Skip to main content

Endpoint Control

Endpoint Control lets you install the Huntbase endpoint agent on your hosts, watch your fleet and run live osquery queries against your endpoints from inside Huntbase. Each organisation's Endpoint Control is one fleet, with its own agent address (for example acme.ec.huntbase.io) that your endpoint agents connect to.

This page covers connecting the fleet, installing on endpoints, uninstalling and managing the install link. Getting Endpoint Control in the first place, from choosing your agent address to the fleet being ready, is on Get Endpoint Control. Day-to-day work, such as finding endpoints, collecting files, access and the audit trail, happens in the Endpoints workspace. Compromise assessment, IOC look-back, forensic timelines and evidence integrity are on the Investigate tab, which has its own requirements for the endpoint agent.

Connect Endpoint Control​

You don't configure anything to connect Endpoint Control. There is no server, credential or environment to enter: Huntbase sets up your fleet and, once it is ready, connects it for you as a connection named Endpoint Control.

On Connections, the Endpoint Control card is marked By Huntbase and reads "Install the Huntbase endpoint agent on your hosts and query them live." What clicking it does depends on where your organisation stands:

Your organisationWhat you see
Has no fleet yetThe card says Set up. It opens Endpoint Control is set up from Endpoints — "Choose your agent address and request access there. Once your fleet is ready, it's connected for you." Click Set up Endpoint Control to go to Get Endpoint Control.
Has a fleet that isn't connected yetConnect your fleet — "Your Endpoint Control fleet is ready. Connect it, then install the endpoint agent on your hosts." It shows the Agent address and the connection Name. If you have more than one fleet, choose one under Which fleet?. Click Connect fleet; you go to Deploy for that fleet.
Is already connectedThe card says Open fleet and opens Endpoints with your fleet selected. From New connection, you see "Your fleet is already connected as …" with Open fleet and Install the agent.

This is rare: usually the fleet is connected for you as soon as it is ready, so you go straight from setup to Deploy.

See Connections for the shared parts of the connection page (health, stats, credentials, webhooks).

Your fleet on the connection page​

An Endpoint Control connection's page shows a Your fleet card in place of the connection set-up details.

ItemWhat it shows
Agent addressThe address your endpoint agents connect to.
Last syncWhen the endpoint list was last refreshed, or Not synced yet.
Online, Offline, TotalEndpoint counts for the fleet.
Install the agentOpens the Deploy tab for this fleet. Not shown on the sample fleet.
View endpointsOpens Endpoints with this fleet selected.

With no endpoints yet, the card says "No endpoints yet. Install the endpoint agent on a host and it shows up here within a minute or two." A fleet that serves more than one organisation is marked View only.

If your organisation doesn't have Endpoint Control yet, the page says "This fleet isn't set up yet. Endpoint Control is set up from Endpoints, where you choose your agent address and request access." with Set up Endpoint Control.

Install on endpoints​

Open Endpoints, choose the fleet in the fleet switcher, and open the Deploy tab. (With All fleets selected, the tab asks you to choose a fleet first.)

The Install the endpoint agent card shows your fleet's Agent address and the install command. The command installs osquery and the Huntbase endpoint agent, and enrols the host in your fleet. It needs administrator rights on the host (root or sudo on macOS and Linux, an elevated PowerShell on Windows).

  1. In Install the endpoint agent, choose the platform: Windows, macOS or Linux. The tab for your own computer's system is selected for you.
  2. Leave Architecture on Detect on the host, or choose x64 or ARM64 to pin the command to one architecture. A pinned command stops with a message on a host of the other architecture. Windows on ARM64 is not supported yet.
  3. Copy the command and run it on the host. The link in the command is masked on screen until you show the secret; the copy button always copies the full command.
  4. Under Check that it joined, wait for the host. It appears within a minute or so as, for example, fin-lt-099 joined, then endpoint agent loaded with the agent version. If the endpoint agent didn't load, open its logs from there and run the command again. Open endpoint takes you to the new endpoint.

The command checks the server's certificate. If your fleet uses its own certificate, the command carries it and trusts only that certificate; it never turns certificate checks off.

Alongside the command:

  • Install link secret: lets a new host join your fleet. Treat it like a password. It is masked; use the eye icon to show it and the copy button to copy it. Use it if you install through your own provisioning tooling.

If your organisation's fleet isn't set up yet, the card says "This fleet isn't set up yet." with a Set up Endpoint Control link. See Get Endpoint Control.

If the install link has expired, the card shows This install link expired instead of the command, with Issue a new link for fleet admins. That rotates the link and gives it a fresh 24-hour expiry.

Only fleet admins see the commands​

The install commands carry the install link, so they are shown only to fleet admins — admins of the connection. Everyone else sees Install commands are limited to fleet admins:

The commands carry this fleet's install link, which only fleet admins can read. You can still see when the link expires. Ask a fleet admin for the commands, or to be made an admin.

Viewing the secret and the commands is recorded on the fleet's Audit log tab.

The install link — and the removal link that goes with it — expires. A pill on the card shows Expires in … or Expired, and the Endpoints Overview tab flags a link that has expired or is about to under Needs attention.

Fleet admins get a Manage link menu:

ActionWhat it does
Rotate nowIssues a fresh link and resets the 24h expiry. The current install and removal links stop working immediately. Endpoints already in the fleet are not affected.
Extend expiryPushes out the expiry without changing the link.
Expire nowInvalidates the current link immediately. Nothing new can join the fleet until you rotate to issue new links.

Rotate now and Expire now ask you to confirm (Rotate link, Expire link). Extend expiry runs straight away. If you are not a fleet admin the menu is disabled with "Only fleet admins can rotate, extend or expire the install link. Ask a fleet admin."

Uninstall from endpoints​

  1. On the Deploy tab, find Uninstall from endpoints and choose the platform.
  2. Copy the command and run it on the host as an administrator. It takes the host out of the fleet and uninstalls the endpoint agent and osquery. To keep osquery installed (for example, if the host runs it for something else), run it with KEEP_OSQUERY=1 set.

The uninstall commands carry the fleet's removal link, so they too are limited to fleet admins (Uninstall commands are limited to fleet admins). When the removal link has expired, no command is shown; issue a new link from Manage link.

If you no longer have access to the host, remove its record instead: select it on the Endpoints tab and click Remove, or use Remove endpoint on its page. A host that still runs the endpoint software with a valid install link can enrol again, so uninstall where you can. See Endpoints and endpoint details.

Shared fleets​

Some fleets serve more than one organization. They are marked Shared and show This fleet is shared — view only: changing the install link and removing endpoints are turned off. Contact Huntbase support to make changes.

Query your endpoints​

Endpoints are queried from the query workspace like any other source. Choose the osquery language, select the Endpoint Control connection, then use the fleet picker to filter the fleet by tag, operating system or hostname, or to pick exact endpoints. From Endpoints, Run query opens a query tab already targeted at the endpoints you chose. See Query workspace.

Enrolled endpoints also surface in Huntbase as device entities, so you can pivot on them and correlate them with telemetry from other connections. An endpoint's entity profile shows the endpoint agent's status and links to the endpoint's page. Wherever a host appears, for example in query results or the graph, Open endpoint takes you to its page. See Entities and Endpoints and endpoint details.

Delete the connection​

Scroll to the Danger Zone at the bottom of the connection page and click Delete Connection. This permanently removes the connection and its associated data and cannot be undone. Uninstall from your hosts first if you no longer want them managed.

Next steps​