Endpoints overview
Endpoints is the workspace for the hosts you manage through Endpoint Control. It is also where you get Endpoint Control in the first place, and its All devices tab shows the hosts your other products, such as your EDR or MDM, report. It brings every endpoint from every Endpoint Control connection you can see into one place: check fleet health, find a host, tag it, run a query on it, collect a file from it, decide who may do hands-on work, and review who did what.
The Files and Console tabs on an endpoint's page are rolling out separately and may be off for your organisation.
Without Endpoint Control, Sandbox included, you can still open Endpoints to browse the read-only Example Corp sample fleet: its endpoints, each endpoint's page and Investigate's recorded views. A banner at the top says what needs Endpoint Control (adding your own endpoints and acting on any endpoint) and, where your plan includes it, offers Set up Endpoint Control. The All devices tab works without Endpoint Control too.
Words used on these pages
| Term | Meaning |
|---|---|
| Endpoint | One host that runs the endpoint software and checks in to Huntbase. |
| Fleet | All the endpoints that belong to one Endpoint Control connection. Each connection is one fleet, named after the connection. |
| Agent address | The address your endpoint agents connect to, for example acme.ec.huntbase.io. You choose it when you get Endpoint Control. |
| Install link | What a new endpoint uses to join a fleet. It carries a secret and it expires. See Endpoint Control. |
Open Endpoints
Click Endpoints under Investigate in the navigation menu. The page header reads Endpoints — "Every endpoint across your fleets" — and the breadcrumb above it reads Explorer › Investigate › Endpoints.
The new navigation is rolling out and may not be enabled for your organization yet. In both the new and the classic navigation, Endpoints sits in the Investigate group.
If your organisation has no fleet of its own yet, Endpoints shows the Set up Endpoint Control card, or where your request stands if someone has already asked. See Get Endpoint Control. If you expected a fleet, check the Scope selector in the page header: you may be working in a different organisation, or in your personal workspace.
Fleets and scope
The scope you pick in the Scope selector decides which fleets you see. A fleet appears once an Endpoint Control connection exists in the selected scope and you have access to it.
The fleet switcher sits at the right of the tab strip. It shows All fleets with the number of fleets, or the name of the fleet you chose. Open it to switch; each fleet is listed with its endpoint count.
| What you see | What it means |
|---|---|
| All fleets | Every fleet in your current scope, combined. |
| A fleet name | Only that fleet. Your choice carries across the tabs. |
| Shared badge | The fleet serves more than one organization. It is view-only — see Shared fleets. |
| Simulated badge | The fleet holds simulated endpoints rather than real hosts. |
| Updated … ago | When online and offline status was last refreshed for the chosen fleet. |
| Live status unavailable on this fleet | Online and offline status for this fleet can be up to an hour old. |
If you only have one fleet, the switcher is locked to it.
The tabs at a glance
| Tab | What you do there | Works across all fleets? |
|---|---|---|
| Overview | Check fleet health at a glance. | Yes |
| Endpoints | Find, filter, tag and act on endpoints. See Endpoints and endpoint details. | Yes |
| All devices | See every device your products report, merged with your endpoints, and which hosts don't have the endpoint agent. See All devices. | Yes (the fleet switcher is hidden) |
| Collections | Follow file collections and download the files. See Collect files. | Yes |
| Audit log | Read the audit trail of hands-on operations. See Access and activity. | One fleet at a time |
| Access | Decide who can do hands-on work on a fleet's endpoints. See Access and activity. | One fleet at a time |
| Deploy | Get install and uninstall commands and manage the install link. See Endpoint Control. | One fleet at a time |
| Investigate | Hunt for known-bad files with YARA, look back for indicators, read an endpoint's forensic timeline, check evidence integrity and approve requests. Shown where it is rolled out. See Investigate endpoints. | One fleet at a time |
When you open Audit log, Access, Investigate or Deploy with All fleets selected, the tab shows Choose a fleet — "This section works on one fleet at a time" — with a button for each fleet. Pick one to continue.
An endpoint's own page has its own tabs: Overview, Logs, and — where they are rolled out — Investigate, Live response (with Console and Files) and Response history. See Endpoints and endpoint details and Files and console.
Read the Overview tab
The Overview tab summarises the fleet you chose, or all your fleets combined.
Status tiles
| Tile | What it shows |
|---|---|
| Online | Endpoints that checked in within 5 minutes. |
| Stale | Endpoints seen in the last 24 hours that are not online. |
| Offline | Endpoints silent for over 24 hours. When some have been offline for over 7 days, the tile says how many. |
| Endpoints | The total, and which fleet or how many fleets it covers. |
| Enrolled, last 7 days | Endpoints whose first check-in was in the last 7 days. |
| Agent versions | How many different versions of the endpoint software are in use, and how many endpoints are behind the most common one. |
Click Online, Stale, Offline or Endpoints to open the Endpoints tab with that filter applied.
Cards
| Card | What it shows |
|---|---|
| Check-ins | A chart of check-ins over time. Use the time range menu (from Last 3 hours to Last 7 days; Last 24 hours by default). Under the chart are totals for Check-ins, Queries, File collections and Enrollments. |
| Needs attention | A short list of things worth a look, each with a link. See the table below. |
| Platforms | Endpoints by operating system. Click a platform to list its endpoints. |
| Agent versions | Endpoints by endpoint software version. |
| Recently enrolled | The newest endpoints, by first check-in. Click one to open its page. |
Check-ins, platforms and agent versions are reported per fleet. With many fleets in view, those cards ask you to pick one fleet from the fleet switcher.
| Needs attention item | Link |
|---|---|
| Install link has expired or Install link expires in … | Manage opens Deploy for that fleet. You see View instead if you can't change the link. |
| Endpoints offline for over 7 days | Review lists them, longest silent first. |
| Endpoints behind agent version … | List shows them, oldest version first. |
| Live status is unavailable | Endpoints lists the fleet. Its online and offline status can be up to an hour old. |
When there is nothing to flag, the card says "Nothing needs attention right now."
Who can do what
What you can do on a fleet depends on your role on its connection, plus any endpoint access a fleet admin has granted you. Buttons you can't use are disabled and say why — for example "You don't have permission to collect files on this fleet. Ask a fleet admin for access."
| Task | Who can do it |
|---|---|
| See endpoints and their details | Anyone with access to the fleet, or a Viewer grant or higher on a tag. |
| Read endpoint logs | Editors and admins of the connection, or an Operator grant or higher. |
| Tag endpoints, run collections | An Operator grant or higher, or a connection role that allows it. |
| Collect files, browse files, run console commands | Admins of the connection, or a Responder grant. |
| See install commands and the install link secret; manage the link | Fleet admins (admins of the connection). |
| Open the Access and Audit log tabs | Fleet admins. |
The full model — roles, tag-scoped access and how to grant it — is on Access and activity.
Shared fleets
A fleet marked Shared serves more than one organization, so it is view-only. A banner reads This fleet is shared — view only, and changing the install link, removing endpoints, collecting files, granting access and opening Files or Console sessions are turned off. Contact Huntbase support to make changes to a shared fleet.
Next steps
- Get Endpoint Control — request a fleet of your own
- Endpoints and endpoint details — find an endpoint and work on it
- Collect files — pull a file from one or more endpoints
- Access and activity — who can do what, and the audit trail
- Investigate endpoints — compromise assessment, look-back, timeline and evidence integrity
- Endpoint Control — connect a fleet and install on endpoints