Team: Huntress Managed Endpoint Detection and Response (EDR)
Product: Huntress Agent Updates
Environment: Windows, MacOS
Summary: Agent update issues, agent not updating
The Agent updates by using either the new hUpdate.exe or a third-party updater, wyUpdate.exe. When an update is available, the HuntressUpdater.exe calls to the appropriate updater, downloading and running the Agent update. The Huntress Updater reaches out to updates.huntress.io.
Update Failure Possibilities
-
TLS 1.1 is blocked
This only affect wyUpdate - wyUpdate uses TLS 1.1 to fetch updates. If TLS 1.1 is blocked, the Agent update will fail. (hUpdate uses TLS 1.3)
More information on Huntress and TLS Deep Packet Inspection (TLS/SSL Interception)
-
Bugsnag is blocked
notify.bugsnag.com (this is for our bug reporting software if an Agent has an issue communicating) (you may see it point to something like6.205.186.35.bc.googleusercontent.com)
-
Outbound traffic is restricted
If you restrict outbound traffic, you will need to allow outbound communications on port 443 to our cloud (read more in our article about outbound communication)
-
3rd party Security Software interference
To prevent interference with Huntress Agent operation and to prevent false positives we highly recommend adding the entire c:\program files\Huntress\ to the 'known good' list in all of your 3rd party security software.
-
Network error
The endpoint may have lost internet connection
Troubleshooting
If using Windows Process Monitor, the update will show as hUpdate or wyUpdate, not HuntressUpdater