Skip to main content
Huntress is the managed EDR/MDR platform many MSPs run across their whole fleet. Connecting it to Neo means your agents can read the alert behind a Huntress-generated ticket, gather the evidence, and — with your approval — act: approve the remediation, isolate the host, resolve the incident, or file the travel exception that stops the escalation recurring.
Huntress uses one API key pair per Huntress account. Connect it once and every agent you enable can use it, with permissions you control per agent.

​
What Neo can do with Huntress

Incidents

Read incident reports and escalations with their full findings and remediation steps, approve or reject remediations, and resolve the incident once the work is done.

Agents

Look up any deployed host by name, organization, platform, or version. Edit host tags and tamper protection, and isolate a compromised host from the network or release it.

Detections

Investigate the evidence: signals, managed identities and their MFA and risk state, externally exposed ports, platform actions, and SIEM log queries. Read-only.

Unwanted access rules

Create time-boxed travel and geolocation exceptions with an automatic expiry date, plus VPN and IP rules — so a user abroad stops generating unwanted-country escalations without anyone permanently whitelisting a country.

Organizations

Enumerate the customers under your Huntress account, and create, rename, or remove organizations during onboarding and offboarding.

Reporting

Read monthly, quarterly, and yearly summary reports for QBRs and security-posture reviews, plus account and reseller invoices. Read-only.

​
Why connect Huntress

  1. The alert context arrives with the ticket. A Huntress-generated ticket normally sends a technician into the Huntress portal to find out what actually happened. With the integration, the agent pulls the incident report, its indicators, and the affected host into the ticket before anyone opens it.
  2. Containment and remediation stay one approval away. Isolating a host and approving remediations are single actions the agent can prepare and a technician can approve, instead of a portal round trip under time pressure.
  3. Recurring geolocation noise becomes self-cleaning. Travel exceptions get created with an expiry date, so the exception disappears on its own when the trip ends.
  4. Posture and billing data feeds reporting agents. Summary reports and invoices are readable, so QBR and reconciliation agents work from Huntress’s own numbers.

​
How agents reach Huntress

When you enable any Huntress permission group on an agent, Neo automatically adds the Huntress tool to that agent’s toolbox. Nothing to install, no toolbox tweaking. Every call uses the key pair you saved in the dashboard and stays inside the areas and access levels you allowed. Some Huntress actions are always gated behind technician approval, whatever the agent’s automation level: isolating or deleting a host, approving or rejecting remediations, resolving an incident or escalation, and any change to who has Huntress portal access.

​
Where to go next

Connecting Huntress to Neo

Generate the API key pair, save it in Neo, and decide what each agent can do.

Huntress API tool

The tool reference: permission groups, access profiles, and safety controls.