Huntress

The Huntress connector enables automated interactions with the Huntress platform, facilitating advanced threat detection and streamlined incident management.

Huntress is a cybersecurity platform specializing in threat detection and tailored incident response. The Huntress connector for Swimlane Turbine enables users to automate the management of organizations, agents, and incident reports within the Huntress ecosystem. By integrating with Huntress, Swimlane Turbine users can enhance their security operations with efficient data retrieval, incident analysis, and streamlined response actions. This connector empowers security teams to proactively manage threats and leverage Huntress' robust telemetry for informed decision-making.

Prerequisites

To effectively utilize the Huntress connector within Swimlane Turbine, ensure you have the following prerequisites:

HTTP Basic Authentication with the following parameters:

URL: The endpoint URL for the Huntress API.

API Key: Your unique identifier to authenticate with the Huntress API.

API Secret Key: A confidential key paired with your API Key for secure authentication.

Capabilities

This Connector provides the following capabilities:

List Organizations

Create Organization

Update Organization

Get Account

Get Agents

Get Incident Reports

List Escalations

Notes

For more information on Huntress: Huntress API Documentation

Additional Documentation

Huntress Connector Documentation

Huntress API Documentation

Configurations

Huntress HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Username	string	Required
password	Password	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Create Organization

Initiates the creation of a new organization in Huntress using specified 'key' and 'name'.

Endpoint

URL: /v1/organizations

Method: POST

Input

Argument Name	Type	Required	Description
key	string	Optional	Organization keys are used to associate a Huntress Agent into a grouping. Value cannot be blank and must be 256 characters or less.
name	string	Optional	The name of the organization. Value cannot be blank and must be 256 characters or less.

Input Example

{"key":"string","name":"Example Name"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"status_code":200,"response_headers":{"Date":"Fri, 20 Mar 2026 06:18:59 GMT","Content-Type":"text/html; charset=utf-8","Content-Length":"8746","Connection":"keep-alive","Server":"nginx","x-frame-options":"SAMEORIGIN","x-xss-protection":"0","x-content-type-options":"nosniff","x-permitted-cross-domain-policies":"none","referrer-policy":"strict-origin-when-cross-origin","link":"<https://huntresscdn.com/portal/production/assets/application-68fa314293ce3d37f5...","vary":"Accept","etag":"W/\"7fc03f7c...

Get Account

Retrieve details of the top-level Huntress Account associated with your API credentials.

Endpoint

URL: /v1/account

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

Get Agents

Lists all Huntress agents associated with your account, providing a comprehensive overview of agent status and details.

Endpoint

URL: /v1/agents

Method: GET

Input

Argument Name	Type	Required	Description
parameters.page	number	Optional	Must be an integer greater than 0.
parameters.limit	number	Optional	Must be an integer between 1 and 500.
parameters.created_at_min	string	Optional	Must provide a date greater than January 1st, 2010.
parameters.created_at_max	string	Optional	must be greater than created_at_min.
parameters.updated_at_min	string	Optional	Must provide a date greater than January 1st, 2010.
parameters.updated_at_max	string	Optional	must be greater than updated_at_min.
parameters.organization_id	number	Optional	The unique identifier of an organization under the account associated with your API credentials. Will only select agents under this organization.
parameters.platform	string	Optional	The platform of the host machine.

Input Example

{"parameters":{"page":1,"limit":10,"created_at_min":"2022-03-01T18:54:02Z","created_at_max":"2022-04-01T18:54:02Z","updated_at_min":"2022-03-01T20:05:10Z","updated_at_max":"2022-03-01T20:05:10Z","organization_id":1,"platform":"windows"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
agents	array	Output field: agents
agents.file_name	string	Name of the resource
agents.file	string	Output field: agents.file
pagination	object	Output field: pagination
pagination.current_page	number	Output field: pagination.current_page
pagination.current_page_count	number	Count value
pagination.limit	number	Output field: pagination.limit
pagination.total_count	number	Count value

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 19 Mar 2024 11:05:19 GMT","Content-Type":"application/json","Content-Length":"95","Connection":"keep-alive","Server":"nginx","X-Huntress-Api-Call-Limit":"60","X-Huntress-Api-Call-Remaining":"59","ETag":"W/\"0a83153eb468c791fe137282160a7f05\"","Cache-Control":"max-age=0, private, must-revalidate","Content-Security-Policy":"report-uri /csp-violation; default-src 'self' https://*.huntress.io https://hunt...","X-Request-Id":"2d70a247-4872-4537-81d8...

List Escalations

Retrieve a list of escalations with varying severities (low, high, critical) for your Huntress account, including pagination metadata.

Endpoint

URL: /v1/escalations

Method: GET

Input

Argument Name	Type	Required	Description
parameters.limit	integer	Optional	Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.
parameters.page_token	string	Optional	Token used to request the next page in paginated results. Defaults to null.
parameters.status	string	Optional	Filter by status. One of open, overdue, resolved.

Input Example

{"parameters":{"limit":1,"page_token":"","status":"open"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

Get Incident Reports

Retrieve all incident reports from Huntress, providing a comprehensive overview of security incidents.

Endpoint

URL: /v1/incident_reports

Method: GET

Input

Argument Name	Type	Required	Description
parameters.page	number	Optional	Must be an integer greater than 0.
parameters.limit	number	Optional	The number of elements to show per page. Must be an integer between 1 and 500.
parameters.updated_at_min	string	Optional	Must provide a date greater than January 1st, 2010.
parameters.updated_at_max	string	Optional	must be greater than updated_at_min.
parameters.indicator_type	string	Optional	Will return only incident reports whose indicator types include the specified value.
parameters.status	string	Optional	Will return only incident reports matching the status provided.
parameters.severity	string	Optional	Will return only incident reports matching the severity provided.
parameters.platform	string	Optional	The platform of the host machine (darwin or windows or microsoft_365).
parameters.organization_id	number	Optional	The unique identifier of an organization under the account associated with your API credentials. Will only select incident reports under this organization.
parameters.agent_id	number	Optional	The unique identifier of an agent under the account associated with your API credentials. Will only select incident reports under this organization.

Input Example

{"parameters":{"page":1,"limit":10,"updated_at_min":"2022-03-01T20:05:10Z","updated_at_max":"2022-03-01T20:05:10Z","indicator_type":"footholds","status":"sent","severity":"low","platform":"windows","organization_id":1,"agent_id":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
incident_reports	array	Unique identifier
incident_reports.file_name	string	Unique identifier
incident_reports.file	string	Unique identifier
pagination	object	Output field: pagination
pagination.current_page	number	Output field: pagination.current_page
pagination.current_page_count	number	Count value
pagination.limit	number	Output field: pagination.limit
pagination.total_count	number	Count value

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 19 Mar 2024 11:05:41 GMT","Content-Type":"application/json","Content-Length":"105","Connection":"keep-alive","Server":"nginx","X-Huntress-Api-Call-Limit":"60","X-Huntress-Api-Call-Remaining":"58","ETag":"W/\"5d841252ca41b87733dbaa4b61b19b17\"","Cache-Control":"max-age=0, private, must-revalidate","Content-Security-Policy":"report-uri /csp-violation; default-src 'self' https://*.huntress.io https://hunt...","X-Request-Id":"2e5f9f71-8cf9-4b56-8f4...

List Organizations

Retrieve details of organizations linked to your account, including a pagination key for result management as per Huntress documentation.

Endpoint

URL: /v1/organizations

Method: GET

Input

Argument Name	Type	Required	Description
parameters.limit	integer	Optional	Max number of resources returned in a paged collection. Defaults to 10, with a minimum of 1 and maximum 500.
parameters.page_token	string	Optional	Token used to request the next page in paginated results. Defaults to null.

Input Example

{"parameters":{"limit":10,"page_token":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"status_code":200,"response_headers":{"Date":"Fri, 20 Mar 2026 06:25:09 GMT","Content-Type":"text/html; charset=utf-8","Content-Length":"8746","Connection":"keep-alive","Server":"nginx","x-frame-options":"SAMEORIGIN","x-xss-protection":"0","x-content-type-options":"nosniff","x-permitted-cross-domain-policies":"none","referrer-policy":"strict-origin-when-cross-origin","link":"<https://huntresscdn.com/portal/production/assets/application-68fa314293ce3d37f5...","vary":"Accept","etag":"W/\"2068fc02...

Update Organization

Updates an existing organization in Huntress using the specified ID provided in path parameters.

Endpoint

URL: /v1/organizations/{{id}}

Method: PATCH

Input

Argument Name	Type	Required	Description
path_parameters.id	integer	Required	The unique identifier of the organization to update.
key	string	Optional	Organization keys are used to associate a Huntress Agent into a grouping. Value cannot be blank and must be 256 characters or less.
name	string	Optional	The name of the organization. Value cannot be blank and must be 256 characters or less.
report_recipients	array	Optional	Any emails specified here will automatically receive quarterly and monthly branded reports.

Input Example

{"path_parameters":{"id":123},"key":"string","name":"Example Name","report_recipients":["string"]}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	integer	Unique identifier
agents_count	integer	Count value
account_id	integer	Unique identifier
created_at	string	Output field: created_at
incident_reports_count	integer	Unique identifier
key	string	Output field: key
logs_sources_count	integer	Count value
identity_provider_tenant_id	string	Unique identifier
billable_identity_count	integer	Unique identifier
name	string	Name of the resource
report_recipients	array	Output field: report_recipients
sat_learner_count	integer	Count value
updated_at	string	Output field: updated_at

Output Example

{"status_code":200,"response_headers":{"Content-Type":"application/json"},"reason":"OK","json_body":{"id":1,"agents_count":42,"account_id":5,"created_at":"2022-03-01T18:54:02Z","incident_reports_count":42,"key":"test1","logs_sources_count":42,"identity_provider_tenant_id":"dcd219dd-bc68-4b9b-bf0b-4a33a796be35","billable_identity_count":42,"name":"Acme Inc.","report_recipients":["[email protected]","[email protected]"],"sat_learner_count":42,"updated_at":"2022-03-01T18:54:02Z"}}

Response Headers

Header	Description	Example
Cache-Control	Directives for caching mechanisms	max-age=0, private, must-revalidate
Connection	HTTP response header: Connection	keep-alive
Content-Length	The length of the response body in bytes	95
Content-Security-Policy	HTTP response header: Content-Security-Policy	report-uri /csp-violation; default-src 'self' https://.huntress.io https://huntresscdn.com; font-src 'self' data: https://fonts.gstatic.com https://beacon-v2.helpscout.net https://huntresscdn.com https://script.hotjar.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://beacon-v2.helpscout.net https://checkout.stripe.com https://huntresscdn.com https://static.hotjar.com https://script.hotjar.com https://api.canny.io; style-src-elem 'self' 'unsafe-inline' https://fonts.googleapis.com https://checkout.stripe.com https://huntresscdn.com; script-src 'self' 'unsafe-inline' https://www.google.com https://www.gstatic.com https://www.recaptcha.net https://www.google-analytics.com https://www.googletagmanager.com https://static.hotjar.com/ https://script.hotjar.com https://beacon-v2.helpscout.net https://d12wqas9hcki3z.cloudfront.net https://d33v4339jhl8k0.cloudfront.net https://checkout.stripe.com https://js.stripe.com https://canny.io https://api.canny.io https://assets.canny.io https://static.zdassets.com https://ekr.zdassets.com https://huntress.zendesk.com https://widget-mediator.zopim.com https://api.smooch.io https://huntresscdn.com; connect-src 'self' https://.huntress.io https://huntress-user-uploads.s3.amazonaws.com https://.google-analytics.com https://.hotjar.com https://.hotjar.io wss://.hotjar.com https://d3hb14vkzrxvla.cloudfront.net https://beaconapi.helpscout.net https://chatapi.helpscout.net wss://.pusher.com https://.sumologic.com https://checkout.stripe.com https://canny.io https://.canny.io wss://.canny.io https://static.zdassets.com https://ekr.zdassets.com https://ekr.zendesk.com https://huntress.zendesk.com https://.zopim.com https://api.smooch.io wss://huntress.zendesk.com wss://.zopim.com wss://api.smooch.io https://sessions.bugsnag.com https://notify.bugsnag.com https://huntresscdn.com https://us-autocomplete-pro.api.smartystreets.com https://international-autocomplete.api.smarty.com https://webhooks.fivetran.com; frame-src 'self' https://www.google.com https://www.recaptcha.net https://beacon-v2.helpscout.net https://checkout.stripe.com https://js.stripe.com https://canny.io https://changelog-widget.canny.io https://app.datadoghq.com; object-src 'self' https://beacon-v2.helpscout.net; img-src 'self' data: https://.huntress.io https://huntress-user-uploads.s3.amazonaws.com https://www.google-analytics.com https://static.hotjar.com/ https://script.hotjar.com https://.gravatar.com https://beacon-v2.helpscout.net https://d33v4339jhl8k0.cloudfront.net https://linkmaker.itunes.apple.com https://.stripe.com https://static.zdassets.com https://ekr.zdassets.com https://huntress.zendesk.com https://.zopim.io https://.zdusercontent.com https://media.smooch.io https://huntresscdn.com https://s3-eu-west-1.amazonaws.com; media-src 'self' https://beacon-v2.helpscout.net https://static.zdassets.com https://ekr.zdassets.com https://huntress.zendesk.com https://.zopim.io https://*.zdusercontent.com https://huntresscdn.com
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Fri, 20 Mar 2026 06:25:09 GMT
etag	An identifier for a specific version of a resource	W/"2068fc02af6ae8cfebf6d4818f2d45ae"
link	HTTP response header: link	https://huntresscdn.com/portal/production/assets/application-68fa314293ce3d37f5fd574bb49d8a8b46b83e4ea4990e969af8996095d337ad.js; rel=preload; as=script; nopush,https://huntresscdn.com/portal/production/assets/application-7bbaf918b1998eaa4e2d62d8694aeeb0fb574e62bee12f0b21e0da4145be1f02.css; rel=preload; as=style; nopush,https://huntresscdn.com/portal/production/assets/tailwind.scoped-bf79989e936531e4a7ed3819276020d162da97ed1a459527e296a586c25528a6.css; rel=preload; as=style; nopush,https://js.stripe.com/v3/; rel=preload; as=script; nopush
referrer-policy	HTTP response header: referrer-policy	strict-origin-when-cross-origin
Server	Information about the software used by the origin server	nginx
set-cookie	HTTP response header: set-cookie	_portal_session=ohKVSiZsTZwAC9CMfQBrLPRIKvnZb%2FS8yYpQfPd8AmZ1ryjlrtul1il4ocTynG0%2B63k%2FwYSJicRYvAVITil8PxasPb4ZvzX3XB%2F92LrXygd%2FQXDJKQI9Rl4%2BJS%2Fpdi6RDfUtUdjs%2ButUjQRQEGg%2BBrvehDB9pDfMREEoLDDixyrp7wsWEKzteNvX83J2Vv%2BoC6MGCJAlKpWChwzcAuEkpoYssaj%2BhcEJIoEpn5SjfKUMMHdcRgjfpC04sFFiFw0pCQoa4%2FShc3f6lYgyx%2FY2hMQAcQFOg6boeZmrzzUpwLcqazcu1YUyYVcgzO8xy3Rf7t26WdIvnq2w04RihUVkJ3YeMrKvWjZIyFGoKysylFDVSemhjovplnwbdluMCMfdrwNDlW0X%2B7UEz25429xgzhLZT7%2FROzw%3D--dZO5VcfvlLakaB5R--6%2FqmNTmdbi00vs1k6dvvbA%3D%3D; domain=huntress.io; path=/; secure; HttpOnly; SameSite=Lax
strict-transport-security	HTTP response header: strict-transport-security	max-age=0
vary	HTTP response header: vary	Accept
x-content-type-options	HTTP response header: x-content-type-options	nosniff
x-frame-options	HTTP response header: x-frame-options	SAMEORIGIN
X-Huntress-Api-Call-Limit	HTTP response header: X-Huntress-Api-Call-Limit	60
X-Huntress-Api-Call-Remaining	HTTP response header: X-Huntress-Api-Call-Remaining	59
x-permitted-cross-domain-policies	HTTP response header: x-permitted-cross-domain-policies	none
X-Request-Id	A unique identifier for the request	2e5f9f71-8cf9-4b56-8f46-e7835ca7de60
x-runtime	HTTP response header: x-runtime	0.010571
x-xss-protection	HTTP response header: x-xss-protection	0