> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Huntress

> Connect ThreatAware to Huntress to monitor endpoint detection and response

## Overview

The Huntress integration enables ThreatAware to collect read-only data from your Huntress console, providing visibility into endpoint threat detection, incidents, and security posture across your organisation.

<Info>
  **Connection Method**: API Credentials
  **Setup Time**: 15 minutes
  **Access Required**: Huntress Account with API access
</Info>

## Data collected

The Huntress integration provides:

* Endpoint detection and response data
* Security incidents and alerts
* Threat intelligence and behavioural analysis
* Device inventory and threat status

## Use cases

<CardGroup cols={2}>
  <Card title="Threat Detection" icon="triangle-exclamation">
    Monitor threats detected by Huntress across your endpoints
  </Card>

  <Card title="Incident Management" icon="alert">
    Track security incidents and response activities in Huntress
  </Card>

  <Card title="Endpoint Security" icon="shield">
    Monitor endpoint security posture and protection status
  </Card>

  <Card title="Investigation Support" icon="magnifying-glass">
    Correlate Huntress threat data with device information in ThreatAware
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="Log in to ThreatAware Dashboard">
    Open the ThreatAware dashboard and navigate to **Settings** > **Systems**.
  </Step>

  <Step title="Search for Huntress">
    In the search bar, search for "Huntress."

    * Click **Connect**, and a pop-up window will appear with further instructions
  </Step>

  <Step title="Access Huntress Account">
    Navigate to your Huntress account:

    * Go to **your-subdomain.huntress.io** and log in to your account
    * Replace **your-subdomain** with your actual Huntress subdomain
  </Step>

  <Step title="Access API Credentials">
    Generate your API keys:

    * Click the profile menu in the dropdown located in the top-right corner
    * Select **API Credentials** from the menu options
  </Step>

  <Step title="Generate API Key Pair">
    Create your API credentials:

    * Click on the green **Setup** button to initiate the process
    * You will be redirected to the API credentials page
    * Click on the **Generate** button to create a new key pair
    * A public and private key pair will be generated
    * Make sure to note down both keys immediately (you won't be able to see them again)

    <Warning>
      Save both your Public Key and Private Key in a secure location immediately. You will not be able to retrieve them after this step.
    </Warning>
  </Step>

  <Step title="Input Credentials in ThreatAware">
    Return to ThreatAware:

    * Copy the **API Key** (public key) and paste it into ThreatAware
    * Copy the **API Secret Key** (private key) and paste it into the corresponding field
    * Click the **Authorize** button to complete the integration
  </Step>

  <Step title="Verify Connection">
    After connecting:

    * Check that the **Integration Status** shows as **Active**
    * Confirm that threat data is appearing in ThreatAware
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="API Key (Public Key)" icon="key">
    **Field Name**: Huntress API Key
    **Type**: String
    **Description**: The public key generated in your Huntress account

    This key identifies your integration and must be kept confidential.
  </Accordion>

  <Accordion title="API Secret Key (Private Key)" icon="lock">
    **Field Name**: Huntress API Secret Key
    **Type**: Password (encrypted)
    **Description**: The private key generated in your Huntress account

    Store this credential securely in your organisation's password manager. This key is only displayed once during generation.
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings** > **Systems** in ThreatAware
   * Confirm the Huntress integration shows **Active** status
   * Check the last sync timestamp

2. **Verify Data Collection**
   * Wait up to 60 minutes for initial data synchronization
   * Check that threat incidents and detections appear in ThreatAware
   * Verify the data matches your Huntress console

3. **Test Queries**
   * Create a test query to filter endpoints monitored by Huntress
   * Verify threat detection data is being collected correctly

## Troubleshooting

<AccordionGroup>
  <Accordion title="Invalid Credentials Error" icon="triangle-exclamation">
    **Symptoms**: Integration status shows authentication failure

    **Solutions**:

    * Verify both the **API Key** and **API Secret Key** are correctly entered
    * Ensure neither credential has extra spaces or was truncated
    * Confirm the credentials were copied from the correct API key pair
    * Check if the API key has been revoked or deleted in Huntress
    * Generate a new API key pair if the original is suspect
  </Accordion>

  <Accordion title="Permission Issues" icon="ban">
    **Symptoms**: Integration connects but no threat data appears

    **Solutions**:

    * Verify the API key pair was generated from an account with appropriate permissions
    * Check that your Huntress account has active threat detection enabled
    * Ensure endpoints are enrolled in Huntress and sending data
    * Review Huntress documentation for API access requirements
    * Contact Huntress support to verify API permissions
  </Accordion>

  <Accordion title="Connection Timeout" icon="clock">
    **Symptoms**: Integration fails to connect or times out

    **Solutions**:

    * Verify the Huntress console is accessible at your subdomain
    * Check firewall rules allow outbound HTTPS (443) to Huntress API endpoints
    * Confirm your network connectivity is stable
    * Test accessing your Huntress console directly in a browser
  </Accordion>

  <Accordion title="No Data After 1 Hour" icon="database">
    **Symptoms**: Integration shows active but no threat data appears

    **Solutions**:

    * Verify there are endpoints enrolled in Huntress and active
    * Check that threat detection is enabled in your Huntress account
    * Confirm the API key hasn't been revoked or rotated
    * Wait for the next sync cycle (typically hourly)
    * Review ThreatAware integration logs for error messages
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="Huntress Console" icon="link" href="https://huntress.io/">
    Access your Huntress console
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **API Key Management**

  * Store your API key and secret key securely in your password manager
  * Document when the API key pair was created and by whom
  * Periodically review active API key pairs in your Huntress account
  * Rotate API keys if compromised or per your security policy
  * Consider creating a dedicated Huntress account for this integration
</Tip>

<Tip>
  **Security Considerations**

  * Keep your Private Key (API Secret) strictly confidential
  * Never share or commit API credentials to version control
  * Monitor failed authentication attempts in ThreatAware regularly
  * Revoke old API key pairs when rotating to new ones
  * Review your Huntress account activity logs periodically
</Tip>