Skip to main content

Why Has A New Agent Not Checked In?

Cameron Granger
  • Updated

Team: Huntress Managed Endpoint Detection and Response (EDR)
Product: Huntress Agent for Windows, macOS, or Linux
Environment: Huntress.io portal
Summary: Newly installed agents may not check in if the account key is input incorrectly, or if network issues are present.

You've installed the Huntress Agent, but it is not appearing in the Huntress console.

This is typically due to one of two reasons:

  1. The account key was entered incorrectly. This will prevent the Huntress Agent from registering.
  2. The Huntress Agent is unable to communicate with the Huntress servers. This is often caused by Deep Packet Inspection or port 443 outbound being blocked. 
  3. A 3rd party program is interfering. This is usually AV, ThreatLocker, or other security tools, for these we recommend visiting Allow List Huntress in Third Party Security Software (AV, NGAV, *DR)

In either case, the Huntress Agent log should provide details about the root cause. The Huntress Agent log can be found within the following directory:

%PROGRAMFILES%\Huntress\

macOS logs can be found here:

/Library/Application Support/Huntress/HuntressAgent/

Linux logs can be found here:

/var/log/

 

Incorrect Account Key

If the log contains something similar to the following the account key was entered incorrectly:

time="2019-01-07T15:14:11-05:00" level=info msg="Registering Huntress agent" 
time="2019-01-07T15:14:11-05:00" level=error msg="(register) post request - bad status code: 400; []"

The simplest solution is to verify your account and organization keys, uninstall the agent and then re-install. 

Deep Packet Inspection

If the log contains the error, "cert does not match pinned fingerprint", Deep Packet Inspection is likely in use. You can review this page for details on how to resolve this. This KB has network testers available for Windows, macOS, and Linux environments: Network Connectivity and Troubleshooting Errors Caused by Firewalls

Port 443 outbound blocked

If the log contains DNS, bad gateway, or 403 forbidden errors the issue is likely with port 443 restrictions. This KB has network testers available for Windows, macOS, and Linux environments: Network Connectivity and Troubleshooting Errors Caused by Firewalls

 

Related articles