Endpoints and endpoint details
The Endpoints tab lists every endpoint in the fleets you can see. Use it to find a host, act on several at once, or open one endpoint's page for its details, logs and hunts.
This feature is currently rolling out and may not be enabled for your organization.
Find endpoints
Open Endpoints from the navigation menu and click the Endpoints tab. With All fleets selected the table covers every fleet in your scope; choose a fleet in the fleet switcher to narrow it.
Filter and search
| Control | What it does |
|---|---|
| Status chips | All, Online, Stale, Offline, each with a count. You can combine more than one status. |
| Platform chips | One chip per operating system in the fleet. The count is fleet-wide — it is not narrowed by your search or tags. |
| Tag | Filter by one or more tags. Choose a single fleet first; with All fleets selected the filter is off and says "Pick a fleet to filter by tag". |
| Search | Search hostname, IP, UUID, serial… |
Active filters appear as chips you can clear. If nothing matches you see No endpoints match these filters.
Your search text is not kept in the page address, so it is not included when you reload the page or share a link. Status, platform and tag filters are.
Table columns
| Column | What it shows |
|---|---|
| Status | Online, Stale or Offline. |
| Endpoint | The hostname. |
| UUID | The endpoint's ID. |
| IP address | The address the endpoint last reported. |
| Fleet | Which fleet it belongs to. Shown only when you have more than one fleet and All fleets is selected. |
| Tags | Huntbase tags on the endpoint. |
| System | Operating system and version. |
| Agent version | The endpoint software version. |
| Last seen | When the endpoint last checked in. |
| 24h activity | A small bar per hour of events received in the last 24 hours. Hover a bar for the count. |
Click a column header to sort where sorting is available. Use Previous and Next to page through large fleets. CSV export covers the current page, or the rows you selected.
Act on several endpoints
Tick the rows you want. A bar appears showing how many are selected on this page — a selection never spans pages.
| Action | What it does |
|---|---|
| Tag | Add a tag to the selected endpoints. Tags come from your tag folders under Settings → Tags. |
| Run query on these | Opens a new osquery query targeted at exactly these endpoints. See Run a query on endpoints. |
| Collect file | Copy one file from the selected endpoints into your storage destination. See Collect files. |
| Remove | Remove the selected endpoints from their fleet. |
| Clear | Clear the selection. |
When a selection spans fleets
You may be allowed to act in one fleet and not another. Huntbase applies the action to the endpoints you are allowed to act on and tells you how many are skipped before you confirm — for example "2 of the 5 selected endpoints are in a shared fleet, which is view-only — they will be skipped." If none of the selection qualifies, the button is disabled and the note under the bar explains why.
If you try to add a tag that grants endpoint access and you don't manage endpoint access, the endpoints are not tagged and Huntbase says so. See Access and activity.
Remove endpoints
Remove asks you to confirm. Removed endpoints leave the fleet and stop receiving queries. Removing an endpoint does not uninstall anything: a host that still runs the endpoint software with a valid install link can enroll again. To remove it for good, uninstall it on the host.
Open an endpoint's page
Click a row to open the endpoint's page. The breadcrumbs lead back to Endpoints and to the endpoint's fleet.
Open an endpoint from elsewhere in Huntbase
You can also open a machine's endpoint page in one step from anywhere it appears as a device or host, as long as it's enrolled in a fleet you can see in Endpoints:
| Where | How |
|---|---|
| Graph in Explorer, hunts and insights | Open endpoint in the node's side panel or right-click menu, or double-click the device node. |
| Entity details (including from the Activity feed) and Explore search previews | The Open endpoint button in the header. |
| Activity feed device rows, a hunt's investigation timeline, endpoint cells in a hunt notebook | Click the hostname. |
| Device entities on a hunt, device chips on an insight, the Endpoint column of osquery results | The small endpoint icon next to the name. |
| A hunt evidence row's details | The Open endpoint button above the row's values. |
When a timeline entry or evidence row carries both a process GUID and a time, the link opens the endpoint's Activity map centred on that process at that time. Otherwise it opens the Overview tab.
If the same hostname is enrolled in more than one fleet you can see, you choose the fleet from a short list. If you can't see the endpoint in Endpoints because you have no access to its fleet, or because it isn't enrolled, no link is shown.
The header's actions are Open in Explorer, Respond, Run query and ⋯ (More actions for this endpoint):
| Action | What it does |
|---|---|
| Open in Explorer | Opens the endpoint as a device entity in Explorer, where you can pivot on it. It is unavailable until the endpoint has been added to the graph, which happens shortly after enrolling. Endpoints in a simulated fleet are never added. |
| Respond | Everything you can do to the endpoint, grouped Investigate, Undo and Contain. See The Respond menu. |
| Run query | Opens a query tab targeted at this endpoint only. |
| ⋯ › Add to timeline… | Puts an event on this endpoint onto an open hunt's investigation timeline, with System filled in. |
| ⋯ › Copy endpoint ID | Copies the endpoint's ID. |
| ⋯ › Remove endpoint… | Removes the endpoint from its fleet, after a confirmation. Last in the menu, in red. |
While live response is starting or running, the header also shows its state (Starting live response…, queued, connecting or live), how many shared slots are in use, and Cancel or End live response.
The Respond menu
| Group | Items |
|---|---|
| Investigate | Start live response, with how many shared slots are in use beside it (Start live response again after one ended), Collect file… (see Collect files) and Run script… |
| Undo | Restore file…, Release network isolation… |
| Contain | Kill process…, Quarantine file…, in red. Isolate from network and Delete file are listed but disabled. |
Each item appears where its feature is rolled out, and an item you can't use stays in the menu, disabled with the reason. If nothing in the menu can be used — on a sample fleet, for example — Respond itself is disabled and its tooltip gives the reasons.
Below the header, a summary strip shows Platform, osquery version, Last seen, First enrolled and Data received. Then come the tabs: Overview, Logs, and — where they are rolled out — Investigate (see Investigate tabs), Live response (see Live response tabs) and Response history (see Follow an action). Investigate and Live response each open a second row of tabs. A tab you can't use is disabled and its tooltip says why; a group is disabled only when you can't use any tab in it.
The open tab is in the page's link (?tab=…), so you can share a link to it.
Overview tab
| Box | What it shows |
|---|---|
| Identity | Hostname, Local name, IP address, Logged-in user, Endpoint ID, Hardware serial and tags. |
| Hardware | Vendor / model, CPU, Cores, Memory and BIOS. |
| Activity | Messages received from this endpoint, per hour, over the last 24 hours or 7 days. |
| Seen in hunts | Hunts whose results included this endpoint. |
| Notes | Your team's notes on this endpoint, with a box to add one. See Tags and notes. |
Tags on an endpoint
An endpoint can carry two kinds of tags:
- Tags are Huntbase tags. Add or remove them here. They drive the Tag filter, query targeting and — for tags in an access-bearing folder — endpoint access. If you can't change tags, the tags are shown read-only with the reason.
- Fleet manager tags are set in the fleet manager. They are read-only here, and are not used for Huntbase access or filters.
Seen in hunts
Seen in hunts lists hunts whose results included this endpoint, with each hunt's status, verdict and an Open link. It is deliberately narrow: hunts where the endpoint was only a starting point, or was linked by hand, aren't listed. When there are more hunts than fit, the box shows the most recently active and says how many there are in total.
Until the endpoint has been added to the graph, hunts can't be matched to it and the box says so.
Investigate tabs
Where Investigate is enabled, the Investigate tab has five tabs for this endpoint. They read through the endpoint's normal check-in, so none of them needs a live response session:
| Tab | What it shows |
|---|---|
| Activity map | Events per data type over time and the process tree. See Activity map. |
| Event timeline | The endpoint's stored events for a time range. See Event timeline. |
| Detections | Live YARA detections on this endpoint. See Detections. |
| Evidence integrity | The event store, signed daily digests and legal hold, with Verify now. See Evidence integrity. |
| Look-back | Search this endpoint's history for one indicator. See IOC look-back. |
Activity map, Event timeline and Look-back run queries on the endpoint; they are disabled if you aren't allowed to run commands on the fleet. Links from Endpoints › Investigate (a hunt match, a look-back hit, a detection) open these tabs at the right process and moment.
Live response tabs
The Live response tab gathers everything that uses a live response session, a direct connection to the endpoint:
| Tab | What it does |
|---|---|
| Console | Run read-only commands and osquery SELECTs. Works without a session, but each command then waits for the endpoint's next check-in (up to about a minute). See Files and console. |
| Files | Browse the endpoint's file system. Like Console, it is fast with a session and waits for check-ins without one. |
| Live activity | The activity map streaming as events happen. Needs a session; appears where Investigate is enabled. |
Read an endpoint's logs
Open the Logs tab.
| Control | Options |
|---|---|
| Log type | Status logs (messages from the endpoint software, with Error and Warning marked) or Result logs (rows returned by queries; expand one to see its columns). |
| Time range | Last hour, Last 6 hours, Last 24 hours, Last 7 days. |
| Search logs | Filters the loaded logs. Like the endpoint search, the term is not kept in the page address. |
When a range holds more than can be shown, a note says it is showing the latest entries — narrow the time range to see more.
If you see You don't have access to this endpoint's logs, logs are limited to editors and admins of the fleet and to people granted access to this endpoint. The rest of the page still works.
Respond to an endpoint
The response actions in Respond, in the endpoint page's header, change the endpoint to contain a threat. Unlike Files and Console, these actions are not read-only.
Response actions are a separate rollout from Files and Console. They appear in Respond, and the Response history tab appears, only when they are enabled for your organization and the fleet supports them.
| Action | What it does |
|---|---|
| Kill process… | Stops a process by its ID. The signal is TERM unless you pick another. The endpoint refuses to kill pid 1 or its own agent. |
| Quarantine file… | Moves a file into the endpoint's quarantine, out of reach, so it can be restored later. Takes an absolute path. |
| Restore file… | Puts a quarantined file back where it came from. Takes the quarantine ID — in the console, in osquery mode, run SELECT * FROM scout_file_quarantine to list them. |
| Release network isolation… | Restores the endpoint's normal network access. |
| Run script… | Runs one of your fleet's active scripts, picked by name. |
| Isolate from network, Delete file | Shown but disabled: they will need two-person approval, which is coming soon. |
You need the Responder role on the fleet or on a tag the endpoint carries — the same role as for the console, but granted as its own permission, so an admin can give someone the console without actions. On a shared fleet, or without the permission, the response actions are disabled and say why. Nothing can be run while the fleet is in safe mode.
Each action opens a confirmation first: the target, any options, an optional Reason, and how it will be delivered:
- Live — runs in about a second. The endpoint has live response.
- Runs at the endpoint's next check-in (up to about a minute). Start live response for faster results.
You can also start an action from where you found the target: under a console result that lists processes, [kill a process…] opens Kill process with those process IDs offered; in Files, a file's details offer Quarantine file with its path filled in.
In a hunt, an Endpoint action cell proposes the same actions for someone else to approve, next to the evidence — and Scout can propose them too, where your organization allows it. See Endpoint cells.
Follow an action
The Response history tab lists the endpoint's recent actions, newest first: what was done and to what, its state, how it was delivered (Live or Check-in), who asked and when. Click an action to see the endpoint's message and output. While an action is unfinished its state updates by itself — every second while the endpoint is live.
| State | Meaning |
|---|---|
| Pending | Accepted, waiting to be sent. |
| Delivered | The endpoint has it and is running it. A script stays here until its job finishes. |
| Succeeded | Done. |
| Failed | The endpoint tried and could not — the message says why. |
| Expired | The endpoint never picked it up in time, usually because it was offline. |
| Denied | The endpoint refused it, for example a protected process. |
Every request is written to the endpoint's audit trail under your name (or, for an approved hunt proposal, under the requester's, with who approved it) — with the target and your reason — before it is sent, and its outcome is added when it finishes. Output is never written to the audit trail. See the fleet's Activity tab.
Run a query on endpoints
Run query (on an endpoint's page) and Run query on these (on the Endpoints tab) open a new query tab in Explorer with osquery selected and the run limited to exactly the endpoints you chose. A banner in the tab reads Targeting N endpoints and names them.
The banner warns you if the targeting is edited away, and offers Restore targeting. See Query workspace.
Next steps
- Collect files — pull a file from the endpoints you found
- Files and console — browse files and run read-only commands live
- Activity map — follow this endpoint's activity and process tree
- Access and activity — control who can do this work
- Query workspace — write and run the targeted query