Hunt Modes

Available Modes

There are two hunt modes available to choose from in the platform. The first is Auto which is the default mode, the second is Interactive mode.

Auto

Auto mode is a flexible, autonomous hunting workflow designed for efficiency and speed. When you provide a clear hunting objective, the assistant independently executes the necessary steps—researching context, running investigations, refining queries, and following evidence trails—without requiring approval at each checkpoint.

How it works:

• You provide a hunting goal with sufficient scope (threat, platform, timeframe, indicators).
• The agent chains investigations and research autonomously to test hypotheses.
• Checkpoints occur only when clarification is needed or when final results are ready.
• You maintain control over deliverables (rules, findings) and can redirect at any time.

Best suited for:

• Experienced threat hunters who prefer rapid results
• Well-defined hunt requests with clear indicators and scope
• Exploratory analysis where tactical decisions can be delegated
• Situations where speed is prioritized over step-by-step visibility

Interactive Mode

Interactive mode will research and generate a hypothesis - but it will stop and look for more feedback from you throughout the hunt. For instance, before executing queries it will display the plan so you are able to make adjustments. This mode is geared towards someone more experienced or someone that wants to have more control over the hunt, and allows for better interaction with the agent for direction and flow of the hunt.

Deep Mode

Deep mode is a much more autonomous and in-depth hunting workflow designed for quality. Similar to Auto mode, you provide a clear hunting objective, and the assistant will perform the required steps for hunting. The main difference is Deep mode will perform far more steps to achieve its goal. This will take significantly more time than Auto mode.

This is limited to 3 Deep directives per day. It is available only via the API