Run a discovery

Use Run discovery to check a domain, host, IP address or email address right now, and optionally repeat the check on a schedule. One window does everything, in two modes: Simple and Advanced.

Before you start

You need access to the Discoveries page (it appears in the menu under Investigate). If you see an "activate Discovery" message instead, the module is not enabled for your workspace. Ask your Hunto contact.
Each run uses credits. One run costs the same whether it covers one target or fifty. The window shows the price before you click, along with your balance. See Credits and limits for Discovery.
Checks that read public sources are safe for any domain. Checks that connect to the target itself (marked Connects to the target) only run on your own domains and assets.

Open the window

Go to Discoveries.
Select Run discovery at the top right.

You can also arrive with the window already filled in. A link with ?target=example.com opens it with that target, and ?preset= or ?detective= opens it on a detective. The tabs on the page also accept ?tab=schedules, ?tab=runs or ?tab=detectives.

The window remembers the mode you used last.

Simple mode: one target, one detective

Use this for a quick check of a single target.

In Target, type a domain, host, IP address or email address. Hunto tells you what it recognises as you type:

You type	Hunto says
`example.com`	Domain. Gets a standard rating you can compare.
`www.example.com` or `api.example.com`	Host. Checked on its own.
`203.0.113.7`	IP address. Its exposed services and reputation.
`203.0.113.0/24`	Network range.
`https://example.com/login`	URL. The host it points at is checked.
`[email protected]`	Email address. Checked for leaks and breaches.
2. Under Detective, pick one card. Each card shows the detective name, how many checks it holds, and a short description. See Detectives for what each one does.

A card that is greyed out cannot take the target you typed. Hover over it to see why.
A card marked Connects to the target, your own domains only runs active checks.

If you have saved your own detectives, use Or one of yours to pick one.
Pick Repeat: Once, Daily, Weekly or Monthly.
Check the cost line at the bottom, for example "Costs 10 credits, 1,240 available". Then select Run discovery.

Note: Simple mode takes one target. If you type a list, the window asks you to use Advanced.

Advanced mode: many targets, hand-picked checks

Use this to cover several targets at once, or to choose exactly which checks run.

Where

Choose the scope with the switch at the top of the Where section.

Specific targets: type one target per line. One run covers up to 50 targets.
My assets: search your assets and tick the ones to cover. Nothing is preselected. Select shown ticks the assets currently listed (up to 50), and Clear empties the selection.

What to check

Use Start from to load a detective's checks as a starting point, or start from scratch.
Use Search checks to find a check by name.
Tick checks one by one, or tick a group heading to select the whole group. Checks are grouped by the part of the security rating they feed.
Read the tags:
- Connects to the target: the check contacts the target directly. It runs on your own domains and assets only.
- Needs ...: the check is locked because your plan or role does not include it. It cannot be ticked.

The counter shows how many checks are selected.

Repeat and options

Repeat: Once, Daily, Weekly or Monthly.
Re-check even if results are fresh: asks every check to run again instead of reusing recent results for the same target and check. Leave it off for the normal behaviour.

Note: Advanced mode always starts a new run. The 24-hour reuse described below applies to Simple mode.

Save as a detective

Tick Save these checks as a detective, type a name of at least 3 characters (for example "Mail and look-alikes") and run. The set appears under Yours the next time you open the window, and in the Detectives tab.

What happens when you start a run

A message appears at the top of the Discoveries page. There are four outcomes. The two "no charge" outcomes only happen in Simple mode.

Message	Meaning	Credits
Discovery started for ...	A new run began. The message shows the detective, the number of checks, the credits used and how often it repeats.	Charged
Reused a result from the last 24 hours	The same detective already finished a run on the same target in the last 24 hours, so Hunto shows you that result.	None
Already running for ...	The same run is in progress. No second run starts.	None
Discovery not started (red)	Something blocked it. The reason is shown, for example a target that does not look valid, or not enough credits.	None

Tip: To get a brand new run inside the 24-hour window, start it from Advanced mode with the same checks.

If some checks in a detective are not available yet, the started message says how many ("2 checks not available yet"). The run still goes ahead with the checks that exist, and the missing areas show as Not measured in the rating.

Select Open the run in the message to watch the run live. See Read a discovery run report.

When the Run button is disabled

Hover over the button to see why. Common reasons:

Reason shown	What to do
Type a target first.	Enter a target.
One target at a time here. Use Advanced for several.	Switch to Advanced.
That does not look like a domain, host, IP address or email address.	Check for typos or stray spaces.
Pick a detective.	Select a card.
The detective "does not take" this kind of target.	Pick a detective that accepts it, for example an email address works with Leaked credentials.
Not enough credits, Discoveries are paused, or Renewal unpaid	Use the Top up credits link. See Credits and limits for Discovery.
One run covers up to 50 targets.	Split the list across two runs.
Pick at least one asset, or Pick at least one check.	Make a selection.

Use cases and wiring tips

Onboard a domain baseline. Run Outside-in rating on your main domain in Simple mode, set Repeat to Weekly, then open the run report to see your starting grade.
Check a vendor. Run Outside-in rating on the vendor's domain. It is passive, so it is safe on a domain you do not own. Active checks are refused on domains that are not yours.
Cover many domains. In Advanced mode, choose My assets, select Select shown, pick a detective under Start from, and set Repeat.
Wiring. Targets you keep become assets (see them in Assets). Findings appear as potential detections that you can promote to detections, and the rating feeds your security score. See What Discovery finds and how to act on it.