Platform · Endpoint Control
When the log was never collected,
ask the host.
Ask Windows, macOS, Linux and container hosts directly, mid-hunt, and get answers in seconds. Nothing changes on a host until two people sign off.
processes
| where name == "rundll32.exe"
| project host, pid, parent.name, user, cmdline| Host | PID | Parent | User | Seen |
|---|---|---|---|---|
| WKS-2231 | 4812 | WINWORD.EXE | m.reyes | just now |
| WKS-2230 | 1207 | explorer.exe | j.okafor | just now |
| LT-0917 | 3391 | WINWORD.EXE | m.reyes | just now |
Answers no log ever held
Ask the fleet, a tag or one host what is running now. The answer lands in the hunt in seconds.
Collect into your own bucket
Pull a file or a process tree the moment the hunt needs it. Files go to your bucket with a SHA-256 hash, and every collection needs a reason.
Two people sign off
Isolate a host, patch a package or kill a process with signed scripts and saved Actions (Early access). Two people approve by default, rollouts are staged, and every step is audited.
02Fleet and response
Enrol once. Act only with sign-off.
Built on open-source osquery, so there's no proprietary agent to trust blindly. Every enrolled host becomes a device entity in your graph, and response actions run under rules you set.
- Roles by tag. Viewer, Responder and Operator roles are scoped to host tags, and every hands-on operation is audited.
- Staged rollout. Actions start with a canary wave. A failure gate pauses the rollout automatically.
- Isolation that cannot strand a host. An isolated host stays reachable to Huntbase. If that link is lost, isolation rolls itself back.
- Ready on day one. A built-in pack of 8 signed scripts and 6 starter Actions, including triage bundle collection and disabling a local account.
| Device | OS | Arch | Tags | Status |
|---|---|---|---|---|
| WKS-2231 | Windows 11 | x64 | finance | Online |
| SRV-DB-04 | Ubuntu 24.04 | x64 | prod, db | Online |
| MBP-A-118 | macOS 15 | ARM64 | eng | Online |
| api-worker-7 | Container | ARM64 | prod | Online |
| LT-0917 | Windows 11 | x64 | finance | Last seen 3h |
03In the loop
Live reach joins the stored history.
A hunt that runs out of logs asks the host. Scout proposes the live query or the action as an approval card; you choose which hosts it may touch. A proposal never counts as approval.
Questions
Frequently asked questions
Do I have to trust a proprietary agent?
No. Endpoint Control is built on open-source osquery with Huntbase's extension, on Windows, macOS, Linux and containers. You can read what runs on your hosts. Endpoint Control is in Early access.
Can Huntbase change anything on a host?
Only with approval, and response actions are in Early access. Signed scripts and saved Actions, such as isolating a host, collecting a triage bundle, patching a package, disabling a local account or killing a process, need two people to approve by default. Your organisation can require an org admin as one of them. Every step is audited.
How do actions roll out across many hosts?
In stages. A canary wave runs first, and a failure gate pauses the rollout automatically if too many hosts fail, before the rest of the fleet is touched.
What happens to an isolated host?
It stays reachable to Huntbase, so you can keep investigating and release it when you are done. If that link is lost, isolation rolls itself back, so a host is never stranded.
Where do collected files go?
To your own storage bucket. Each collection requires a reason and is recorded with the file's SHA-256 hash. Viewer, Responder and Operator roles are scoped by host tag, and every hands-on operation is in the audit log.
Ask the host.
Keep the call.
Answers from the host itself, and nothing changes there until two people sign off.
- 01Sign up
- 02Run a guided hunt on the sample workspace, no connector needed
- 03Connect your own sources when you're ready
