Co-Hunter Instructions: teach Mars how your team hunts

Co-Hunter has become one of the most-used parts of the Mars platform. Analysts describe what they're after in plain language. Co-Hunter then plans and runs the investigation across every connected source, without ingesting or moving data. Teams use it to go from a threat intel report or a hunch to an answer backed by evidence, in minutes.

As usage grew, one request kept coming up: more control. Every hunter knows things no model can guess. Some examples:

• okta_system_log is the source of truth for identity.
• "The lab" means 10.90.0.0/16.
• A silent endpoint usually means a missing agent, not a clean host.

Until now, analysts had to repeat that context in every prompt.

What's new

Co-Hunter Instructions is standing guidance that Mars adds to every new Co-Hunter session. You find it under Settings, and it's organized into four sections:

• Data Sources & Naming: which tables Co-Hunter should check first, which source wins when two overlap, and the fields an outsider wouldn't think to read. For example, in Okta, trust client.device over a user_agent that can be spoofed.
• Investigation Workflows: your team's steps, in order: the systems only your team knows to check and what a hit there means.
• Team Vocabulary: your shorthand mapped to real data, so a question asked in your team's words reaches the right assets.
• Additional Instructions: rules that apply to every investigation, one per line. For example: "When reviewing EDR-related investigations, confirm an EDR is installed on that endpoint. Zero telemetry means no EDR until proven otherwise." "Always look for a change management ticket in ServiceNow when reviewing a DC sync event."

Sections you leave empty are skipped. You write in a working draft with a live preview, and when you publish, it becomes a version you can roll back to.

Why it matters

• Accuracy: Co-Hunter starts from your environment's real data and conventions, not generic assumptions.
• Consistency: every hunter's investigations follow the same team playbook, from a new hire to a senior hunter.
• Speed: you set the context organization wide, and every hunt uses it.

Instructions shape how Co-Hunter investigates, not what the report looks like. Report structure stays consistent so findings are always easy to compare.

Available now. Go to Settings → Co-Hunter Instructions, fill in the sections that matter to your team, and publish.