list your organisation's schedules, including which come from packs. See Scout and the Library.
Permissions by pack
Who can do what with packs comes from the Content packs capability in your organisation's roles and team access:
| Level | What it allows | Who has it by default |
|---|---|---|
| View | Browse packs and open pack pages | Every member |
| Manage | Enable and disable packs, switch and customise items, review and apply updates, change the update policy, pin and roll back | Owners and admins |
Making a pack available to your organisation is done by Huntbase, not by your organisation's admins.
Limit to packs
On a custom role or a team's access, a Content packs: Manage row can be limited to particular packs. Tick Limit to packs and choose the packs; leave it unticked for Every pack. People with that role or on that team can then manage only the packs you chose. For example, give your identity team Content packs: Manage limited to Identity Threats, so it can tune and update that pack without changing AI Security.
Only optional packs appear in the list. Limit to packs controls who can change a pack, not who can see it: everyone with View still sees every pack's page and contents.
Who can manage a pack
A pack's Access tab lists who can manage it:
- Organisation admins: owners and admins manage every pack.
- Roles and Teams that give Content packs: Manage on this pack, with their members. Each one says Every pack or Limited to packs.
If you can only view a pack
Without Manage on a pack, you see its page, contents, changelog and update review, but the switches, Enable / Disable, Customise…, Reset to pack and Apply update are unavailable. The page says You can view this pack; ask an organisation admin for access.
Licences and trust
The Licence and trust tab shows the Pack licence, any Third-party content the pack includes with its own licence, the Publisher, and What it may do: for example, run read-only queries, or propose endpoint actions that ask for approval before they run.
In this release every pack is published by Huntbase. Signed packs, and packs from partners and the community, will come in a later release.
Next steps
- AI Security pack — find the AI tools, models and MCP servers in use
- Identity Threats pack — detect and hunt account takeover
- Compliance — read the results of a compliance framework pack
- Watchers — tune the watchers a pack switches on
- Schedules — see the schedules a pack creates
- Roles — give people Content packs: Manage