Detectives
Detectives
What Are Detectives?
Detectives are your automated scanning agents in Hunto. Think of them as digital investigators you create, customize, and deploy to continuously monitor your brand's online presence.
Each Detective has:
- A unique name and avatar — making them easy to identify at a glance
- Scan categories — the types of searches it performs (e.g., phishing, domain monitoring)
- Asset focus — the kind of assets it monitors (domains, IPs, emails, etc.)
Once created, you attach a Detective to a schedule, and it runs automatically at the frequency you choose.
Getting Started
Creating a Detective
- Navigate to Discovery → Detectives
- Click Create Detective
- Fill in the configuration (see sections below)
- Click Save Detective
After saving, you'll be prompted to create a schedule for your new Detective right away.
What You'll Configure
| Setting | What It Does |
|---|---|
| Name | A unique identifier for your Detective (minimum 3 characters) |
| Avatar | A visual icon — choose from 8 styles and customize colors, features, and more |
| Description | An optional note to remind you what this Detective is for |
| Scan Keywords | The categories of scans this Detective will run (at least 1 required) |
| Asset Target | What the Detective monitors — either an asset type (like "Domain") or specific assets |
| Tags | Optional keywords to help you organize your Detectives |
Naming Your Detective
Every Detective needs a unique name. You have two options:
- Auto-generate: A random name is suggested when you create a new Detective (e.g., "Shadow Hawk", "Quantum Oracle", "Crystal Sentinel"). Click the randomize button to get a new suggestion.
- Choose your own: Type any name you like (3–50 characters). The system checks availability in real time — you'll see a green checkmark when the name is available, or a warning if it's already taken.
Customizing the Avatar
Each Detective gets a unique visual avatar. You can customize it in the Avatar Editor:
- Pick a style — Choose from 8 distinct visual styles (cartoon characters, robots, geometric designs, and more)
- Customize features — Each style has its own set of options (hair, eyes, accessories, clothing, etc.)
- Set a background color — Pick from the color palette or use transparent
- Flip — Mirror the avatar horizontally if you prefer
- Randomize — Click to generate a completely new random look
Your Detective's avatar appears throughout the platform — in the gallery, profiles, and schedule views — so make it distinctive.
Choosing Scan Keywords
Scan keywords determine what your Detective searches for. These are tags associated with the platform's scanning tools (flows).
- Browse the available keywords in the keyword picker
- Use the search bar to filter keywords
- Select at least one keyword (you can select as many as you need)
- Each keyword activates a corresponding set of scans
Examples of scan keywords: phishing, domain monitoring, brand abuse, social media, dark web, typosquatting, etc.
Tip: Selecting more keywords means your Detective will run more scan types, giving broader coverage. Selecting fewer keywords creates a more focused, targeted scanner.
Setting Asset Targets
Your Detective needs to know what to scan. There are two targeting modes:
Option A: By Asset Type
Select a category, and the Detective will scan all assets of that type in your organization.
| Asset Type | What It Covers |
|---|---|
| Brand | Your brand entities |
| IP | IP addresses in your inventory |
| Domain | Domain names you're monitoring |
| Email addresses | |
| URL | Specific URLs |
| Keyword | Custom keywords |
| Product | Product names |
Option B: Specific Assets
Switch to table mode to hand-pick individual assets. Use search and filters to find the exact assets you want this Detective to monitor.
Note: You must choose either an asset type OR specific assets — not both.
The Detective Gallery
The Detectives page shows all your Detectives in a visual gallery. Each Detective card displays:
- Avatar and name
- Whether it's a System detective (platform-wide) or Organization detective (your org only)
- Description preview
- Asset type indicator
- Scan keyword badges
Click any Detective to open its profile on the right side.
Detective Profile
The profile view shows everything about a Detective:
Details
- Full name and avatar
- Who created it and when
- Description
- Asset type and scan keywords
Statistics
Your Detective tracks its performance over time:
| Metric | What It Means |
|---|---|
| Active Schedules | How many schedules are currently using this Detective |
| Intel Generated | Total intelligence items found |
| Detections | Items confirmed as real threats |
| Total Runs | How many times the Detective has executed |
| Conversion Rate | Percentage of intel that became confirmed detections |
| False Positive Rate | Percentage of results that turned out to be non-threats |
Execution Details
- When the Detective last ran
- Whether the last run succeeded or failed
- Success/failure history
- Duplicate findings count
Working with Schedules
Detectives come to life when attached to a schedule. Here's how:
- Go to Discovery → Create Schedule
- Step 1: Choose how often the Detective should run:
- Once — Run a single time
- Daily — Run every day
- Weekly — Run once a week
- Monthly — Run once a month
- Step 2: Pick a Detective from the gallery
- Confirm and create
The schedule will automatically trigger your Detective at the chosen frequency. The Detective resolves its scan keywords into actual scanning tools, targets the configured assets, and executes.
Editing a Detective
- Open the Detective gallery
- Click the Detective you want to edit
- In the profile pane, click Edit
- Modify any settings — name, avatar, keywords, asset targets, description
- Click Save Detective
Note: You can only edit Detectives that belong to your organization. System-wide Detectives are read-only for regular users.
Deactivating a Detective
If you no longer need a Detective:
- Open its profile
- Click Deactivate
Important: A Detective cannot be deactivated if it's currently attached to an active schedule. You'll need to remove or disable those schedules first.
Deactivation is a soft action — the Detective is marked inactive but not permanently deleted.
System vs Organization Detectives
| Type | Who Creates Them | Who Can See Them | Who Can Edit Them |
|---|---|---|---|
| Organization | Any user with Discovery access | Your organization only | Your organization |
| System | Platform administrators only | All organizations | Platform administrators only |
- System Detectives appear in every organization's gallery with a "System" badge. They provide standardized scanning configurations that work across the platform.
- Organization Detectives are private to your org. Only members of your organization can see and manage them.
Tips & Best Practices
- Name meaningfully — Use descriptive names like "Domain Phishing Scanner" instead of generic ones, so your team knows what each Detective does at a glance.
- Start focused — Begin with fewer scan keywords targeting your most critical assets, then expand coverage as you review results.
- Review statistics regularly — Check your Detective's conversion rate and false positive rate. A high false positive rate may mean the scan scope is too broad.
- One Detective per purpose — Rather than creating one Detective that does everything, create specialized Detectives for different monitoring goals (e.g., one for phishing, one for brand abuse).
- Use descriptions and tags — Help your team understand each Detective's purpose with clear descriptions and organizational tags.
- Plan your schedule frequency — Daily scans for high-priority threats, weekly for routine monitoring, monthly for broad sweeps.
Frequently Asked Questions
Q: How many Detectives can I create?\nThere is no fixed limit. Create as many as your monitoring strategy requires.
Q: Can I use the same Detective in multiple schedules?\nYes. A single Detective can be attached to multiple schedules with different frequencies.
Q: What happens if I edit a Detective that's attached to a running schedule?\nThe changes take effect on the next scheduled run. Currently running executions use the configuration as it was when they started.
Q: Why can't I deactivate my Detective?\nIt's likely attached to one or more active schedules. Remove the Detective from those schedules first, then deactivate.
Q: I see Detectives I didn't create in my gallery. Where did they come from?\nThose are System Detectives created by platform administrators. They're available to all organizations and cannot be edited by regular users.
Q: Can I duplicate a Detective?\nThere's no one-click duplicate option, but you can create a new Detective and configure it with the same settings.