Skip to main content

Endpoint Control (osctrl)

Endpoint Control lets you install the Huntbase endpoint software on your hosts, watch your fleet and run live osquery queries against your endpoints from inside Huntbase. It is powered by osctrl and works like any other connection. Each Endpoint Control connection is one fleet.

This page covers setup: connect a fleet, install on endpoints, uninstall, and manage the install link. Day-to-day work — finding endpoints, collecting files, access and the audit trail — happens in the Endpoints workspace.

Beta

The Endpoints workspace is currently rolling out and may not be enabled for your organization. Where it is not enabled, you do the same setup from the connection page — see If Endpoints is not enabled.

Create an osctrl connection​

  1. Open Connections and click New connection (or open the osctrl product page and start from there).
  2. On the Product step, pick osctrl, choose the Owner, then select the Environment your endpoints will join. If none is listed, use the Request access button — Endpoint Control runs in an environment assigned to your organization, and the request carries the details support needs to assign one.
  3. On the Details step, give the connection a Name (a suggestion is pre-filled) and an optional description. The name is also the fleet's name in Endpoints.
  4. Review the summary and click Create Connection.

Host, credentials and configuration are handled for you, so there is nothing else to fill in. You can create several osctrl connections to manage separate fleets — each keeps its own endpoints, install link and commands.

See Connections for the shared parts of the connection page (health, stats, description, credentials, webhooks).

The fleet summary on the connection page​

With Endpoints enabled, an Endpoint Control connection's page shows a compact Fleet card: Online, Offline and Total counts, and two links.

LinkWhere it goes
Open in EndpointsThe Endpoints workspace, with this fleet selected.
DeployThe Deploy tab for this fleet.

A fleet that serves more than one organization is marked Shared · view only.

If your organization has no Endpoint Control environment assigned, the page shows a Request access message instead — there is nothing to install into until one is assigned.

Install on endpoints​

Open Endpoints, choose the fleet in the fleet switcher, and open the Deploy tab. (With All fleets selected, the tab asks you to choose a fleet first.)

  1. In Install on endpoints, choose the platform — Windows, macOS, Linux or Docker.
  2. Choose the Architecture — x64 or ARM64.
  3. Follow the numbered steps. Each has a copy button; commands and JSON snippets are copied ready to paste.
  4. Run the steps on the host. It shows up in Endpoints within a minute of its first check-in.

Alongside the steps:

  • Install link secret — lets a new endpoint join this fleet. Treat it like a password. It is masked; use the eye icon to show it and the copy button to copy it. Use it if you install through your own provisioning tooling.
  • Download installer — appears when an installer package is available for the chosen platform and architecture.

Only fleet admins see the commands​

The install commands carry the install link, so they are shown only to fleet admins — admins of the connection. Everyone else sees Install commands are limited to fleet admins:

The commands carry this fleet's install link, which only admins of the connection can read. You can still see when the link expires. Ask a fleet admin for the commands, or to be made an admin.

Viewing the secret and the commands is recorded on the fleet's Activity tab.

The install link — and the removal link that goes with it — expires. A pill on the card shows Expires in … or Expired, and the Endpoints Overview tab flags a link that has expired or is about to under Needs attention.

Fleet admins get a Manage link menu:

ActionWhat it does
Rotate nowIssues a fresh link and resets the 24h expiry. The current install and removal links stop working immediately. Endpoints already in the fleet are not affected.
Extend expiryPushes out the expiry without changing the link.
Expire nowInvalidates the current link immediately. Nothing new can join the fleet until you rotate to issue new links.

Rotate now and Expire now ask you to confirm (Rotate link, Expire link). Extend expiry runs straight away. If you are not a fleet admin the menu is disabled with "Only fleet admins can rotate, extend or expire the install link. Ask a fleet admin."

Uninstall from endpoints​

  1. On the Deploy tab, find Uninstall from endpoints and choose the platform.
  2. Copy the commands and run them on the host. They uninstall the endpoint software and take the host out of the fleet.
  3. For Docker, stop and remove the container as shown.

The uninstall commands carry the fleet's removal link, so they too are limited to fleet admins (Uninstall commands are limited to fleet admins). The Docker steps need no link and are available to everyone.

If you no longer have access to the host, remove its record instead: select it on the Endpoints tab and click Remove, or use Remove endpoint on its page. A host that still runs the endpoint software with a valid install link can enroll again, so uninstall where you can. See Endpoints and endpoint details.

Shared fleets​

Some fleets serve more than one organization. They are marked Shared and show This fleet is shared — view only: changing the install link and removing endpoints are turned off. Contact Huntbase support to make changes.

If Endpoints is not enabled​

Without the Endpoints workspace, the connection page shows a panel with two tabs instead of the Fleet card.

TabWhat it has
Fleet StatusOnline, Offline and Total cards (click Online or Offline to filter), a search box, a platform filter (All platforms, macOS, Windows, Linux), and a table with Hostname, Platform, Agent, Last seen and Status. Click Hostname, Platform or Last seen to sort; page with Prev and Next. Remove on a row deletes that endpoint's record from the fleet; it is disabled with a reason if you aren't allowed.
Fleet ManagementThe same Install on endpoints and Uninstall from endpoints cards described above, including Manage link and the fleet-admin limits.

Query your endpoints​

Endpoints are queried from the query workspace like any other source. Choose the osquery language, select the osctrl connection, then use the fleet picker to filter the fleet by tag, operating system or hostname, or to pick exact endpoints. From Endpoints, Run query opens a query tab already targeted at the endpoints you chose. See Query workspace.

Enrolled endpoints also surface in Huntbase as device entities, so you can pivot on them and correlate them with telemetry from other connections. See Entities.

Delete the connection​

Scroll to the Danger Zone at the bottom of the connection page and click Delete Connection. This permanently removes the connection and its associated data and cannot be undone. Uninstall from your hosts first if you no longer want them managed.

Next steps​