Collect files

Collect file copies one file from one or more endpoints into a storage bucket your organization owns. Use it to pull a suspicious binary, a log or a configuration file for analysis. Collected files are stored in your bucket, never kept by Huntbase.

Beta

This feature is currently rolling out and may not be enabled for your organization.

Before you start: set up a storage destination

A file collection needs somewhere to put the file. That is a storage destination: an S3 or S3-compatible bucket you own, with an access key Huntbase can use. One destination is the Default, and file collections use it.

Until a default destination with an access key exists, collecting is blocked:

• The Collect file dialog shows Set up a storage destination first.
• The Collections tab shows File collections need a storage destination.

Both link to Set up a storage destination, which opens Storage destinations in Settings. Organization admins manage destinations; other members can see whether one exists. See Organization management for the steps.

Who can collect files

You need to be an admin of the fleet's connection or hold the Responder role — on the whole fleet, or on a tag the endpoint carries. See Access and activity. Without it, Collect file is disabled with "You don't have permission to collect files on this fleet. Ask a fleet admin for access."

Files can't be collected from a shared fleet.

Start a collection

You can start from three places. All open the same Collect file dialog.

Where	How
The Endpoints tab	Tick one or more endpoints, then click Collect file in the bar.
An endpoint's page	Click Collect file in the header.
An endpoint's Files tab	Click Collect on a file's row, or Collect file in the file's details. The path is filled in for you. The Files tab is a separate rollout.

1. In File path, enter the full path of the file on the endpoint. The dialog shows an example for Linux, macOS and Windows.
2. Optionally add a Label — a short note such as "Suspicious launch agent" that helps you find the collection later.
3. Check the Collect from list. It names the endpoints, grouped by fleet.
4. Click Collect file.

Each endpoint sends the file the next time it checks in, so an offline endpoint delivers nothing until it is back.

Collecting across fleets

One collection is started per fleet, one after another. When your selection spans fleets:

• A shared fleet is left out, and the dialog says so.
• If you can only collect in some of the fleets, the button reads Collect from N of M.
• When the requests have been sent, the dialog lists what happened on each fleet, with View in Collections for each one that started. A fleet where the request failed shows Not started and the reason.

Follow collections on the Collections tab

The Collections tab lists collection runs across the fleets you can see, newest first.

Filter	Options
Type	All types, File collections, Other.
Status	Any of the run statuses below.
Search	Search path or label…

Column	What it shows
Collection	The file path, plus the label if you gave one.
Fleet	The fleet the run belongs to.
Requested by	Who started it.
Targets	How many endpoints the run named.
Progress	How many endpoints have finished.
Status	The run status.
When	When it was requested.

Click Refresh to reload. Runs that are still going update on their own.

Run statuses

Status	Meaning
Queued	The run is waiting to start. You can still Cancel collection.
Running	Endpoints are picking up the request and sending the file.
Complete	Every endpoint finished.
Completed with errors	The run finished, but some files could not be collected. The panel explains under Some files could not be collected.
Failed	The run failed. The panel explains under This collection failed.
Cancelled	The run was cancelled before it started.

Open a run and download files

Click a run to open its panel.

Details shows the Fleet, Type, Requested by, Targets, Requested, Started, your Label, Endpoints finished and how many files are Stored.

Files by endpoint has one entry per endpoint:

File status	Meaning
Waiting	Nothing has come back from the endpoint yet.
Scheduled	The collection is scheduled for this endpoint.
Collecting	The endpoint is sending the file. A progress bar shows the blocks received.
Collected	The whole file has arrived.
Storing	The file is being written to your storage destination.
Stored	The file is in your bucket and can be downloaded.
No file found	The endpoint found nothing at that path.
Failed	The file could not be collected from this endpoint.

For a stored file you also see its Size, when it was stored, and the SHA-256 of the stored archive with a copy button. The hash is of the archive in your bucket, not of the original file on the endpoint — use it to confirm that what you downloaded is what was stored.

Click Download to fetch the file from your bucket. If the download is refused, the message says why: the file isn't stored yet, the storage destination it was stored in has been removed, or you can see the endpoint but aren't allowed to download files collected from it.

Collect again starts a new run for the same path on the same endpoints.

Endpoints outside your access

A run can name endpoints you aren't allowed to see — for example when a colleague with wider access started it. Those endpoints are counted, not shown: under the files you see "2 endpoints are outside your access, so their files aren't listed." You can't download their files.

What is recorded

Starting a collection and downloading a collected file are both written to the fleet's audit trail, including refused attempts. The trail records the path, never the file's contents. See Access and activity.

Next steps

• Organization management — add and test a storage destination
• Access and activity — grant the Responder role
• Files and console — browse an endpoint's files to find the path
• Endpoints and endpoint details — select the endpoints to collect from