Discovery use cases and wiring tips

Five recipes you can follow today, then a map of how Discovery connects to the rest of Hunto.

1. Onboard a domain baseline

Goal: know how a new domain looks from outside, and record it as the starting point.

Select Run discovery, enter the domain and choose Outside-in rating.
Open the run. Note the grade and the Top issues on the Overview tab.
Run Attack surface on the same domain to list hosts, addresses and exposed services. Review them in Footprint.
Run Email & DNS security to check spoofing protection.
In Findings, tick the issues you will act on and select Add N to detections.
Set Repeat to Weekly on the rating run so the next runs compare against this baseline.

The first run has no Changes tab because there is nothing to compare with. From the second run on, it shows what moved.

Goal: catch lookalike domains, phishing pages and leaks every week.

Run Brand & leaks on your main domain with Repeat set to Weekly.
Each week, open Potential Detections and filter Change by Anything new.
Work the list from Worst first. Use Accept for real impersonations, Not real for wrong results and Out of scope for things you will not act on.
Accepted findings become detections you can assign and track.

Tip: Add Lookalike domains as its own weekly schedule if the brand sweep is too broad for your team.

Goal: assess a supplier's public security posture before a review.

Run Outside-in rating Once on the vendor's domain. Only passive checks run, so it is safe on any domain.
Read the grade, the Sections tiles and Top issues.
Select Report (PDF) to share a summary.
Repeat before the next review. Use the Run switcher to compare.

Note: Only run Full sweep on domains and assets you own. It connects to the target.

Goal: make sure a finding gets fixed by someone.

In the run's Findings tab, or in Potential Detections, accept the finding.
Open the detection from In detections or All Detections.
Go to its Tasks tab and select New task. Assign an owner and a due date.
The task appears in the normal task queue. Close the detection when the work is done.

Goal: find out why a domain's grade fell.

Schedule Outside-in rating with Repeat set to Weekly.
When the grade falls, open the domain's rating History and select the run where it dropped.
Open that run's Changes tab. Chips New, Gone and Changed show what moved.
Check Top issues on the Overview tab for the largest deductions.
Add the cause to detections and create a task.

Module	Connection
Assets	Targets can be picked from your assets. Hosts and services a run finds are shown in Footprint. Use Go to Assets in the page header.
Detections	Accepted findings become detections. Import findings adds them automatically.
Incidents	Detections can be grouped into incidents in the normal way.
Tasks	A detection has a Tasks tab.
Notifications	Use your notification settings to be told about new detections and changes.
Reports	Report (PDF) on a run, and the "Digital risk & exposure assessment" from Runs.
Security score	The rating from Outside-in rating appears on Security Posture. Detections count in the score.
CLI, MCP and API	Start and read runs from a terminal, an AI assistant or your own code. See Drive Discovery from the CLI, MCP and API.

Choose the smallest detective that answers your question.
Set a schedule and review on a fixed day, so results are dealt with while they are fresh.
Keep a short list of domains as "watched", and use the Repeat filter on Schedules to see them together.
Keep track of Not measured sections. They tell you where the picture is incomplete.