Add your team's knowledge

Library › Knowledge is where your organization keeps its own reference documents for Scout: incident response runbooks, security policies, escalation paths, and notes about your environment (which subnets hold what, who owns which systems, which alerts are known to be noisy). Upload a document once and Scout uses it whenever it answers, next to Huntbase's curated guidance, and cites the exact section it relied on.

Use it so Scout's answers follow the way your team works. Ask "how do we contain a ransomware host?" and Scout quotes your runbook rather than generic advice. When your runbook and general guidance disagree, Scout says so and cites both.

Rolling out

Knowledge is currently rolling out and may not be enabled for your organization.

What you can upload

Format	Notes
Markdown (.md)	Headings become sections, so Scout can cite Containment in your ransomware runbook rather than the whole file. A top-level heading is suggested as the title.
Plain text (.txt)	Stored and searched as one body of text.
PDF (.pdf)	Huntbase reads the PDF's text layer and cites by page. Scanned documents (images of pages, with no text layer) and password-protected PDFs aren't supported.

Each file can be up to 5 MB, and a PDF up to 200 pages. Your organization can hold up to 500 documents.

Write documents for a person, not for Scout: short sections with clear headings get the most precise citations.

Add a document

1. Go to Library › Knowledge and click Upload document (or choose it from the Library's New button).

2. Drag a file onto the dialog, or click to choose one.

3. Fill in the details:

   Field	What it's for
   Title	How the document is shown in the Library and in Scout's citations.
   Description	Optional. A line about what the document covers.
   Category	Runbook, Policy, Environment, Reference or Other. Scout sees the category too, so it knows a runbook from a policy.
   Tags	Optional keywords for finding the document in the Library.
   TLP	How widely the document's content may be shared. Defaults to TLP:GREEN. See TLP markings.
   Who can use this	Everyone in the org, or Specific teams. See Restrict a document to teams.

4. Click Upload.

The document appears in the list straight away with the status Pending, then Processing while Huntbase reads and indexes it, then Ready. Scout can use a document once it's ready. The list updates on its own while documents are processing.

If the same file is already in your organization's knowledge, Huntbase tells you and points to the existing document instead of adding a copy.

When a document fails

A document whose status is Failed shows why:

Reason	What to do
The PDF has no text layer	It's a scanned document. Export it from the original application as a text PDF, or paste the text into a Markdown file.
The PDF is password-protected	Remove the password and upload it again.
Too many pages, or too much text	Split it into smaller documents, for example one per procedure.
Couldn't queue or process the document	Click Retry. If it keeps failing, contact support.

Restrict a document to teams

By default every member of the organization can read a document, and everyone's Scout can use it. To keep a document to the people who need it, choose Specific teams under Who can use this and pick one or more teams.

A team-restricted document is:

• listed and readable only by members of those teams (and by people who manage knowledge for the organization);
• used by Scout only for members of those teams. Scout labels it with the team, for example Your organisation · SOC Tier 2.

If every team a document was restricted to is deleted, the document is not opened up to the whole organization. Only people who manage knowledge can still see it, so they can choose new teams or delete it.

You can restrict a document only to teams you belong to, unless you manage knowledge for the organization.

Who can do what

To	Who
Read documents, download them, and have Scout use them	Every member of the organization (team-restricted documents: members of those teams)
Upload documents, replace files, edit details, retry	Members with Edit on Knowledge, through their role or a team
Delete a document you uploaded	Members with Edit on Knowledge
See every document, delete any document, restrict to any team	Organization admins and owners, and members with Manage on Knowledge

Uploading, replacing, editing and deleting are recorded in the access log.

View, update and delete a document

Click a document to open it. Its page shows the details, the extracted text by section, and its earlier versions.

• Download gets the original file you uploaded.
• Replace file uploads a new version. Scout keeps using the current version until the new one is ready, then switches to it. The old version stays in the history.
• Edit details changes the title, description, category, tags, TLP or teams. Who can find the document through Scout changes as soon as you save; the title and TLP on Scout's citations follow your edit too.
• Delete removes the document, its versions and everything Scout indexed from it. Scout stops citing it straight away. This can't be undone.

How Scout uses and cites your documents

Scout searches your organization's documents and Huntbase's curated guidance (CISA COUN7ER countermeasures and CERT/CC SSVC) together whenever it answers a security question. It also uses them in a hunt. To ask about knowledge directly, switch the Scout input to Knowledge mode or start your message with /knowledge. See Chatting with Scout.

When Scout relies on one of your documents:

• it says so ("your ransomware runbook says…") and puts a citation chip after the claim;
• the chip's card shows Your organisation (or the team), the section, the TLP marking and an Open document link that opens the document at the cited section;
• when your document conflicts with general guidance, Scout points out the difference and cites both, so you can decide.

Scout treats your documents as reference material. It never follows instructions written inside a document.

TLP markings

Every document carries a Traffic Light Protocol marking. It controls where the document's content may go, not who in your organization can read it (use teams for that).

Marking	Scout inside Huntbase	Claude connector
TLP:CLEAR, TLP:GREEN	Reads and cites it	Shared
TLP:AMBER	Reads and cites it	Shared only if an admin allowed TLP:AMBER for the connector
TLP:AMBER+STRICT, TLP:RED	Reads and cites it	Never shared

Scout can read and cite a document at any marking inside Huntbase. It never puts the content of a TLP:RED document into web search or other outside services.

Your knowledge in Claude

If your organization has turned on the Claude connector (Settings › [Organization] › Claude), Claude can search your knowledge too. It gets the same passages Scout would, each with its title, section, TLP marking and a link back to the document in Huntbase. A personal API key used for the connector needs the Knowledge: View scope.

The connector applies your TLP rules to every result. A passage that may not be shared comes back withheld, with only a link to open it in Huntbase. When Claude asks Scout a question and Scout's answer draws on a document that may not be shared, the whole answer is withheld and Claude is told to open it in Huntbase.

Next steps

• Chatting with Scout — Knowledge mode and citations
• Teams — create the teams you restrict documents to
• Roles — give people Edit or Manage on Knowledge
• Access log — see who changed which document