Discovery troubleshooting and FAQ
Find your symptom, check the likely cause, and follow the fix.
A run did not start
| What you see | Likely cause | Fix |
|---|---|---|
| Run discovery is disabled | No target, no detective, or the target is not one the detective accepts | Hover the button for the reason. Choose a detective that takes your target type. |
| A detective card is greyed out | It does not accept the target type, for example an IP address for Email & DNS security | Pick another detective or change the target |
| Not enough credits | Balance is lower than the run cost | Select Top up credits |
| "Discoveries are paused" | Discovery is locked for your organisation | Contact your administrator or support |
| "Renewal unpaid" | Your plan renewal is outstanding | Pay the renewal and try again |
| "Already running" | The same detective is already working on this target | Open that run. It is free. |
| The window opens an existing run | A Simple run of the same detective and target finished in the last 24 hours | Open it, or use Advanced to start a new run |
| A scheduled run did not fire | Credits too low at that moment, or the previous run of the schedule was still going | Top up. The next due time tries again. |
A run is slow or stuck
- Runs of Attack surface, Brand & leaks and Full sweep go several rounds deep and take longer than a focused detective.
- A run with no progress for more than an hour shows stuck. Select Refresh. If nothing changes, select Stop run. Finished work is kept and rated from what was completed.
- Pause holds new checks. Use Resume to continue.
A run finished but found little
- Check the header counts. A high number of failed or not-run checks means the picture is incomplete, not that you are clean.
- A rating section that says Not measured could not be checked. It is not shown as clean.
- A domain with little public exposure may honestly have few results.
- Try a broader detective, or use Advanced and tick more checks.
- Check your plan. Checks your plan does not include show Needs ... in the run window.
Results are wrong or too many
- Use Not real for wrong findings and Out of scope for real ones you will not act on. Pick the closest reason. Repeats of the finding are closed with it.
- Raise Minimum confidence in a detective you created to hide weak findings.
- Set Maximum degree to keep findings close to your own assets.
- Lower Max fan-out if runs grow too large.
I do not see something I expected
| Question | Answer |
|---|---|
| Where are my findings in All Detections? | Findings are not added to detections automatically. Accept them from the run report or Potential Detections. |
| Why is the Changes tab missing? | It is hidden on the first run of a schedule. |
| Why is History missing? | It shows only when you open the page from a domain's rating. |
| Why is there no Detectives tab? | It needs the flow library permission. Ask your administrator. |
| Why can I not edit a detective? | The seven Hunto detectives cannot be edited. Only your own can. |
| Why is a discovery page missing from my menu? | Discovery is part of the Monitoring module. Ask your administrator to check your access. |
| Why is there a Repeat menu on some runs only? | It shows only for runs that belong to a schedule. |
Import problems
| Message | Fix |
|---|---|
| Rows refused because of the target | The target must be one of your organisation's domains |
| Rows refused because of the classification | Use a classification Hunto recognises |
| A phishing finding on your own domain is refused | It cannot be an impersonation of your own domain. Use a different target or classification. |
| "Nothing was imported." | Every row was refused. Review the reasons in the preview. |
| The file is too large | A file holds up to 5,000 rows. Split it. |
FAQ
Does Discovery attack my systems? No. Every detective except Full sweep only reads public information and never connects to your target. Full sweep connects, and only to your own domains and assets.
Is a person checking results before I see them? Findings come from automated checks and are yours to review. You decide which become detections.
Can I run Discovery on a domain I do not own? Yes, with the passive detectives, such as Outside-in rating for a vendor. Full sweep is for your own assets only.
How often should I run it? Weekly for most domains. Monthly for vendors. See Schedules and repeating discoveries.
Do repeat runs cost credits? Yes, each run does. See Credits and limits for Discovery.
Can I delete a detective? Not from the page. Ask support. A detective used by an active schedule cannot be retired.
Does accepting or dismissing change my rating? Not the rating of the run it came from. Adding findings to detections does not change that run's rating either.
How do I stop a schedule? Open a run of it and set Repeat to Off.
Can I use Discovery from a script or an AI assistant? Yes. See Drive Discovery from the CLI, MCP and API.
Use cases and wiring tips
- Runs that keep failing. Compare the failed count across runs. If the same checks fail every time, tell support the run link so it can be investigated.
- Noise after onboarding a domain. Do one triage pass in Potential Detections, dismissing with reasons, then let the schedule run. Later runs only show what is new.
- Getting help. Include the run link (its address contains the run id), the target, the detective and the time.