HUNTS HUB N
Centralizing hunt management with a brand new feature.
Mars is an AI-driven threat hunting platform that converts threat intelligence into executable hunts and detections, seamlessly integrated with your existing security stack. The project focused on designing a centralized hub where Threat Hunters, Detection Engineers, and CISOs could track, run, schedule, and review every hunt - from active investigations to historical results. Built entirely from scratch (with the help of Figma Make and Claude Design) the goal was to create a more informative and engaging experience that improved how users manage input and output across their hunting workflow.
DATE
2026
ROLE
UX/UI Prototyping Discovery Research IA
TEAM
CTO Head of ProductProduct Designer
TOOLS
Figma Claude Balsamiq
Problem Statement
There was no single place to see or manage hunts, which meant the platform's actual hunt capabilities stayed hidden behind layers of navigation most users never bothered to dig through. Viewing a single hunt's details took four clicks and three screens - buried inside the Intel Feed, a campaign card, then finally the “Hunt Results” tab.
The main objective was to create one place for hunts to live. The goals were: give users a clear view of their hunt history, and a way to manage hunts directly. Beyond that, the feature needed to work as a showcase - surfacing the depth and breadth of what the platform could actually do around hunts, which was otherwise hidden in the product's structure.
We built a standalone feature that consolidates all hunt settings and choices into one unified command center. It highlights platform strengths that were previously hard to discover, while laying the groundwork for scalability and giving users more confidence and control over their hunts.
Before: 3 screens
After: 1 hub
We analyzed existing hunt data and saw early signals of slowing engagement with significant drop-off points across the flow. To dig into why, I partnered closely with our Product Manager, leadership, and Chief Architect to bring in design-partner insights, conducted competitive analysis, reviewed user recordings, and analyzed how comparable features were handled in the market. The discovery process surfaced three core frustrations we needed to implement during design.
Pain Points
Missing depth
Because hunts are inherently complex with many moving parts, the existing hunt experience was missing capabilities. Users needed to get a detailed, nuanced view of what was actually happening inside a hunt.
Scalability
Well before users started hunts, the experience risked becoming unmanageable due to exponential hunt volume - from hundreds today toward hundreds of thousands in the future - there’d be no way to condense and minimize the chaos.
Motivation
Users regularly hit dead ends trying to find relevant hunt details, which killed engagement in the moment, caused drop-offs, and left them frustrated with the product.
Serving two different audiences
Rather than splitting the Hunts Hub into separate features, I proposed a single screen with two views: a Table view built for Threat Hunters and Security Analysts who'd work with the data and investigate, and a Dashboard view built for CISOs and CTOs who'd primarily view the high-level hunt activity - giving the product a new UI component to motivate and engage all our users.
Deliberate control capability
Solving for "missing depth" meant getting specific about how threat hunters actually work, not just adding more unclear controls. I defined filter and sorting capabilities so hunters could quickly see and adjust exactly which sources they were investigating, like most relevant hunts to most prioritized, so a user could immediately tell whether a suspicious hunt needed action - turning a dense table into something a hunter could actually triage from, instead of just browse.
Rather than splitting the Hunts Hub into separate features, I proposed a single screen with two views: a Table view built for Threat Hunters and Security Analysts who'd work with the data and investigate, and a Dashboard view built for CISOs and CTOs who'd primarily view the high-level hunt activity - giving the product a new UI component to motivate and engage all our users.
Navigating ambiguity and purpose
Deciding whether Hunts Hub should focus on archiving hunts or managing them was a main misalignment among stakeholders. I stepped in to help mediate by flagging that without aligning on intent, we risked shipping something that satisfied neither use case and left both types of users underserved. In order to hit development deadlines without forcing a premature decision, I suggested we use an existing design system tab component by splitting the Table view into History and Scheduled to let both intents coexist. This would give hunters a dedicated space for past activity and a separate one for what's ahead, rather than compressing both into a single cluttered view.
Deciding whether Hunts Hub should focus on archiving hunts or managing them was a main misalignment among stakeholders. I stepped in to help mediate by flagging that without aligning on intent, we risked shipping something that satisfied neither use case and left both types of users underserved. In order to hit development deadlines without forcing a premature decision, I suggested we use an existing design system tab component by splitting the Table view into History and Scheduled to let both intents coexist. This would give hunters a dedicated space for past activity and a separate one for what's ahead, rather than compressing both into a single cluttered view.
Deliberate control capability
Solving for "missing depth" meant getting specific about how threat hunters actually work, not just adding more unclear controls. I defined filter and sorting capabilities so hunters could quickly see and adjust exactly which sources they were investigating, like most relevant hunts to most prioritized, so a user could immediately tell whether a suspicious hunt needed action - turning a dense table into something a hunter could actually triage from, instead of just browse.
Protecting the vision
When the Dashboard view was deprioritized, I made the case for it directly to leadership that part of our audience would lose value and motivation to stay engaged. Ultimately we landed on a compromise by keeping the Dashboard button visible in a disabled state instead of cutting it. While it may seem like a small detail, it would solve scalability and motivation in one.
This is where the gritty details live - the main working hub of the platform alongside Co-Hunter. Given how dense the hunt list gets, I added overview widgets above the table itself: counts for activity in the last 24 hours and 7 days, suspicious hunts, threats found, and clean results. The goal was for a hunter to glance at the top of the screen and instantly understand what's going on - status, risk, volume - without having to parse rows of data first. It turns a wall of information into something scannable in seconds.
The depth of the table view meant we needed a way to help hunters narrow in on exactly what they're investigating. By adding sortable columns for timestamp, hunt name, type, status, outcome, severity, findings, source, and version, plus multi-select filtering with active filter chips we were able to achieve that goal. We also provided a multiple selection function for Sources which shows a count badge (e.g. "+3 Source") alongside individual chips, so it's always clear what's active without digging into a dropdown. The Status and Outcome filters got priority placement, since they were the fastest path to the question that mattered most: does this hunt need action right now. History and Scheduled live as separate tabs here, each with filter and sort logic tuned to its own intent - reviewing what happened versus planning what's coming next.
The Head of Product's initial list had eight options - Run Hunt, Schedule Hunt, View Details, Delete Hunt, Pause/Resume, Duplicate, Archive, and View in Intelligence Hub. I pushed back: that many choices - in a single dropdown - is known to create decision overload, especially for an action users take frequently. I narrowed it to the four that carried the most value - Run Hunt, Schedule Hunt, View Details, and Delete Hunt.
Cutting “Duplicate” from actions was one of the clearest changes due to its main use case - re-running a hunt with the same parameters - was already covered by Run Hunt, which re-executes the existing hunt against the same campaign with no extra input required. A separate Duplicate action would have just created redundancy without adding real value. It's a decision I'd revisit if the need shifted toward cloning a hunt to modify it independently (different sources, tags, or hypothesis) - that's a distinct enough use case to justify its own flow later.
This wasn't something leadership had planned - I pushed for it myself once I recognized the product was missing a visual layer that could ease the information overload of sifting through raw hunt data. Instead of forcing execs to interpret rows and columns, the Dashboard translates hunt activity into charts: status, type, method, outcomes, origin over time, and severity, all filterable by time range. Below the charts, a list of the underlying hunts lets anyone drill from a high-level trend straight into the specific data behind it. It wasn't something I'd seen competitors offering either, which made it feel less like a nice-to-have and more like a real point of differentiation for the product.
Designing Hunts Hub also meant designing for what happens when the data isn't clean or complete - I mapped six of these scenarios before handoff. Here's one example: a new user with zero hunts would normally see six broken or empty charts on the Dashboard. Instead, I designed placeholder states paired with a clear "Create your first hunt" call to action, so a user's first experience with the feature is a next step, not a dead end.
When the Dashboard was deprioritized, I still wanted its presence felt rather than erased. A disabled state with a hover tooltip reading "coming soon" kept the design minimal and didn't pull focus from the hunt lists. Just as important, it stayed entirely within existing design system components - which meant preserving the vision cost almost no extra development or design time against a deadline that didn't have room to spare.
Hunts Hub replaced a buried, multi-click flow with one dedicated space built for both analysts and executives. Every decision - from the Actions menu to the dashboard's edge cases - was considered against real trade-offs before reaching engineering. I left the company before the feature shipped to production, so these reflect the design outcome, not live usage data.