📄️ Endpoints overview
Endpoints is the workspace for the hosts you manage through Endpoint Control. It is also where you get Endpoint Control in the first place, and its All devices tab shows the hosts your other products, such as your EDR or MDM, report. It brings every endpoint from every Endpoint Control connection you can see into one place: check fleet health, find a host, tag it, run a query on it, collect a file from it, decide who may do hands-on work, and review who did what.
📄️ Get Endpoint Control
Endpoint Control puts the Huntbase endpoint agent on your hosts, so you can ask them questions directly, collect files from them and act on them. It is set up once per organisation. You ask for it from Endpoints: choose your agent address, send the request and follow it on the same page. When your fleet is ready, you go straight to Deploy to install the endpoint agent.
📄️ Endpoints and endpoint details
The Endpoints tab lists every endpoint in the fleets you can see. Use it to find a host, act on several at once, or open one endpoint's page for its details, logs and hunts.
📄️ All devices
The All devices tab lists every device your connected products know about, with your Endpoint Control endpoints merged in. Devices reported by your EDR (such as CrowdStrike, SentinelOne or Microsoft Defender), your device management (MDM, such as Intune or Jamf) and other products appear next to your fleet, one row per machine. Use it to see which hosts don't have the endpoint agent yet, and which products see each host.
📄️ Collect files
Collect file copies one file from one or more endpoints into a storage bucket your organization owns. Use it to pull a suspicious binary, a log or a configuration file for analysis. Collected files are stored in your bucket, never kept by Huntbase.
📄️ Access and activity
Collecting files, browsing a host's file system and running console commands are hands-on operations. The Access tab decides who may do them on a fleet's endpoints, and the Audit log tab records who did — including attempts that were refused.
📄️ Actions and runs
Running an Action on endpoints creates a run. A run records every targeted endpoint, sends the Action out in waves, and keeps the outcome of each endpoint, including endpoints that were offline and never got it.
📄️ Files and console
An endpoint's page has two live tabs, under its Live response tab. Files lets you browse the host's file system. Console lets you run read-only commands and osquery SELECTs on it. Both talk to the endpoint in real time, both are read-only, and everything you do in them is recorded under your name.
📄️ Isolate an endpoint
The Isolate endpoint Action cuts an endpoint off the network while keeping it reachable by Huntbase, so you can still query it, use live response on it and release it.
📄️ Investigate endpoints
The Investigate tab in Endpoints gives you forensic investigation and response on the hosts in an Endpoint Control fleet. It runs alongside your EDR rather than replacing it. Use it to check whether a fleet is compromised, look back through each endpoint's recent history, and keep a tamper-evident record of what happened.
📄️ Activity map
The Activity map shows what happened on one endpoint over time: a lane per data type, the process tree around any process, and that process's events. It reads the endpoint's local event store, so it can go back as far as retention allows, and it can follow the endpoint live.