Huntress Tools

Written By Christopher Scaminaci

Last updated 7 days ago

Huntress Tools

huntress_ · 92 tools · Free 55 · Pro 37 Huntress managed-detection API; raw JSON passthrough.

All connector tools · Huntress setup guide

Huntress tool groups

Account — 2 tools
Agents — 6 tools
Identities — 2 tools
Incident Reports — 7 tools
Escalations — 3 tools
Platform Actions — 2 tools
Signals — 2 tools
Organizations — 5 tools
Memberships — 5 tools
Invoices — 2 tools
External Recon — 2 tools
Summary Reports — 2 tools
Unwanted Access Rules — 6 tools
Managed Accounts (Reseller) — 36 tools
Reseller Billing — 9 tools
SIEM — 1 tool

Account

Tool	Plan	Access	Summary
`huntress_get_account`	Free	Read-only	Get the Huntress account associated with the current API credentials — name, subdomain, status, and high-level account metadata.
`huntress_get_actor`	Free	Read-only	Get the actor for the current API credentials — the set of entities (account, organizations, permissions) the key is authorized to act as.

huntress_get_account details

[Huntress] Get the Huntress account associated with the current API credentials — name, subdomain, status, and high-level account metadata. Use this to confirm which account the key is operating against before drilling into agents, organizations, or billing with huntress_list_organizations / huntress_list_invoices.

huntress_get_actor details

[Huntress] Get the actor for the current API credentials — the set of entities (account, organizations, permissions) the key is authorized to act as. Use this to understand the effective scope and access of the credentials before making scoped calls.

Agents

Tool	Plan	Access	Summary
`huntress_get_agent`	Free	Read-only	Get a single Huntress agent by its numeric ID — full host detail, OS, platform, version, last-seen, and organization.
`huntress_isolate_agent`	Pro	Destructive	Network-isolate a Huntress agent's endpoint, cutting it off from the network except for Huntress communication.
`huntress_list_agents`	Free	Read-only	List Huntress agents (deployed endpoint sensors) across the account.
`huntress_release_agent_isolation`	Pro	Destructive	Release network isolation on a Huntress agent's endpoint, restoring normal network connectivity.
`huntress_uninstall_agent`	Pro	Destructive	Uninstall the Huntress agent from an endpoint.
`huntress_update_agent`	Pro	Write	Update a Huntress agent — set its tags and/or tamper-protection-configured flag.

huntress_get_agent details

[Huntress] Get a single Huntress agent by its numeric ID — full host detail, OS, platform, version, last-seen, and organization. Discover agent IDs via huntress_list_agents.

Param	Type	Required	Default	Description
`id`	integer	yes		Numeric agent ID (from huntress_list_agents).

huntress_isolate_agent details

[Huntress] Network-isolate a Huntress agent's endpoint, cutting it off from the network except for Huntress communication. Optionally provide a reason and request strict isolation. Discover agent IDs via huntress_list_agents; reverse with huntress_release_agent_isolation.

Param	Type	Required	Default	Description
`fieldsJson`	string	no	null	Additional body fields as a JSON object, merged into the request.
`id`	integer	yes		Numeric agent ID to isolate (from huntress_list_agents).
`reason`	string	no	null	Optional human-readable reason for the isolation.
`strictIsolation`	boolean	no	null	When true, request strict isolation (tighter lockdown).

huntress_list_agents details

[Huntress] List Huntress agents (deployed endpoint sensors) across the account. Returns a paginated list with host, OS, platform, version, and organization. Filter by organization, platform, hostname, OS, or version. Use huntress_get_agent for full detail on one agent, and huntress_list_organizations to discover organizationId values.

Param	Type	Required	Default	Description
`hostname`	string	no	null	Filter by hostname (exact match).
`limit`	integer	no	50	Max results per page (default 50, capped at 500 by the API).
`organizationId`	integer	no	null	Filter to a single organization ID (from huntress_list_organizations).
`os`	string	no	null	Filter by operating system string.
`pageToken`	string	no	null	Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`platform`	string	no	null	Filter by platform: windows\|darwin\|linux.
`sortDirection`	string	no	null	Sort direction: asc\|desc. Omit for default ordering.
`sortField`	string	no	null	Field to sort by: id\|created_at\|updated_at. Omit for default ordering.
`version`	string	no	null	Filter by agent version string.

huntress_release_agent_isolation details

[Huntress] Release network isolation on a Huntress agent's endpoint, restoring normal network connectivity. Reverses huntress_isolate_agent. Discover agent IDs via huntress_list_agents.

Param	Type	Required	Default	Description
`id`	integer	yes		Numeric agent ID to release from isolation (from huntress_list_agents).

huntress_uninstall_agent details

[Huntress] Uninstall the Huntress agent from an endpoint. This is an asynchronous, IRREVERSIBLE action — the sensor is removed and monitoring stops; reinstalling requires a fresh deployment. Discover agent IDs via huntress_list_agents.

Param	Type	Required	Default	Description
`id`	integer	yes		Numeric agent ID to uninstall (from huntress_list_agents).

huntress_update_agent details

[Huntress] Update a Huntress agent — set its tags and/or tamper-protection-configured flag. Tags are supplied as a comma-separated list and replace the agent's existing tags. Discover agent IDs via huntress_list_agents.

Param	Type	Required	Default	Description
`fieldsJson`	string	no	null	Additional body fields as a JSON object, merged into the request.
`id`	integer	yes		Numeric agent ID to update (from huntress_list_agents).
`tags`	string	no	null	Comma-separated list of tags to set on the agent (replaces existing tags).
`tamperProtectionConfigured`	boolean	no	null	When true, mark tamper protection as configured for this agent.

Identities

Tool	Plan	Access	Summary
`huntress_get_identity`	Free	Read-only	Get a single ITDR identity by its numeric ID — full user detail, risk level, MFA status, and tenant.
`huntress_list_identities`	Free	Read-only	List ITDR identities (Microsoft 365 / Google Workspace users) monitored by Huntress.

huntress_get_identity details

[Huntress] Get a single ITDR identity by its numeric ID — full user detail, risk level, MFA status, and tenant. Discover identity IDs via huntress_list_identities.

Param	Type	Required	Default	Description
`id`	integer	yes		Numeric identity ID (from huntress_list_identities).

huntress_list_identities details

[Huntress] List ITDR identities (Microsoft 365 / Google Workspace users) monitored by Huntress. Returns a paginated list with risk level, MFA status, billable/enabled/external flags, and tenant. Filter by organization, tenant type, billable, enabled, external, risk level, or MFA status. Use huntress_get_identity for full detail on one identity.

Param	Type	Required	Default	Description
`billable`	boolean	no	null	Filter by billable status (true\|false).
`enabled`	boolean	no	null	Filter by enabled status (true\|false).
`external`	boolean	no	null	Filter by external status (true\|false).
`limit`	integer	no	50	Max results per page (default 50, capped at 500 by the API).
`mfaEnabled`	boolean	no	null	Filter by MFA-enabled status (true\|false).
`organizationId`	integer	no	null	Filter to a single organization ID (from huntress_list_organizations).
`pageToken`	string	no	null	Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`riskLevel`	string	no	null	Filter by risk level: none\|low\|medium\|high.
`tenantType`	string	no	null	Filter by tenant type: microsoft_365\|google_workspace.

Incident Reports

Tool	Plan	Access	Summary
`huntress_approve_remediations`	Pro	Destructive	Approve the remediations recommended for a Huntress incident report, authorizing Huntress to apply them.
`huntress_get_incident_report`	Free	Read-only	Get a single incident report by its numeric ID — full threat detail, indicators, severity, status, and SOC narrative.
`huntress_get_remediation`	Free	Read-only	Get a single remediation by its ID, scoped to its parent incident report — full remediation detail, type, and status.
`huntress_list_incident_reports`	Free	Read-only	List incident reports — confirmed threats triaged by the Huntress SOC.
`huntress_list_remediations`	Free	Read-only	List the remediations attached to a specific incident report — the recommended or applied remediation steps (assisted, manual, or containment).
`huntress_reject_remediations`	Pro	Destructive	Reject the remediations recommended for a Huntress incident report, declining to apply them.
`huntress_resolve_incident_report`	Pro	Destructive	Resolve a Huntress incident report.

huntress_approve_remediations details

[Huntress] Approve the remediations recommended for a Huntress incident report, authorizing Huntress to apply them. This is a bodyless action — the Huntress API approves all pending remediations for the report and takes no parameters beyond the report ID. Discover incident report IDs via huntress_list_incident_reports and remediations via huntress_list_remediations.

Param	Type	Required	Default	Description
`incidentReportId`	integer	yes		Numeric incident report ID whose remediations to approve (from huntress_list_incident_reports).

huntress_get_incident_report details

[Huntress] Get a single incident report by its numeric ID — full threat detail, indicators, severity, status, and SOC narrative. Discover report IDs via huntress_list_incident_reports; see remediation steps with huntress_list_remediations.

Param	Type	Required	Default	Description
`id`	integer	yes		Numeric incident report ID (from huntress_list_incident_reports).

huntress_get_remediation details

[Huntress] Get a single remediation by its ID, scoped to its parent incident report — full remediation detail, type, and status. Discover remediation IDs via huntress_list_remediations.

Param	Type	Required	Default	Description
`incidentReportId`	integer	yes		Numeric incident report ID the remediation belongs to (from huntress_list_incident_reports).
`remediationId`	integer	yes		Numeric remediation ID (from huntress_list_remediations).

huntress_list_incident_reports details

[Huntress] List incident reports — confirmed threats triaged by the Huntress SOC. Returns a paginated list with indicator type, status, severity, platform, and the affected organization/agent. Filter by indicator type, status, severity, platform, organization, or agent. Use huntress_get_incident_report for full detail, and huntress_list_remediations to see the remediation steps for a report.

Param	Type	Required	Default	Description
`agentId`	integer	no	null	Filter to a single agent ID (from huntress_list_agents).
`indicatorType`	string	no	null	Filter by indicator type: footholds\|monitored_files\|ransomware_canaries\|antivirus_detections\|process_detections\|managed_identity\|mde_detections\|siem_detections\|favicon_detections\|behavioral_detections\|email_security_detections\|app_control\|ai_misuse.
`limit`	integer	no	50	Max results per page (default 50, capped at 500 by the API).
`organizationId`	integer	no	null	Filter to a single organization ID (from huntress_list_organizations).
`pageToken`	string	no	null	Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`platform`	string	no	null	Filter by platform: windows\|darwin\|microsoft_365\|google\|linux\|email_security\|other.
`severity`	string	no	null	Filter by severity: low\|high\|critical.
`sortDirection`	string	no	null	Sort direction: asc\|desc. Omit for default ordering.
`sortField`	string	no	null	Field to sort by: id\|created_at\|updated_at. Omit for default ordering.
`status`	string	no	null	Filter by status: sent\|closed\|dismissed\|auto_remediating\|deleting\|partner_dismissed.

huntress_list_remediations details

[Huntress] List the remediations attached to a specific incident report — the recommended or applied remediation steps (assisted, manual, or containment). Filter by remediation type or status. Paginated: when more pages exist, read next_page_token from the response's pagination object and pass it as pageToken. Use huntress_get_remediation for one remediation's full detail; discover incident report IDs via huntress_list_incident_reports.

Param	Type	Required	Default	Description
`incidentReportId`	integer	yes		Numeric incident report ID the remediations belong to (from huntress_list_incident_reports).
`limit`	integer	no	50	Max results per page (default 50, capped at 500 by the API).
`pageToken`	string	no	null	Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`sortDirection`	string	no	null	Sort direction: asc\|desc. Omit for default ordering.
`sortField`	string	no	null	Field to sort by: id\|created_at\|updated_at. Omit for default ordering.
`statuses`	string	no	null	Filter by comma-separated statuses: unapproved\|approved\|completed\|failed\|cancelled.
`types`	string	no	null	Filter by comma-separated remediation types: assisted\|manual\|containment.

huntress_reject_remediations details

[Huntress] Reject the remediations recommended for a Huntress incident report, declining to apply them. The Huntress API REQUIRES comment and useful. Discover incident report IDs via huntress_list_incident_reports and remediations via huntress_list_remediations.

Param	Type	Required	Default	Description
`comment`	string	yes		Why the remediations were rejected. Required. Helps the Huntress SOC fix the plan and re-issue the incident report.
`email`	string	no	null	Email for the Huntress SOC to contact. Falls back to the API key's user if omitted.
`fieldsJson`	string	no	null	Additional body fields as a JSON object, merged into the request after the typed fields.
`incidentReportId`	integer	yes		Numeric incident report ID whose remediations to reject (from huntress_list_incident_reports).
`name`	string	no	null	Name of the user rejecting. Falls back to the API key's user if omitted.
`phoneNumber`	string	no	null	Phone number for the Huntress SOC to contact. Falls back to the API key's user if omitted.
`useful`	boolean	yes		Whether the remediation plan was useful. Required.

huntress_resolve_incident_report details

[Huntress] Resolve a Huntress incident report. This is a bodyless action — the Huntress API takes no parameters beyond the report ID. Discover incident report IDs via huntress_list_incident_reports.

Param	Type	Required	Default	Description
`id`	integer	yes		Numeric incident report ID to resolve (from huntress_list_incident_reports).

Escalations

Tool	Plan	Access	Summary
`huntress_get_escalation`	Free	Read-only	Get a single escalation by its numeric ID — full detail, severity, status, due date, and the related organization.
`huntress_list_escalations`	Free	Read-only	List escalations — items the Huntress SOC has escalated to the partner for action.
`huntress_resolve_escalation`	Pro	Destructive	Resolve a Huntress escalation by recording a determination (expected vs unauthorized) and the scope it applies to (account, organization, or identity).

huntress_get_escalation details

[Huntress] Get a single escalation by its numeric ID — full detail, severity, status, due date, and the related organization. Discover escalation IDs via huntress_list_escalations.

Param	Type	Required	Default	Description
`id`	integer	yes		Numeric escalation ID (from huntress_list_escalations).

huntress_list_escalations details

[Huntress] List escalations — items the Huntress SOC has escalated to the partner for action. Returns a paginated list with status, severity, subtype, due date, and organization. Filter by status, severity, subtype, or organization. Use huntress_get_escalation for full detail on one escalation.

Param	Type	Required	Default	Description
`limit`	integer	no	50	Max results per page (default 50, capped at 500 by the API).
`organizationId`	integer	no	null	Filter to a single organization ID (from huntress_list_organizations).
`pageToken`	string	no	null	Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`severity`	string	no	null	Filter by severity: low\|high\|critical.
`sortDirection`	string	no	null	Sort direction: asc\|desc. Omit for default ordering.
`sortField`	string	no	null	Field to sort by: id\|severity\|due_at\|created_at\|updated_at. Omit for default ordering.
`status`	string	no	null	Filter by status: open\|overdue\|resolved.
`subtype`	string	no	null	Filter by escalation subtype.

huntress_resolve_escalation details

[Huntress] Resolve a Huntress escalation by recording a determination (expected vs unauthorized) and the scope it applies to (account, organization, or identity). Discover escalation IDs via huntress_list_escalations.

Param	Type	Required	Default	Description
`determination`	string	no	null	Determination: expected\|unauthorized.
`fieldsJson`	string	no	null	Additional body fields as a JSON object, merged into the request.
`id`	integer	yes		Numeric escalation ID to resolve (from huntress_list_escalations).
`scope`	string	no	null	Scope the determination applies to: account\|organization\|identity.

Platform Actions

Tool	Plan	Access	Summary
`huntress_get_platform_action`	Free	Read-only	Get a single platform action by its numeric ID — full detail, severity, status, and the related organization.
`huntress_list_platform_actions`	Free	Read-only	List platform actions — actions requested or taken on the Huntress platform.

huntress_get_platform_action details

[Huntress] Get a single platform action by its numeric ID — full detail, severity, status, and the related organization. Discover platform action IDs via huntress_list_platform_actions.

Param	Type	Required	Default	Description
`id`	integer	yes		Numeric platform action ID (from huntress_list_platform_actions).

huntress_list_platform_actions details

[Huntress] List platform actions — actions requested or taken on the Huntress platform. Returns a paginated list with status, severity, subtype, and organization. Filter by status, severity, subtype, or organization. Use huntress_get_platform_action for full detail on one action.

Param	Type	Required	Default	Description
`limit`	integer	no	50	Max results per page (default 50, capped at 500 by the API).
`organizationId`	integer	no	null	Filter to a single organization ID (from huntress_list_organizations).
`pageToken`	string	no	null	Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`severity`	string	no	null	Filter by severity: low\|high\|critical.
`sortDirection`	string	no	null	Sort direction: asc\|desc. Omit for default ordering.
`sortField`	string	no	null	Field to sort by: id\|severity\|due_at\|created_at\|updated_at. Omit for default ordering.
`status`	string	no	null	Filter by status: open\|overdue\|resolved.
`subtype`	string	no	null	Filter by platform action subtype.

Signals

Tool	Plan	Access	Summary
`huntress_get_signal`	Free	Read-only	Get a single security signal by its numeric ID — full detail, type, status, related entity, and investigation timeline.
`huntress_list_signals`	Free	Read-only	List security signals — investigated detections tied to entities (users, mailboxes, agents, identities).

huntress_get_signal details

[Huntress] Get a single security signal by its numeric ID — full detail, type, status, related entity, and investigation timeline. Discover signal IDs via huntress_list_signals.

Param	Type	Required	Default	Description
`id`	integer	yes		Numeric signal ID (from huntress_list_signals).

huntress_list_signals details

[Huntress] List security signals — investigated detections tied to entities (users, mailboxes, agents, identities). Returns a paginated list with status, type, the related entity, and investigation timestamps. Filter by investigated-at window, entity, organization, type, or status. Use huntress_get_signal for full detail on one signal.

Param	Type	Required	Default	Description
`entityId`	string	no	null	Filter to a single entity ID. Must be paired with entityType.
`entityType`	string	no	null	Filter by entity type: user_entity\|source\|mailbox\|service_principal\|agent\|identity. Required when entityId is supplied.
`investigatedAtMax`	string	no	null	Filter to signals investigated at or before this ISO-8601 timestamp.
`investigatedAtMin`	string	no	null	Filter to signals investigated at or after this ISO-8601 timestamp.
`limit`	integer	no	50	Max results per page (default 50, capped at 500 by the API).
`organizationId`	integer	no	null	Filter to a single organization ID (from huntress_list_organizations).
`pageToken`	string	no	null	Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`sortDirection`	string	no	null	Sort direction: asc\|desc. Omit for default ordering.
`sortField`	string	no	null	Field to sort by: id\|created_at\|updated_at\|status. Omit for default ordering.
`statuses`	string	no	null	Filter by comma-separated statuses: reported\|closed.
`types`	string	no	null	Filter by comma-separated signal types.

Organizations

Tool	Plan	Access	Summary
`huntress_create_organization`	Pro	Write	Create a new organization within the Huntress account.
`huntress_delete_organization`	Pro	Destructive	Delete a Huntress organization.
`huntress_get_organization`	Free	Read-only	Get a single organization by its numeric ID — full detail, name, key, and metadata.
`huntress_list_organizations`	Free	Read-only	List the customer organizations under the account.
`huntress_update_organization`	Pro	Write	Update a Huntress organization — rename it.

huntress_create_organization details

[Huntress] Create a new organization within the Huntress account. Both name and key are REQUIRED by the Huntress API. List existing organizations via huntress_list_organizations.

Param	Type	Required	Default	Description
`fieldsJson`	string	no	null	Additional body fields as a JSON object, merged into the request after the typed fields.
`key`	string	yes		Unique key/identifier for the new organization. Required.
`name`	string	yes		Name for the new organization. Required.

huntress_delete_organization details

[Huntress] Delete a Huntress organization. This is IRREVERSIBLE — the organization and its associations are removed. Discover organization IDs via huntress_list_organizations.

Param	Type	Required	Default	Description
`id`	integer	yes		Numeric organization ID to delete (from huntress_list_organizations).

huntress_get_organization details

[Huntress] Get a single organization by its numeric ID — full detail, name, key, and metadata. Discover organization IDs via huntress_list_organizations.

Param	Type	Required	Default	Description
`id`	integer	yes		Numeric organization ID (from huntress_list_organizations).

huntress_list_organizations details

[Huntress] List the customer organizations under the account. Returns a paginated list with name, key, and metadata. The organization `id` returned here is the `organizationId` filter used across huntress_list_agents, huntress_list_identities, huntress_list_incident_reports, huntress_list_signals, and more. Filter by name or key; use huntress_get_organization for full detail.

Param	Type	Required	Default	Description
`key`	string	no	null	Filter by organization key.
`limit`	integer	no	50	Max results per page (default 50, capped at 500 by the API).
`name`	string	no	null	Filter by organization name.
`pageToken`	string	no	null	Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`sortDirection`	string	no	null	Sort direction: asc\|desc. Omit for default ordering.
`sortField`	string	no	null	Field to sort by: id\|created_at\|updated_at\|name\|key. Omit for default ordering.

huntress_update_organization details

[Huntress] Update a Huntress organization — rename it. Discover organization IDs via huntress_list_organizations.

Param	Type	Required	Default	Description
`fieldsJson`	string	no	null	Additional body fields as a JSON object, merged into the request.
`id`	integer	yes		Numeric organization ID to update (from huntress_list_organizations).
`name`	string	no	null	New name for the organization.

Memberships

Tool	Plan	Access	Summary
`huntress_create_membership`	Pro	Write	Invite a user to the Huntress account by creating a membership.
`huntress_delete_membership`	Pro	Destructive	Delete a Huntress membership, revoking the member's access to the account.
`huntress_get_membership`	Free	Read-only	Get a single membership by its numeric ID — full detail, the user, organization, and permission role.
`huntress_list_memberships`	Free	Read-only	List memberships — the user-to-organization access grants and their permission roles.
`huntress_update_membership`	Pro	Write	Update a Huntress membership — change the member's permissions.

huntress_create_membership details

[Huntress] Invite a user to the Huntress account by creating a membership. The Huntress API REQUIRES email, first name, last name, and permissions. Optionally scope the membership to an organization. List existing memberships via huntress_list_memberships.

Param	Type	Required	Default	Description
`email`	string	yes		Email address of the user to invite. Required.
`fieldsJson`	string	no	null	Additional body fields as a JSON object, merged into the request after the typed fields.
`firstName`	string	yes		First name of the user. Required.
`lastName`	string	yes		Last name of the user. Required.
`organizationId`	integer	no	null	Optional organization ID to scope the membership to (from huntress_list_organizations).
`permissions`	string	yes		Permissions to grant the new member. Required. One of: Admin, Security Engineer, User, Read-only, Finance, Marketing, Provisioner.

huntress_delete_membership details

[Huntress] Delete a Huntress membership, revoking the member's access to the account. This is IRREVERSIBLE — it removes the membership but does NOT delete the underlying user. Discover membership IDs via huntress_list_memberships.

Param	Type	Required	Default	Description
`id`	integer	yes		Numeric membership ID to delete (from huntress_list_memberships).

huntress_get_membership details

[Huntress] Get a single membership by its numeric ID — full detail, the user, organization, and permission role. Discover membership IDs via huntress_list_memberships.

Param	Type	Required	Default	Description
`id`	integer	yes		Numeric membership ID (from huntress_list_memberships).

huntress_list_memberships details

[Huntress] List memberships — the user-to-organization access grants and their permission roles. Returns a paginated list with user, organization, and permissions. Filter by organization, user, or permission role. Use huntress_get_membership for full detail on one membership.

Param	Type	Required	Default	Description
`limit`	integer	no	50	Max results per page (default 50, capped at 500 by the API).
`organizationId`	integer	no	null	Filter to a single organization ID (from huntress_list_organizations).
`pageToken`	string	no	null	Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`permissions`	string	no	null	Filter by permission role: Admin\|Security Engineer\|User\|Read-only\|Finance\|Marketing\|Provisioner.
`sortDirection`	string	no	null	Sort direction: asc\|desc. Omit for default ordering.
`sortField`	string	no	null	Field to sort by: id\|user_id\|created_at\|updated_at. Omit for default ordering.
`userId`	integer	no	null	Filter to a single user ID.

huntress_update_membership details

[Huntress] Update a Huntress membership — change the member's permissions. Discover membership IDs via huntress_list_memberships.

Param	Type	Required	Default	Description
`fieldsJson`	string	no	null	Additional body fields as a JSON object, merged into the request.
`id`	integer	yes		Numeric membership ID to update (from huntress_list_memberships).
`permissions`	string	no	null	New permissions to set for the member.

Invoices

Tool	Plan	Access	Summary
`huntress_get_invoice`	Free	Read-only	Get a single invoice by its numeric ID — full billing detail, status, line items, and amounts.
`huntress_list_invoices`	Free	Read-only	List billing invoices for the account.

huntress_get_invoice details

[Huntress] Get a single invoice by its numeric ID — full billing detail, status, line items, and amounts. Discover invoice IDs via huntress_list_invoices.

Param	Type	Required	Default	Description
`id`	integer	yes		Numeric invoice ID (from huntress_list_invoices).

huntress_list_invoices details

[Huntress] List billing invoices for the account. Returns a paginated list with status, amounts, and usage flags. Filter by status or whether the invoice has usage. Use huntress_get_invoice for full detail on one invoice.

Param	Type	Required	Default	Description
`hasUsage`	boolean	no	null	Filter to invoices that have (true) or do not have (false) usage.
`limit`	integer	no	50	Max results per page (default 50, capped at 500 by the API).
`pageToken`	string	no	null	Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`sortDirection`	string	no	null	Sort direction: asc\|desc. Omit for default ordering.
`sortField`	string	no	null	Field to sort by: id\|created_at\|updated_at\|status. Omit for default ordering.
`status`	string	no	null	Filter by status: open\|paid\|failed\|partial_refund\|full_refund\|draft\|voided\|processing.

External Recon

Tool	Plan	Access	Summary
`huntress_get_external_port`	Free	Read-only	Get a single External Recon port finding by its numeric ID — full detail, protocol, port, service, and risk classification.
`huntress_list_external_ports`	Free	Read-only	List externally-discovered open ports and exposed services found by Huntress External Recon.

huntress_get_external_port details

[Huntress] Get a single External Recon port finding by its numeric ID — full detail, protocol, port, service, and risk classification. Discover finding IDs via huntress_list_external_ports.

Param	Type	Required	Default	Description
`id`	integer	yes		Numeric external port finding ID (from huntress_list_external_ports).

huntress_list_external_ports details

[Huntress] List externally-discovered open ports and exposed services found by Huntress External Recon. Returns a paginated list with protocol, port, service, and risky-service flag. Filter by organization, protocol, port, risky-service, or service name. Use huntress_get_external_port for full detail on one finding.

Param	Type	Required	Default	Description
`limit`	integer	no	50	Max results per page (default 50, capped at 500 by the API).
`organizationId`	integer	no	null	Filter to a single organization ID (from huntress_list_organizations).
`pageToken`	string	no	null	Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`port`	integer	no	null	Filter to a single port number.
`protocol`	string	no	null	Filter by protocol: TCP\|UDP.
`riskyService`	boolean	no	null	Filter to only risky (true) or non-risky (false) services.
`service`	string	no	null	Filter by service name.
`sortDirection`	string	no	null	Sort direction: asc\|desc. Omit for default ordering.
`sortField`	string	no	null	Field to sort by: id\|port\|protocol\|created_at\|updated_at. Omit for default ordering.

Summary Reports

Tool	Plan	Access	Summary
`huntress_get_report`	Free	Read-only	Get a single summary report by its numeric ID — full report detail, type, period, and the related organization.
`huntress_list_reports`	Free	Read-only	List summary reports — periodic monthly/quarterly/yearly account and organization summaries.

huntress_get_report details

[Huntress] Get a single summary report by its numeric ID — full report detail, type, period, and the related organization. Discover report IDs via huntress_list_reports.

Param	Type	Required	Default	Description
`id`	integer	yes		Numeric summary report ID (from huntress_list_reports).

huntress_list_reports details

[Huntress] List summary reports — periodic monthly/quarterly/yearly account and organization summaries. Returns a paginated list with report type, period, and organization. Filter by period window, organization, or report type. Use huntress_get_report for full detail on one report.

Param	Type	Required	Default	Description
`limit`	integer	no	50	Max results per page (default 50, capped at 500 by the API).
`organizationId`	integer	no	null	Filter to a single organization ID (from huntress_list_organizations).
`pageToken`	string	no	null	Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`periodMax`	string	no	null	Filter to reports whose period is at or before this ISO-8601 timestamp.
`periodMin`	string	no	null	Filter to reports whose period is at or after this ISO-8601 timestamp.
`sortDirection`	string	no	null	Sort direction: asc\|desc. Omit for default ordering.
`sortField`	string	no	null	Field to sort by: id\|created_at\|updated_at. Omit for default ordering.
`type`	string	no	null	Filter by report type: monthly_summary\|quarterly_summary\|yearly_summary.

Unwanted Access Rules

Tool	Plan	Access	Summary
`huntress_create_unwanted_access_rule`	Pro	Write	Create an unwanted-access rule that classifies identity sign-ins as expected or unauthorized.
`huntress_delete_unwanted_access_rule`	Pro	Destructive	Delete an unwanted-access rule.
`huntress_get_unwanted_access_rule`	Free	Read-only	Get a single unwanted access rule by its numeric ID — full detail, type, status, scope, category, and matching logic.
`huntress_list_known_vpns`	Free	Read-only	List the reference catalog of known VPN providers recognized by Huntress ITDR.
`huntress_list_unwanted_access_rules`	Free	Read-only	List unwanted access rules — ITDR location/VPN access policies that flag expected vs. unauthorized sign-in sources.
`huntress_update_unwanted_access_rule`	Pro	Write	Update an unwanted-access rule.

huntress_create_unwanted_access_rule details

[Huntress] Create an unwanted-access rule that classifies identity sign-ins as expected or unauthorized. The Huntress API REQUIRES type (expected|unauthorized). Set an optional category (country|vpn) and its match (countryCode or vpn), the matching logic, an active window (startsAt/expiresAt), and notes. List existing rules via huntress_list_unwanted_access_rules.

Param	Type	Required	Default	Description
`category`	string	no	null	Rule category: country\|vpn.
`countryCode`	string	no	null	Country code to match when category=country.
`expiresAt`	string	no	null	ISO-8601 timestamp when the rule expires.
`fieldsJson`	string	no	null	Additional body fields as a JSON object, merged into the request.
`identityId`	integer	no	null	Limit the rule to a single identity ID (from huntress_list_identities).
`logic`	string	no	null	Matching logic: standard\|catchall\|catchall_exception.
`notes`	string	no	null	Free-text notes for the rule.
`organizationId`	integer	no	null	Limit the rule to a single organization ID (from huntress_list_organizations).
`startsAt`	string	no	null	ISO-8601 timestamp when the rule becomes active.
`type`	string	yes		Rule type. Required. One of: expected\|unauthorized.
`vpn`	string	no	null	VPN to match when category=vpn (from huntress_list_known_vpns).

huntress_delete_unwanted_access_rule details

[Huntress] Delete an unwanted-access rule. This is IRREVERSIBLE — the rule is removed and no longer classifies sign-ins. Discover rule IDs via huntress_list_unwanted_access_rules.

Param	Type	Required	Default	Description
`id`	integer	yes		Numeric rule ID to delete (from huntress_list_unwanted_access_rules).

huntress_get_unwanted_access_rule details

[Huntress] Get a single unwanted access rule by its numeric ID — full detail, type, status, scope, category, and matching logic. Discover rule IDs via huntress_list_unwanted_access_rules.

Param	Type	Required	Default	Description
`id`	integer	yes		Numeric unwanted access rule ID (from huntress_list_unwanted_access_rules).

huntress_list_known_vpns details

[Huntress] List the reference catalog of known VPN providers recognized by Huntress ITDR. Returns the full list (no pagination, no parameters). Use these VPN identifiers when interpreting or building vpn-category unwanted access rules (see huntress_list_unwanted_access_rules).

huntress_list_unwanted_access_rules details

[Huntress] List unwanted access rules — ITDR location/VPN access policies that flag expected vs. unauthorized sign-in sources. Returns a paginated list with type, status, scope, category, and matching logic. Filter by organization, identity, type, status, scope, category, country code, VPN, or logic. Use huntress_get_unwanted_access_rule for full detail, and huntress_list_known_vpns for the VPN reference list.

Param	Type	Required	Default	Description
`category`	string	no	null	Filter by category: country\|vpn.
`countryCode`	string	no	null	Filter by ISO country code (for country-category rules).
`identityId`	integer	no	null	Filter to a single identity ID (from huntress_list_identities).
`limit`	integer	no	50	Max results per page (default 50, capped at 500 by the API).
`logic`	string	no	null	Filter by matching logic: standard\|catchall\|catchall_exception.
`organizationId`	integer	no	null	Filter to a single organization ID (from huntress_list_organizations).
`pageToken`	string	no	null	Pagination cursor. Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`scope`	string	no	null	Filter by scope: account\|organization\|identity.
`status`	string	no	null	Filter by status: active\|scheduled\|expired.
`type`	string	no	null	Filter by rule type: expected\|unauthorized.
`vpn`	string	no	null	Filter by VPN provider (for vpn-category rules).

huntress_update_unwanted_access_rule details

[Huntress] Update an unwanted-access rule. Only the active window (startsAt/expiresAt) and notes can be changed. Discover rule IDs via huntress_list_unwanted_access_rules.

Param	Type	Required	Default	Description
`expiresAt`	string	no	null	ISO-8601 timestamp when the rule expires.
`fieldsJson`	string	no	null	Additional body fields as a JSON object, merged into the request.
`id`	integer	yes		Numeric rule ID to update (from huntress_list_unwanted_access_rules).
`notes`	string	no	null	Free-text notes for the rule.
`startsAt`	string	no	null	ISO-8601 timestamp when the rule becomes active.

Managed Accounts (Reseller)

Tool	Plan	Access	Summary
`huntress_approve_managed_account_remediations`	Pro	Destructive	Approve remediations for an incident report within a reseller-managed account selected by accountId.
`huntress_create_managed_account`	Pro	Destructive	Create a new reseller-managed account.
`huntress_create_managed_account_membership`	Pro	Write	Invite a user (create a membership) within a reseller-managed account selected by accountId.
`huntress_create_managed_account_organization`	Pro	Write	Create an organization within a reseller-managed account selected by accountId.
`huntress_delete_managed_account_membership`	Pro	Destructive	Delete a user membership within a reseller-managed account selected by accountId.
`huntress_delete_managed_account_organization`	Pro	Destructive	Delete an organization within a reseller-managed account selected by accountId.
`huntress_disable_managed_account`	Pro	Destructive	PERMANENTLY disable a reseller-managed account.
`huntress_get_managed_account`	Free	Read-only	Get a single reseller-managed account by accountId (discoverable via huntress_list_managed_accounts).
`huntress_get_managed_account_agent`	Free	Read-only	Get a single agent within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts).
`huntress_get_managed_account_external_port`	Free	Read-only	Get a single external-recon open port within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts).
`huntress_get_managed_account_incident_report`	Free	Read-only	Get a single incident report within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts).
`huntress_get_managed_account_invoice`	Free	Read-only	Get a single invoice for a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts).
`huntress_get_managed_account_membership`	Free	Read-only	Get a single membership within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts).
`huntress_get_managed_account_organization`	Free	Read-only	Get a single organization within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts).
`huntress_get_managed_account_remediation`	Free	Read-only	Get a single remediation for an incident report within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts).
`huntress_get_managed_account_report`	Free	Read-only	Get a single summary report within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts).
`huntress_get_managed_account_signal`	Free	Read-only	Get a single investigation signal within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts).
`huntress_isolate_managed_account_agent`	Pro	Destructive	Network-isolate an agent within a reseller-managed account selected by accountId.
`huntress_list_managed_account_agents`	Free	Read-only	List deployed agents within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts).
`huntress_list_managed_account_external_ports`	Free	Read-only	List external-recon open ports discovered within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts).
`huntress_list_managed_account_incident_reports`	Free	Read-only	List incident reports within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts).
`huntress_list_managed_account_invoices`	Free	Read-only	List invoices for a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts).
`huntress_list_managed_account_memberships`	Free	Read-only	List user memberships within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts).
`huntress_list_managed_account_organizations`	Free	Read-only	List organizations within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts).
`huntress_list_managed_account_remediations`	Free	Read-only	List remediations for an incident report within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts).
`huntress_list_managed_account_reports`	Free	Read-only	List summary reports within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts).
`huntress_list_managed_account_signals`	Free	Read-only	List investigation signals within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts).
`huntress_list_managed_accounts`	Free	Read-only	List the reseller-managed accounts available to the current credentials.
`huntress_reject_managed_account_remediations`	Pro	Destructive	Reject remediations for an incident report within a reseller-managed account selected by accountId.
`huntress_release_managed_account_agent_isolation`	Pro	Destructive	Release network isolation on an agent within a reseller-managed account selected by accountId.
`huntress_resolve_managed_account_incident_report`	Pro	Destructive	Resolve an incident report within a reseller-managed account selected by accountId.
`huntress_uninstall_managed_account_agent`	Pro	Destructive	Uninstall an agent within a reseller-managed account selected by accountId.
`huntress_update_managed_account`	Pro	Write	Update a reseller-managed account.
`huntress_update_managed_account_agent`	Pro	Write	Update an agent within a reseller-managed account selected by accountId (tags, tamper-protection config).
`huntress_update_managed_account_membership`	Pro	Write	Update a user membership's permissions within a reseller-managed account selected by accountId.
`huntress_update_managed_account_organization`	Pro	Write	Update an organization within a reseller-managed account selected by accountId.

huntress_approve_managed_account_remediations details

[Huntress] Approve remediations for an incident report within a reseller-managed account selected by accountId. This is a bodyless action — the Huntress API approves all pending remediations for the report and takes no parameters beyond the path identifiers. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`incidentReportId`	integer	yes		Numeric ID of the incident report whose remediations to approve.

huntress_create_managed_account details

[Huntress] Create a new reseller-managed account. The Huntress API REQUIRES name, subdomain, phone number, and an initial admin user (first name, last name, email). Requires reseller-level API credentials.

Param	Type	Required	Default	Description
`adminEmail`	string	yes		Email address of the initial admin user for this account. Required.
`adminFirstName`	string	yes		First name of the initial admin user for this account. Required.
`adminLastName`	string	yes		Last name of the initial admin user for this account. Required.
`fieldsJson`	string	no	null	Additional body fields (e.g. support_type, products, billing_address) as a JSON object, merged into the request after the typed fields.
`name`	string	yes		Display name of the managed account. Required.
`phoneNumber`	string	yes		Primary phone number used to contact the account owner. Required.
`subdomain`	string	yes		Subdomain for the managed account (e.g. 'acme' for acme.huntress.io). Required.

huntress_create_managed_account_membership details

[Huntress] Invite a user (create a membership) within a reseller-managed account selected by accountId. The Huntress API REQUIRES email, first name, last name, and permissions. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`email`	string	yes		Email address of the user to invite. Required.
`fieldsJson`	string	no	null	Additional body fields as a JSON object, merged into the request after the typed fields.
`firstName`	string	yes		First name of the user. Required.
`lastName`	string	yes		Last name of the user. Required.
`organizationId`	integer	no	null	Optional organization ID to scope the membership to.
`permissions`	string	yes		Permission/role to grant. Required. One of: Admin, Security Engineer, User, Read-only, Finance, Marketing, Provisioner.

huntress_create_managed_account_organization details

[Huntress] Create an organization within a reseller-managed account selected by accountId. The Huntress API REQUIRES name and key. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`fieldsJson`	string	no	null	Additional body fields as a JSON object, merged into the request after the typed fields.
`key`	string	yes		Unique key/identifier for the organization. Required.
`name`	string	yes		Name of the organization to create. Required.

huntress_delete_managed_account_membership details

[Huntress] Delete a user membership within a reseller-managed account selected by accountId. This removes the membership only; it does not delete the user. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`id`	integer	yes		Numeric ID of the membership to delete.

huntress_delete_managed_account_organization details

[Huntress] Delete an organization within a reseller-managed account selected by accountId. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`id`	integer	yes		Numeric ID of the organization to delete.

huntress_disable_managed_account details

[Huntress] PERMANENTLY disable a reseller-managed account. This is irreversible: it disables the account and uninstalls ALL of its agents after 10 days. Requires reseller-level API credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account to disable (from huntress_list_managed_accounts).

huntress_get_managed_account details

[Huntress] Get a single reseller-managed account by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.

huntress_get_managed_account_agent details

[Huntress] Get a single agent within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`id`	integer	yes		Numeric ID of the agent.

huntress_get_managed_account_external_port details

[Huntress] Get a single external-recon open port within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`id`	integer	yes		Numeric ID of the external port record.

huntress_get_managed_account_incident_report details

[Huntress] Get a single incident report within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`id`	integer	yes		Numeric ID of the incident report.

huntress_get_managed_account_invoice details

[Huntress] Get a single invoice for a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`id`	integer	yes		Numeric ID of the invoice.

huntress_get_managed_account_membership details

[Huntress] Get a single membership within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`id`	integer	yes		Numeric ID of the membership.

huntress_get_managed_account_organization details

[Huntress] Get a single organization within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`id`	integer	yes		Numeric ID of the organization.

huntress_get_managed_account_remediation details

[Huntress] Get a single remediation for an incident report within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials.

Param	Type	Required	Description
`accountId`	integer	yes	Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`incidentReportId`	integer	yes	Numeric ID of the incident report the remediation belongs to.
`remediationId`	integer	yes	Numeric ID of the remediation.

huntress_get_managed_account_report details

[Huntress] Get a single summary report within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`id`	integer	yes		Numeric ID of the summary report.

huntress_get_managed_account_signal details

[Huntress] Get a single investigation signal within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`id`	integer	yes		Numeric ID of the signal.

huntress_isolate_managed_account_agent details

[Huntress] Network-isolate an agent within a reseller-managed account selected by accountId. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`fieldsJson`	string	no	null	Additional body fields as a JSON object, merged into the request.
`id`	integer	yes		Numeric ID of the agent to isolate.
`reason`	string	no	null	Optional reason for the isolation.
`strictIsolation`	boolean	no	null	When true, applies strict isolation (blocks all traffic except Huntress).

huntress_list_managed_account_agents details

[Huntress] List deployed agents within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials. Paginated.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`hostname`	string	no	null	Filter by hostname.
`limit`	integer	no	50	Max results per page (default 50, max 500).
`organizationId`	integer	no	null	Filter by organization ID.
`os`	string	no	null	Filter by operating system.
`pageToken`	string	no	null	Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`platform`	string	no	null	Filter by platform: windows\|darwin\|linux.
`sortDirection`	string	no	null	Sort direction: asc\|desc.
`sortField`	string	no	null	Field to sort by: id\|created_at\|updated_at.
`version`	string	no	null	Filter by agent version.

huntress_list_managed_account_external_ports details

[Huntress] List external-recon open ports discovered within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials. Paginated.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`limit`	integer	no	50	Max results per page (default 50, max 500).
`organizationId`	integer	no	null	Filter by organization ID.
`pageToken`	string	no	null	Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`port`	integer	no	null	Filter by port number.
`protocol`	string	no	null	Filter by protocol: TCP\|UDP.
`riskyService`	boolean	no	null	Filter to risky services only (true/false).
`service`	string	no	null	Filter by service name.
`sortDirection`	string	no	null	Sort direction: asc\|desc.
`sortField`	string	no	null	Field to sort by: id\|port\|protocol\|created_at\|updated_at.

huntress_list_managed_account_incident_reports details

[Huntress] List incident reports within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials. Paginated.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`agentId`	integer	no	null	Filter by agent ID.
`indicatorType`	string	no	null	Filter by indicator type: footholds\|monitored_files\|ransomware_canaries\|antivirus_detections\|process_detections\|managed_identity\|mde_detections\|siem_detections\|favicon_detections\|behavioral_detections\|email_security_detections\|app_control\|ai_misuse.
`limit`	integer	no	50	Max results per page (default 50, max 500).
`organizationId`	integer	no	null	Filter by organization ID.
`pageToken`	string	no	null	Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`platform`	string	no	null	Filter by platform: windows\|darwin\|microsoft_365\|google\|linux\|email_security\|other.
`severity`	string	no	null	Filter by severity: low\|high\|critical.
`sortDirection`	string	no	null	Sort direction: asc\|desc.
`sortField`	string	no	null	Field to sort by (e.g. id, created_at, updated_at).
`status`	string	no	null	Filter by status: sent\|closed\|dismissed\|auto_remediating\|deleting\|partner_dismissed.

huntress_list_managed_account_invoices details

[Huntress] List invoices for a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials. Paginated.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`hasUsage`	boolean	no	null	Filter to invoices that have usage (true/false).
`limit`	integer	no	50	Max results per page (default 50, max 500).
`pageToken`	string	no	null	Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`sortDirection`	string	no	null	Sort direction: asc\|desc.
`sortField`	string	no	null	Field to sort by: id\|created_at\|updated_at\|status.
`status`	string	no	null	Filter by status: open\|paid\|failed\|partial_refund\|full_refund\|draft\|voided\|processing.

huntress_list_managed_account_memberships details

[Huntress] List user memberships within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials. Paginated.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`limit`	integer	no	50	Max results per page (default 50, max 500).
`organizationId`	integer	no	null	Filter by organization ID.
`pageToken`	string	no	null	Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`permissions`	string	no	null	Filter by permission: Admin\|Security Engineer\|User\|Read-only\|Finance\|Marketing\|Provisioner.
`sortDirection`	string	no	null	Sort direction: asc\|desc.
`sortField`	string	no	null	Field to sort by: id\|user_id\|created_at\|updated_at.
`userId`	integer	no	null	Filter by user ID.

huntress_list_managed_account_organizations details

[Huntress] List organizations within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials. Paginated.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`key`	string	no	null	Filter by organization key.
`limit`	integer	no	50	Max results per page (default 50, max 500).
`name`	string	no	null	Filter by organization name.
`pageToken`	string	no	null	Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`sortDirection`	string	no	null	Sort direction: asc\|desc.
`sortField`	string	no	null	Field to sort by: id\|created_at\|updated_at\|name\|key.

huntress_list_managed_account_remediations details

[Huntress] List remediations for an incident report within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials. Paginated: when more pages exist, read next_page_token from the response's pagination object and pass it as pageToken.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`incidentReportId`	integer	yes		Numeric ID of the incident report whose remediations to list.
`limit`	integer	no	50	Max results per page (default 50, max 500).
`pageToken`	string	no	null	Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`sortDirection`	string	no	null	Sort direction: asc\|desc.
`sortField`	string	no	null	Field to sort by (e.g. id, created_at, updated_at).
`statuses`	string	no	null	Comma-separated list of remediation statuses: unapproved\|approved\|completed\|failed\|cancelled.
`types`	string	no	null	Comma-separated list of remediation types: assisted\|manual\|containment.

huntress_list_managed_account_reports details

[Huntress] List summary reports within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials. Paginated.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`limit`	integer	no	50	Max results per page (default 50, max 500).
`organizationId`	integer	no	null	Filter by organization ID.
`pageToken`	string	no	null	Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`periodMax`	string	no	null	Filter to reports with period on/before this ISO-8601 timestamp.
`periodMin`	string	no	null	Filter to reports with period on/after this ISO-8601 timestamp.
`sortDirection`	string	no	null	Sort direction: asc\|desc.
`sortField`	string	no	null	Field to sort by: id\|created_at\|updated_at.
`type`	string	no	null	Filter by report type: monthly_summary\|quarterly_summary\|yearly_summary.

huntress_list_managed_account_signals details

[Huntress] List investigation signals within a reseller-managed account selected by accountId (discoverable via huntress_list_managed_accounts). Requires reseller-level API credentials. Paginated.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`entityId`	string	no	null	Filter by entity ID. Must be paired with entityType.
`entityType`	string	no	null	Filter by entity type: user_entity\|source\|mailbox\|service_principal\|agent\|identity. Required when entityId is set.
`investigatedAtMax`	string	no	null	Filter to signals investigated on/before this ISO-8601 timestamp.
`investigatedAtMin`	string	no	null	Filter to signals investigated on/after this ISO-8601 timestamp.
`limit`	integer	no	50	Max results per page (default 50, max 500).
`organizationId`	integer	no	null	Filter by organization ID.
`pageToken`	string	no	null	Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`sortDirection`	string	no	null	Sort direction: asc\|desc.
`sortField`	string	no	null	Field to sort by: id\|created_at\|updated_at\|status.
`statuses`	string	no	null	Comma-separated list of signal statuses: reported\|closed.
`types`	string	no	null	Comma-separated list of signal types.

huntress_list_managed_accounts details

[Huntress] List the reseller-managed accounts available to the current credentials. Use this to discover the accountId required by every other Managed Account tool. Requires reseller-level API credentials. Paginated.

Param	Type	Required	Default	Description
`limit`	integer	no	50	Max results per page (default 50, max 500).
`name`	string	no	null	Filter by account name.
`pageToken`	string	no	null	Use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.
`sortDirection`	string	no	null	Sort direction: asc\|desc.
`sortField`	string	no	null	Field to sort by (e.g. id, created_at, updated_at, name).
`status`	string	no	null	Filter by account status: enabled\|disabled.
`subdomain`	string	no	null	Filter by account subdomain.

huntress_reject_managed_account_remediations details

[Huntress] Reject remediations for an incident report within a reseller-managed account selected by accountId. The Huntress API REQUIRES comment and useful. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`comment`	string	yes		Why the remediations were rejected. Required. Helps the Huntress SOC fix the plan and re-issue the incident report.
`email`	string	no	null	Email for the Huntress SOC to contact. Falls back to the API key's user if omitted.
`fieldsJson`	string	no	null	Additional body fields as a JSON object, merged into the request after the typed fields.
`incidentReportId`	integer	yes		Numeric ID of the incident report whose remediations to reject.
`name`	string	no	null	Name of the user rejecting. Falls back to the API key's user if omitted.
`phoneNumber`	string	no	null	Phone number for the Huntress SOC to contact. Falls back to the API key's user if omitted.
`useful`	boolean	yes		Whether the remediation plan was useful. Required.

huntress_release_managed_account_agent_isolation details

[Huntress] Release network isolation on an agent within a reseller-managed account selected by accountId. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`id`	integer	yes		Numeric ID of the agent whose isolation to release.

huntress_resolve_managed_account_incident_report details

[Huntress] Resolve an incident report within a reseller-managed account selected by accountId. This is a bodyless action — the Huntress API takes no parameters beyond the path identifiers. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`id`	integer	yes		Numeric ID of the incident report to resolve.

huntress_uninstall_managed_account_agent details

[Huntress] Uninstall an agent within a reseller-managed account selected by accountId. This is an asynchronous, irreversible removal of the agent. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`id`	integer	yes		Numeric ID of the agent to uninstall.

huntress_update_managed_account details

[Huntress] Update a reseller-managed account. Requires reseller-level API credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts).
`fieldsJson`	string	no	null	Additional body fields as a JSON object, merged into the request.
`name`	string	no	null	New display name for the managed account.

huntress_update_managed_account_agent details

[Huntress] Update an agent within a reseller-managed account selected by accountId (tags, tamper-protection config). Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`fieldsJson`	string	no	null	Additional body fields as a JSON object, merged into the request.
`id`	integer	yes		Numeric ID of the agent to update.
`tags`	string	no	null	Comma-separated list of tags to set on the agent.
`tamperProtectionConfigured`	boolean	no	null	Whether tamper protection is configured for the agent.

huntress_update_managed_account_membership details

[Huntress] Update a user membership's permissions within a reseller-managed account selected by accountId. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`fieldsJson`	string	no	null	Additional body fields as a JSON object, merged into the request.
`id`	integer	yes		Numeric ID of the membership to update.
`permissions`	string	no	null	New permission/role to grant (e.g. Admin, Security Engineer, User, Read-only).

huntress_update_managed_account_organization details

[Huntress] Update an organization within a reseller-managed account selected by accountId. Targets a reseller-managed account (from huntress_list_managed_accounts); requires reseller-level credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account (from huntress_list_managed_accounts). Requires reseller-level API credentials.
`fieldsJson`	string	no	null	Additional body fields as a JSON object, merged into the request.
`id`	integer	yes		Numeric ID of the organization to update.
`name`	string	no	null	New name for the organization.

Reseller Billing

Tool	Plan	Access	Summary
`huntress_create_reseller_subscription`	Pro	Destructive	Create a new reseller subscription.
`huntress_get_reseller_invoice`	Free	Read-only	Get a single reseller invoice by id; these require reseller-level API credentials.
`huntress_get_reseller_subscription`	Free	Read-only	Get a single reseller subscription by id; these require reseller-level API credentials.
`huntress_list_reseller_account_usage_line_items`	Free	Read-only	List per-account usage line items for a reseller invoice; these require reseller-level API credentials.
`huntress_list_reseller_invoices`	Free	Read-only	List reseller invoices; these require reseller-level API credentials.
`huntress_list_reseller_organization_usage_line_items`	Free	Read-only	List per-organization usage line items for a reseller invoice; these require reseller-level API credentials.
`huntress_list_reseller_subscriptions`	Free	Read-only	List reseller subscriptions; these require reseller-level API credentials.
`huntress_update_reseller_subscription`	Pro	Destructive	Update a reseller subscription.
`huntress_upgrade_reseller_subscription`	Pro	Destructive	Upgrade a reseller subscription (e.g. raise the seat minimum).

huntress_create_reseller_subscription details

[Huntress] Create a new reseller subscription. The Huntress API REQUIRES account_id, product, minimum (seat count), and purchase_order. Requires reseller-level API credentials.

Param	Type	Required	Default	Description
`accountId`	integer	yes		Numeric ID of the managed account this subscription is for (from huntress_list_managed_accounts). Required.
`billingInterval`	string	no	null	Optional billing interval for the subscription.
`fieldsJson`	string	no	null	Additional body fields as a JSON object, merged into the request after the typed fields.
`minimum`	integer	yes		Seat/unit minimum for the subscription. Required.
`product`	string	yes		Product for the subscription. Required. One of: edr, sat, itdr, siem.
`purchaseOrder`	string	yes		Purchase order reference. Required.

huntress_get_reseller_invoice details

Param	Type	Required	Default	Description
`id`	integer	yes		Numeric ID of the reseller invoice (from huntress_list_reseller_invoices).

huntress_get_reseller_subscription details

Param	Type	Required	Default	Description
`id`	integer	yes		Numeric ID of the reseller subscription (from huntress_list_reseller_subscriptions).

huntress_list_reseller_account_usage_line_items details

[Huntress] List per-account usage line items for a reseller invoice; these require reseller-level API credentials. Paginated — use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.

Param	Type	Required	Default	Description
`invoiceId`	integer	yes		Numeric ID of the reseller invoice to list usage line items for (from huntress_list_reseller_invoices).
`limit`	integer	no	50	Maximum number of results per page (default 50, max 500).
`pageToken`	string	no	null	Pagination cursor: pass the `next_page_token` from the previous response's `pagination` object to fetch the next page. Omit for the first page.

huntress_list_reseller_invoices details

[Huntress] List reseller invoices; these require reseller-level API credentials. Paginated — use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.

Param	Type	Required	Default	Description
`limit`	integer	no	50	Maximum number of results per page (default 50, max 500).
`pageToken`	string	no	null	Pagination cursor: pass the `next_page_token` from the previous response's `pagination` object to fetch the next page. Omit for the first page.
`status`	string	no	null	Filter by invoice status: open\|paid\|failed\|partial_refund\|full_refund\|draft\|voided\|processing.

huntress_list_reseller_organization_usage_line_items details

[Huntress] List per-organization usage line items for a reseller invoice; these require reseller-level API credentials. Paginated — use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.

Param	Type	Required	Default	Description
`invoiceId`	integer	yes		Numeric ID of the reseller invoice to list usage line items for (from huntress_list_reseller_invoices).
`limit`	integer	no	50	Maximum number of results per page (default 50, max 500).
`pageToken`	string	no	null	Pagination cursor: pass the `next_page_token` from the previous response's `pagination` object to fetch the next page. Omit for the first page.

huntress_list_reseller_subscriptions details

[Huntress] List reseller subscriptions; these require reseller-level API credentials. Paginated — use the `next_page_token` from the response's `pagination` object as `pageToken` for the next page.

Param	Type	Required	Default	Description
`limit`	integer	no	50	Maximum number of results per page (default 50, max 500).
`pageToken`	string	no	null	Pagination cursor: pass the `next_page_token` from the previous response's `pagination` object to fetch the next page. Omit for the first page.
`product`	string	no	null	Filter by product: edr\|sat\|itdr\|siem.
`sortDirection`	string	no	null	Sort direction: asc\|desc.
`sortField`	string	no	null	Field to sort by: id\|status\|minimum\|created_at\|updated_at.
`status`	string	no	null	Filter by subscription status: draft\|approved\|accepted\|active\|completed.

huntress_update_reseller_subscription details

[Huntress] Update a reseller subscription. Requires reseller-level API credentials.

Param	Type	Required	Default	Description
`fieldsJson`	string	no	null	Additional body fields as a JSON object, merged into the request.
`id`	integer	yes		Numeric ID of the reseller subscription (from huntress_list_reseller_subscriptions).

huntress_upgrade_reseller_subscription details

[Huntress] Upgrade a reseller subscription (e.g. raise the seat minimum). The Huntress API REQUIRES the new minimum. Requires reseller-level API credentials.

Param	Type	Required	Default	Description
`fieldsJson`	string	no	null	Additional body fields as a JSON object, merged into the request after the typed fields.
`id`	integer	yes		Numeric ID of the reseller subscription (from huntress_list_reseller_subscriptions).
`minimum`	integer	yes		New seat minimum for the subscription. Required.
`onRenewal`	boolean	no	null	Whether the upgrade applies on renewal rather than immediately.
`purchaseOrder`	string	no	null	Purchase order reference for the upgrade.

SIEM

Tool	Plan	Access	Summary
`huntress_query_siem`	Pro	Write	Query SIEM logs with ES\|QL.

huntress_query_siem details

[Huntress] Query SIEM logs with ES|QL. The `esql` query must begin with "FROM logs". Requires the SIEM product to be enabled on the account (returns 404 if not). Returns {logs:[...], pagination:{next_page_token?}}; pass the returned token as `pageToken` for the next page. Maximum 200 rows per page.

Param	Type	Required	Default	Description
`esql`	string	yes		ES\|QL query string. Required. Must begin with "FROM logs".
`fieldsJson`	string	no	null	Additional body fields as a JSON object, merged into the request after the typed fields.
`pageToken`	string	no	null	Pagination cursor: pass the `next_page_token` from the previous response's `pagination` object to fetch the next page. Omit for the first page.
`rangeEnd`	string	yes		End of the time range to query (ISO 8601 timestamp). Required.
`rangeStart`	string	yes		Start of the time range to query (ISO 8601 timestamp). Required.

Still need help? Ask the team