Team: Huntress Managed Endpoint Detection and Response (EDR)
Environment: Windows Agent, Registry, Regedit
Summary: What data does Huntress store in the registry?
All the registry keys can be found in one key folder:
HKEY_LOCAL_MACHINE\SOFTWARE\Huntress Labs\Huntress
The following are very important for communication between the Huntress portal and the Huntress agent installed on your endpoint:
- AgentId - The hexadecimal equivalent of the Agent ID used in the portal. This cannot be changed or the agent will disconnect from the portal.
- ApiKey - The key used to keep track of trust by the portal. If this key is modified the agent will be orphaned and reinstalling will not work. If orphaned the agent will need a full uninstall / reinstall.
- VerifyHashes - This is used for troubleshooting agents that are generating too many autoruns. This should always be 0 unless otherwise instructed by Huntress to change.
The following are only stored for Huntress support to use for troubleshooting. These values may not reflect the values in the portal (and won't affect communication between the Huntress portal and the agent):
- Account Key
- AgentVersion
- OrganizationKey
- Tags