Team: Huntress Managed Endpoint Detection and Response (EDR)
Product: Huntress Agent
Environment: Huntress.io portal
Summary: Newly installed agents may not check in if the account key is input incorrectly, or if network issues are present.
You've installed the Huntress Agent, but it is not appearing in the Huntress console.
This is typically due to one of two reasons:
- The account key was entered incorrectly. This will prevent the Huntress Agent from registering.
- The Huntress Agent is unable to communicate with the Huntress servers. This is often caused by Deep Packet Inspection.
In either case, the Huntress Agent log should provide details about the root cause. The Huntress Agent log can be found within the following directory:
%PROGRAMFILES%\Huntress\HuntressAgent.log
macOS logs can be found here:
cat '/Library/Application Support/Huntress/HuntressAgent/HuntressAgent.log'
Incorrect Account Key
If the log contains something similar to the following the account key was entered incorrectly:
time="2019-01-07T15:14:11-05:00" level=info msg="Registering Huntress agent" time="2019-01-07T15:14:11-05:00" level=error msg="(register) post request - bad status code: 400; []"
The simplest solution is to verify your account and organization keys and uninstall the agent and then re-install.
Deep Packet Inspection
If the log contains the error, "cert does not match pinned fingerprint", Deep Packet Inspection is likely in use. You can review this page for details on how to resolve this.
If the issue persists, feel free to send the log to Support.