📄️ Endpoints overview
Endpoints is the workspace for the hosts you manage through Endpoint Control (osctrl). It brings every endpoint from every Endpoint Control connection you can see into one place: check fleet health, find a host, tag it, run a query on it, collect a file from it, decide who may do hands-on work, and review who did what.
📄️ Endpoints and endpoint details
The Endpoints tab lists every endpoint in the fleets you can see. Use it to find a host, act on several at once, or open one endpoint's page for its details, logs and hunts.
📄️ Collect files
Collect file copies one file from one or more endpoints into a storage bucket your organization owns. Use it to pull a suspicious binary, a log or a configuration file for analysis. Collected files are stored in your bucket, never kept by Huntbase.
📄️ Access and activity
Collecting files, browsing a host's file system and running console commands are hands-on operations. The Access tab decides who may do them on a fleet's endpoints, and the Activity tab records who did — including attempts that were refused.
📄️ Actions and runs
Running an Action on endpoints creates a run. A run records every targeted endpoint, sends the Action out in waves, and keeps the outcome of each endpoint, including endpoints that were offline and never got it.
📄️ Files and console
An endpoint's page has two live tabs, under its Live response tab. Files lets you browse the host's file system. Console lets you run read-only commands and osquery SELECTs on it. Both talk to the endpoint in real time, both are read-only, and everything you do in them is recorded under your name.
📄️ Isolate an endpoint
The Isolate endpoint Action cuts an endpoint off the network while keeping it reachable by Huntbase, so you can still query it, use live response on it and release it.
📄️ Investigate endpoints
The Investigate tab in Endpoints gives you forensic investigation and response on the hosts in an Endpoint Control fleet. It runs alongside your EDR rather than replacing it. Use it to check whether a fleet is compromised, look back through each endpoint's recent history, and keep a tamper-evident record of what happened.
📄️ Activity map
The Activity map shows what happened on one endpoint over time: a lane per data type, the process tree around any process, and that process's events. It reads the endpoint's local event store, so it can go back as far as retention allows, and it can follow the endpoint live.