Huntbase Hub · Packs
Content packs.
The hunts on this hub are a sample. Inside Huntbase, packs bring the rest: scheduled detections, query libraries, compliance checks and the reports that go with them, switched on for your organisation in one step.
- 9,468queries
- 44detections
- 36hunts
- 139compliance checks
- 168integrations
Add-on packs
Switch these on for a focused programme: scheduled detections, hunts and the reports that go with them.
-
Sandbox · Enterprise · Service providerLocked
Identity Threats
Detect and hunt account takeover across Okta, Microsoft Entra ID and Google Workspace, the most common way attackers get in. Schedules detections for MFA fatigue, risky and impossible-travel sign-ins, OAuth consent…
249 queries3 detections26 hunts4 integrations1 report templateWorks with Microsoft Entra ID, Okta, Google Workspace, Google Directory
-
Every planLocked
AI Security
Find the AI tools, models, agents and MCP servers in use in your organisation, and hunt for AI misuse. Inventories MCP server configurations and running MCP servers, local LLM runtimes, AI coding assistants and AI…
126 queries1 detection10 hunts2 integrations1 report templateWorks with Huntbase Endpoint Control, Anthropic, OpenAI
Compliance packs
Checks mapped to a framework's controls, run on the sources you already connect, with hunting as evidence.
-
Every planLocked
ISO 27001
Device, identity, vulnerability and certificate checks mapped to ISO/IEC 27001:2022 Annex A controls, with threat-hunting evidence. Enabling the pack schedules these checks on your connected sources and reports against…
38 compliance checks1 framework -
Every planLocked
NIS2
Device, identity, vulnerability and certificate checks mapped to the NIS2 cybersecurity risk-management measures (Implementing Regulation 2024/2690), with threat-hunting evidence. Enabling the pack schedules these…
38 compliance checks1 framework -
Every planLocked
SOC 2
Device, identity, vulnerability and certificate checks mapped to the SOC 2 Trust Services Criteria, with threat-hunting evidence. Enabling the pack schedules these checks on your connected sources and reports against…
37 compliance checks1 framework -
Every planLocked
Cyber Essentials
Checks for the five Cyber Essentials technical controls: firewalls, secure configuration, user access control, malware protection and security update management. Enabling the pack schedules these checks on your…
26 compliance checks1 framework
In every account
What every Huntbase organisation starts with, before any add-on.
-
IncludedLocked
Cloud integrations
Product integrations and their query templates for cloud providers, container platforms and cloud file stores. Every organisation has it.
5,025 queries25 integrations -
IncludedLocked
Endpoint inventory
The Huntbase Endpoint Control integration and its osquery query templates for inventory, configuration and investigation on your endpoints, with entity extraction for their results. Every organisation has it.
862 queries1 integrationWorks with Huntbase Endpoint Control
-
IncludedLocked
Developer integrations
Product integrations and their query templates for source control, CI/CD and infrastructure-as-code tools. Every organisation has it.
640 queries12 integrations -
IncludedLocked
SaaS integrations
Product integrations and their query templates for collaboration, ticketing, on-call and GRC tools. Every organisation has it.
624 queries15 integrations -
IncludedLocked
Data platform integrations
Product integrations and their query templates for databases, data warehouses and lakehouses. Every organisation has it.
545 queries11 integrations -
IncludedLocked
Identity integrations
Product integrations and their query templates for identity providers, directories, and secrets and privileged-access managers. Every organisation has it.
451 queries16 integrations -
IncludedLocked
Network and email security integrations
Product integrations and their query templates for NDR, firewalls and secure networking, CDNs, DNS and domain registrars, and email security gateways. Every organisation has it.
274 queries12 integrations -
IncludedLocked
SIEM and log integrations
Product integrations and their query templates for SIEMs, log and observability platforms, and SOAR. Every organisation has it.
200 queries19 integrations -
IncludedLocked
Threat intelligence integrations
Product integrations and their query templates for threat intelligence platforms, enrichment and reputation services, and STIX/TAXII and MISP feeds. Every organisation has it.
151 queries16 integrations -
IncludedLocked
Vulnerability and posture integrations
Product integrations and their query templates for vulnerability scanners, cloud posture (CSPM/CNAPP) and code and container security scanners. Every organisation has it.
140 queries11 integrations -
IncludedLocked
Other integrations
Product integrations and their query templates for integrations that fit no other category. Every organisation has it.
103 queries6 integrations -
IncludedLocked
AI provider integrations
Product integrations and their query templates for AI model providers (Anthropic, OpenAI, Cohere; Amazon Bedrock, Vertex AI and Azure AI come with the AWS, Google Cloud and Azure integrations in the cloud pack). Every…
62 queries3 integrations -
IncludedLocked
Endpoint response
Built-in endpoint scripts for inventory, hardening, patching and incident response, and starter actions such as isolating and releasing an endpoint. Every organisation has it.
50 endpoint scripts11 response actionsWorks with Huntbase Endpoint Control
-
IncludedLocked
Huntbase detections
The built-in watchers: process and PowerShell detections, cross-product and kill-chain correlations, threat-intelligence matches and known-exploited vulnerability exposure. Every organisation has it; switch watchers on…
40 detections -
IncludedLocked
EDR, XDR and endpoint management integrations
Product integrations and their query templates for third-party EDR and XDR platforms and endpoint management tools. Every organisation has it.
16 queries15 integrations -
IncludedLocked
Huntbase core
The foundations every Huntbase organisation has: normalised surfaces, routing formats, insight normalisers, entity extraction, security frameworks, the built-in hunt report templates and the Huntbase documentation that…
2 report templates1 knowledge source8 frameworks -
IncludedLocked
Threat intelligence feeds
The shared threat-intelligence feeds every organisation gets: MITRE ATT&CK over TAXII and open blocklists of attacking, compromised and Tor exit IP addresses.
6 threat intel feeds -
IncludedLocked
Getting started
The first hunts onboarding suggests for a new organisation: exposed AWS identities, risky Okta accounts, and suspicious PowerShell, failed sign-ins and rare domains in your data lake.
5 playbooks -
IncludedLocked
Endpoint collection
File collection templates for gathering evidence from Windows, macOS and Linux endpoints through the Huntbase endpoint agent. Every organisation has it.
3 collection templatesWorks with Huntbase Endpoint Control
-
IncludedLocked
Security knowledge
Reference knowledge Scout can search and cite: CISA COUN7ER countermeasures and CERT/CC SSVC vulnerability decision guidance. Every organisation has it.
2 knowledge sources
Locked until you sign up
See what is inside.
Pack contents stay in the platform. Sign up free: the Sandbox plan includes the add-on packs, so you can try them on sample data before you connect your own.