Endpoints and endpoint details
The Endpoints tab lists every endpoint in the fleets you can see. Use it to find a host, act on several at once, or open one endpoint's page for its details, logs and hunts.
This feature is currently rolling out and may not be enabled for your organization.
Find endpoints
Open Endpoints from the navigation menu and click the Endpoints tab. With All fleets selected the table covers every fleet in your scope; choose a fleet in the fleet switcher to narrow it.
Filter and search
| Control | What it does |
|---|---|
| Status chips | All, Online, Stale, Offline, each with a count. You can combine more than one status. |
| Platform chips | One chip per operating system in the fleet. The count is fleet-wide — it is not narrowed by your search or tags. |
| Tag | Filter by one or more tags. Choose a single fleet first; with All fleets selected the filter is off and says "Pick a fleet to filter by tag". |
| Search | Search hostname, IP, UUID, serial… |
Active filters appear as chips you can clear. If nothing matches you see No endpoints match these filters.
Your search text is not kept in the page address, so it is not included when you reload the page or share a link. Status, platform and tag filters are.
Table columns
| Column | What it shows |
|---|---|
| Status | Online, Stale or Offline. |
| Endpoint | The hostname. |
| UUID | The endpoint's ID. |
| IP address | The address the endpoint last reported. |
| Fleet | Which fleet it belongs to. Shown only when you have more than one fleet and All fleets is selected. |
| Tags | Huntbase tags on the endpoint. |
| System | Operating system and version. |
| Agent version | The endpoint software version. |
| Last seen | When the endpoint last checked in. |
| 24h activity | A small bar per hour of events received in the last 24 hours. Hover a bar for the count. |
Click a column header to sort where sorting is available. Use Previous and Next to page through large fleets. CSV export covers the current page, or the rows you selected.
Act on several endpoints
Tick the rows you want. A bar appears showing how many are selected on this page — a selection never spans pages.
| Action | What it does |
|---|---|
| Tag | Add a tag to the selected endpoints. Tags come from your tag folders under Settings → Tags. |
| Run query on these | Opens a new osquery query targeted at exactly these endpoints. See Run a query on endpoints. |
| Collect file | Copy one file from the selected endpoints into your storage destination. See Collect files. |
| Remove | Remove the selected endpoints from their fleet. |
| Clear | Clear the selection. |
When a selection spans fleets
You may be allowed to act in one fleet and not another. Huntbase applies the action to the endpoints you are allowed to act on and tells you how many are skipped before you confirm — for example "2 of the 5 selected endpoints are in a shared fleet, which is view-only — they will be skipped." If none of the selection qualifies, the button is disabled and the note under the bar explains why.
If you try to add a tag that grants endpoint access and you don't manage endpoint access, the endpoints are not tagged and Huntbase says so. See Access and activity.
Remove endpoints
Remove asks you to confirm. Removed endpoints leave the fleet and stop receiving queries. Removing an endpoint does not uninstall anything: a host that still runs the endpoint software with a valid install link can enroll again. To remove it for good, uninstall it on the host.
Open an endpoint's page
Click a row to open the endpoint's page. The breadcrumbs lead back to Endpoints and to the endpoint's fleet.
The header has the actions:
| Action | What it does |
|---|---|
| Run query | Opens a query tab targeted at this endpoint only. |
| Collect file | Starts a file collection from this endpoint. |
| Open in Explorer | Opens the endpoint as a device entity in Explorer, where you can pivot on it. It is unavailable until the endpoint has been added to the graph, which happens shortly after enrolling. Endpoints in a simulated fleet are never added. |
| More actions → Copy endpoint ID | Copies the endpoint's ID. |
| More actions → Remove endpoint | Removes the endpoint from its fleet, after a confirmation. |
Below the header, a summary strip shows Platform, osquery version, Last seen, First enrolled and Data received. Then come the tabs: Overview, Logs, and — where they are rolled out — Files and Console (see Files and console). A tab you can't use is disabled and its tooltip says why.
Overview tab
| Box | What it shows |
|---|---|
| Identity | Hostname, Local name, IP address, Logged-in user, Endpoint ID, Hardware serial and tags. |
| Hardware | Vendor / model, CPU, Cores, Memory and BIOS. |
| Activity | Messages received from this endpoint, per hour, over the last 24 hours or 7 days. |
| Seen in hunts | Hunts whose results included this endpoint. |
Tags on an endpoint
An endpoint can carry two kinds of tags:
- Tags are Huntbase tags. Add or remove them here. They drive the Tag filter, query targeting and — for tags in an access-bearing folder — endpoint access. If you can't change tags, the tags are shown read-only with the reason.
- Fleet manager tags are set in the fleet manager. They are read-only here, and are not used for Huntbase access or filters.
Seen in hunts
Seen in hunts lists hunts whose results included this endpoint, with each hunt's status, verdict and an Open link. It is deliberately narrow: hunts where the endpoint was only a starting point, or was linked by hand, aren't listed. When there are more hunts than fit, the box shows the most recently active and says how many there are in total.
Until the endpoint has been added to the graph, hunts can't be matched to it and the box says so.
Read an endpoint's logs
Open the Logs tab.
| Control | Options |
|---|---|
| Log type | Status logs (messages from the endpoint software, with Error and Warning marked) or Result logs (rows returned by queries; expand one to see its columns). |
| Time range | Last hour, Last 6 hours, Last 24 hours, Last 7 days. |
| Search logs | Filters the loaded logs. Like the endpoint search, the term is not kept in the page address. |
When a range holds more than can be shown, a note says it is showing the latest entries — narrow the time range to see more.
If you see You don't have access to this endpoint's logs, logs are limited to editors and admins of the fleet and to people granted access to this endpoint. The rest of the page still works.
Run a query on endpoints
Run query (on an endpoint's page) and Run query on these (on the Endpoints tab) open a new query tab in Explorer with osquery selected and the run limited to exactly the endpoints you chose. A banner in the tab reads Targeting N endpoints and names them.
The banner warns you if the targeting is edited away, and offers Restore targeting. See Query workspace.
Next steps
- Collect files — pull a file from the endpoints you found
- Files and console — browse files and run read-only commands live
- Access and activity — control who can do this work
- Query workspace — write and run the targeted query