Files and console
An endpoint's page has two live tabs. Files lets you browse the host's file system. Console lets you run read-only commands and osquery SELECTs on it. Both talk to the endpoint in real time, both are read-only, and everything you do in them is recorded under your name.
This feature is currently rolling out and may not be enabled for your organization. Files and Console are a separate rollout from the Endpoints workspace: the two tabs may be missing from an endpoint's page even when Endpoints is on.
If you are deciding whether to enable this for your team, start with What is recorded.
Who can use them
You need to be an admin of the fleet's connection or hold the Responder role on the fleet or on a tag the endpoint carries. See Access and activity.
| What you see | Why |
|---|---|
| The tab is disabled, with "You don't have permission to browse files on this fleet. Ask a fleet admin for access." (or the same for console commands) | You don't hold the role. |
| File browsing isn't available on this fleet or Console isn't available on this fleet | The feature is turned off for this deployment. Nothing was opened. |
| This fleet is shared — view only | Sessions can't be opened on a fleet that serves more than one organization. |
Sessions
Nothing happens when you open the tab. A session starts only when you click Start browsing or Start console session, because opening a session, and every listing, file and command after that, is written to the audit trail under your name. The notice Everything you do here is recorded says so before you start.
While a session is open, a status line shows:
- Session active.
- A countdown — Idle timeout in and the time left. The session closes after 5 minutes without activity; it is kept alive while the tab is visible. Near the end of a long session the countdown switches to Ends in, because sessions last at most one hour.
- How many requests or commands you have made this session.
- End session, to close it yourself.
| A session ends when… | What you see |
|---|---|
| You click End session | "You ended this session." |
| You leave the tab, reload, or navigate away | The session is closed for you. |
| It sits idle | "The session was idle for 5 minutes and expired." |
| It reaches the maximum length | "The session reached its one-hour maximum." |
| You open a newer session on the same endpoint, for example in another tab | The older one is replaced. |
| A fleet admin ends it | "A fleet admin ended this session." |
After that you see This session has ended and Start a new session. Starting again is recorded, like the first time. Console output that was on screen stays visible until you leave the tab.
Session limits
There is a limit on how many sessions you, and your team, can have open at once. When you reach it you see Session limit reached — "Close one to open another" — and, when Huntbase knows, how long to wait: idle sessions expire on their own.
Browse files
- Open the endpoint's page and click the Files tab.
- Click Start browsing.
- Type a path and click Go, or click folders in the listing. Use Back, Forward, Up one level and the breadcrumb to move around. Refresh lists the directory again, and is recorded as a new request.
- Click a file to open its details: Path, Size, Mode, Owner (uid:gid), and the Modified, Accessed and Changed times.
The listing has the columns Name, Size, Modified, Owner (uid:gid), Mode and Type; click a header to sort.
Browsing is read-only. Nothing is downloaded until you collect a file: click Collect on a file's row, or Collect file in its details, to open the Collect file dialog with the path filled in.
| Message | Meaning |
|---|---|
| The endpoint did not pick this up — it may be offline | Requests wait about a minute for the endpoint to check in, then expire. Try again once it is back online. |
| The endpoint could not read this path | It may not exist, or the endpoint software may not be allowed to read it. |
| "This directory is empty, or the endpoint software can't read it." | Shown for an empty listing. |
| The result was too large | List a smaller directory. |
Use the console
- Open the endpoint's page and click the Console tab.
- Click Start console session.
- Type a command and press Enter. Use the up and down arrows to recall earlier commands.
The console is read-only, but powerful: it cannot change the endpoint, but a SELECT can read almost anything osquery exposes on it — processes, users, file metadata, network state. A session runs one command at a time. While you wait you see Queued — waiting for the endpoint to check in… and then Delivered — waiting for the endpoint's answer…. If the endpoint is offline it never picks the command up, and the command expires after about a minute.
Results appear as a table with a row count and Copy output. If you see "Results were truncated", add a WHERE clause or a LIMIT.
Commands
Open What can I run here? under the console for this reference in the app.
| Command | What it does |
|---|---|
pwd | Print the current directory. |
cd <path> | Change the current directory. |
ls [path] | List a directory. |
stat <path> | Show one file's metadata. |
ps | List running processes. |
sql <select…> | Run one osquery SELECT without switching mode. |
osquery / sql | Switch to osquery mode: every line is a SELECT. |
help | Show the console's own help. |
clear | Clear this scrollback (nothing is sent). |
osquery mode
In osquery mode every line you enter is a query. Type exit to leave the mode.
- Each line is one statement and must start with
select. - No
;, and no insert, update, delete, drop, alter, attach, detach or pragma. - Up to 4,000 characters, on one line.
What is refused, and why
| Refused | Why |
|---|---|
get, the carves table and carve() | Pulling a file through the console would skip the file-collection permission, its audit record and your storage destination. Use Collect file instead, so the collection is permissioned, recorded and stored in your bucket. |
The curl and curl_certificate tables | They make the endpoint send network requests. |
A refused command shows That command isn't allowed here.
What is recorded
Security teams should know exactly what these tabs leave behind.
| Recorded in the audit trail | Never recorded or stored by Huntbase | |
|---|---|---|
| Console | Opening and closing a session; every command, with its full text; who ran it and on which endpoint; refused attempts. | Command output. It exists only in your browser tab until you leave it. |
| Files | Opening a session; every directory you list and file you inspect, with the path; refused attempts. | The listing itself and file contents. |
- Recorded before it runs. Each action is written to your organization's audit trail, under your name, before it runs. If that write fails, nothing runs and you see Blocked: the action could not be recorded.
- Sessions are personal. A session can only be used by the person who opened it.
- Read-only by design. Neither tab can change the endpoint, and the console refuses commands that would move files or make the endpoint send network requests.
- Files leave the endpoint one way only — through Collect file, into a bucket your organization owns.
- Fleet admins review all of it on the fleet's Activity tab, including denied attempts.
Next steps
- Access and activity — grant the Responder role and read the audit trail
- Collect files — retrieve a file you found
- Endpoints and endpoint details — the rest of the endpoint's page
- Query languages — osquery syntax