👍

Quick Details

Recommended Agent: On-Demand
Supported Agents: On-Demand Agent and Self-Managed Agent
Can Auto-Discover: Huntress organizations (child inspectors)
Parent/Child Type Inspector: Yes
Inspection via: API
Default Frequency: Once daily (maximum every 8 hours)
Data Summary: Here

Overview

Liongard's Huntress Inspector retrieves and monitors configuration data from our partners' Huntress EDR solutions. This Inspector allows you to effectively oversee the security configurations of all Huntress instances, establish a standardized security baseline across all clients, and quickly identify any deviations from this baseline.

Inspector Setup Preparation

A user is required to set up this integration. You can create a new API User or use an existing user to generate the API Credentials.

MFA is supported for API use and recommended to secure accounts properly.

Generating API Credentials

1. Once you have created or logged in with your API user, select the three-bar menu on the top right of your instance, then click API Credentials.

   

2. After you access the API Credentials window, you may copy the API Key listed below only if you have stored its accompanying Secret Key. Otherwise, clickRegenerate in order to generate a new set of API keys. Note that clicking Regenerate will invalidate both your current API Key and API Secret Key, and will require that your applications be updated with the new set of credentials

3. From here, record and save the generated API Keys that you will need to add to the inspector configuration screen

Liongard Inspector Setup

Step 1: Parent Inspector Setup

Since Huntress is a multi-tenant system with a single portal to manage many Environments, you will set up a single "Parent" Inspector with the API Key that will then auto-discover "Child" Inspectors for each Environment.

In Liongard, navigate to Admin > Inspectors > Inspector Types > Navigate to the Huntress Inspector > Select Add System.

Fill in the following information:

• Type of Inspector: Select Parent
• Environment: Select your MSP's Environment
• Friendly Name: Suggested "Huntress [Environment Name]"
• Agent: On-Demand Agent (recommended) or Self-Managed Agent
• Inspector Version: Latest
• Huntress API Key: The API Key you generated in the steps above
• Huntress API Key Secret: The API Secret Key you generated in the steps above
• Scheduling: The Inspector will default to run once a day at the time the Inspector is set up. Here you can adjust the schedule

Select Save. The Inspector will now be triggered to run within the minute.

For more on generating credentials, see Huntress's guide to Generating API Keys.

Step 2: Child Inspector Setup

After the first run of the Parent Inspector, your client Huntress organizations will be Auto-Discovered in the Discovered Systems tab on the Inspectors >Huntress page.

Navigate to the Discovered Systems tab in your Inspectors > Huntress page

• Activate or Archive your Discovered Systems by ensuring that they're mapped to the correct Environment > Check the checkbox to the left of Inspector(s) > Select the Actions drop down menu > Activate Launchpoints

Child inspectors use an Organization ID that Liongard fills in automatically. You do not need to enter it.

📘

Add-on data

Everything beyond the Organization and Agents data depends on Huntress products your account may not have purchased (ITDR, SIEM, External Recon, and related add-ons). When an add-on is not licensed, Huntress returns a permission error for that data and the Liongard inspector skips it. The matching tab appears empty and the run still completes successfully. An empty tab does not indicate a failed inspection.

Optional: Turn on Flexible Asset/Configuration Auto-Updating

If you would like this Inspector's data to be sent to ConnectWise and/or IT Glue, turn on Flexible Assets/Configurations for this Inspector:

• ConnectWise: Admin > Integrations > ConnectWise > Configuration Types > Confirm the "Configuration Auto-Updating" toggle is enabled
• IT Glue: Admin > Integrations > IT Glue > Flexible Assets > Confirm the "Flexible Asset Auto-Updating" toggle is enabled

Unresponsive Agent Metrics

The 21, 30, 45, 60, and 90 day unresponsive-agent metrics are calculated by Liongard from each agent's last check-in. "EDR Unresponsive Agents Count (Official)" is the count Huntress itself reports for the organization. The two may differ slightly. See the data summary for the full list of Huntress metrics and alerts.

Inspector FAQs