Discovery

Detectives

A detective is a named set of checks. When you run a discovery you pick a detective to say what should be looked at. Hunto provides seven ready-made detectives, and you can save your own.

The detectives Hunto provides

Each one answers a question you would ask in plain words.

Detective Answers Takes Connects to the target?
Outside-in rating How does this domain look from outside, graded the way a vendor assessment sees it? Domain, host, IP address, email address, URL No. Passive, safe on any domain.
Attack surface What do we expose, and what is weak on it? Hosts, addresses, exposed services and their weaknesses. Domain, host, IP address, URL, code repository No.
Brand & leaks Who is impersonating us and what of ours has leaked? Lookalike domains, phishing pages, leaked credentials, exposed code or data. Domain, URL No.
Full sweep Everything we have, including port and protocol scans. Domain, host, IP address, URL, code repository Yes. Your own domains and assets only.
Email & DNS security Can someone send mail as this domain? SPF, DKIM and DMARC policy, and DNS zone hygiene. Domain, URL No.
Leaked credentials Are credentials for this domain or address in breaches, stealer logs or leak dumps? Domain, email address, URL No.
Lookalike domains Which look-alikes of this domain are registered, and is any serving a phishing page? Domain, URL No.

The first four are broad. The last three are focused, which makes them quicker and easier to read.

Note: A URL is checked as the host it points at.

Which one should I use?

Situation Pick
First look at a domain, or a vendor Outside-in rating
Mapping what you expose Attack surface
Watching for impersonation Brand & leaks, or Lookalike domains for that alone
Checking mail spoofing protection Email & DNS security
Checking whether an employee address was breached Leaked credentials with the email address as the target
A deep check of your own domain Full sweep

What "Takes" means

If the target you typed is not one a detective accepts, its card is greyed out with the reason on hover. For example, Email & DNS security does not take an IP address.

How the checks in a detective are chosen

A detective is a rule, not a frozen list. If Hunto adds a new check that fits, for example a new lookalike source, it joins the detective automatically. Outside-in rating uses the checks behind the published scoring method. If a check the method names is not available yet, that area shows Not measured in the rating, and the started message says how many checks are "not available yet".

Your plan can limit which checks are available. A check your plan does not include appears as Needs ... and cannot be ticked.

Your own detectives

Save one from a run

  1. Select Run discovery and switch to Advanced.
  2. Tick the checks you want.
  3. Tick Save these checks as a detective and type a name of at least 3 characters.
  4. Run. The detective appears under Yours in the run window and in the Detectives tab.

A saved detective keeps exactly the checks you chose. It does not grow when new checks are added.

Create one in the Detectives tab

Available with the flow library permission.

  1. Open Discoveries, then the Detectives tab.
  2. Select Create your own.
  3. Fill in the form:
Field Meaning
Name 3 to 50 characters, unique in your workspace. Hunto shows whether the name is free. Use Randomize name & avatar for a suggestion.
Goal of the detective A note for your team, up to 300 characters.
Checks selection The scan keywords that pick the checks. At least one is required, and each must match at least one check.
Asset Types or chosen assets What the detective monitors.
Max depth How many follow-up rounds (1 to 10, default 3).
Max fan-out How many new targets one check may add (1 to 5000, default 500).
When something is filtered Tag it, keep it (recommended) or Discard it.
Minimum confidence Hides findings below this confidence (0 to 1).
Maximum degree Limits how far removed from your own assets a finding can be.
Exclude wildcard-synthesized hosts Drops made-up hosts from wildcard DNS.
4. Optionally select Customize Avatar to choose a style and colours.
5. Select Save Detective. You return to Discoveries with the run window open on your new detective.

Tip: Keep Tag it, keep it selected. A discarded finding looks the same as one that was never produced, which makes problems harder to spot.

Edit or retire one

  • Select a detective, then the pencil (Edit Detective). Only your own detectives can be edited. The seven Hunto detectives cannot.
  • Editing does not affect a run already in progress.
  • You cannot delete a detective from the page. Ask support to retire one. A detective still used by an active schedule cannot be retired.

Use cases and wiring tips

  • Weekly brand-abuse sweep. Schedule Brand & leaks on your domain with Weekly.
  • Onboard a domain baseline. Start with Outside-in rating, then add Attack surface for the hosts behind it.
  • A team-specific set. Save a detective called "Mail and look-alikes" with the email and lookalike checks and reuse it across domains.
  • Wiring. A detective decides which findings arrive in Potential Detections, and which sections of the rating are measured.