> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> What the Huntress integration brings to your Neo Agent setup

Huntress is the managed EDR/MDR platform many MSPs run across their whole fleet. Connecting it to Neo means your agents can read the alert behind a Huntress-generated ticket, gather the evidence, and — with your approval — act: approve the remediation, isolate the host, resolve the incident, or file the travel exception that stops the escalation recurring.

<Info>
  Huntress uses one API key pair per Huntress account. Connect it once and every agent you enable can use it, with permissions you control per agent.
</Info>

## What Neo can do with Huntress

<CardGroup cols={2}>
  <Card title="Incidents" icon="triangle-exclamation">
    Read incident reports and escalations with their full findings and remediation steps, approve or reject remediations, and resolve the incident once the work is done.
  </Card>

  <Card title="Agents" icon="desktop">
    Look up any deployed host by name, organization, platform, or version. Edit host tags and tamper protection, and isolate a compromised host from the network or release it.
  </Card>

  <Card title="Detections" icon="magnifying-glass">
    Investigate the evidence: signals, managed identities and their MFA and risk state, externally exposed ports, platform actions, and SIEM log queries. Read-only.
  </Card>

  <Card title="Unwanted access rules" icon="plane">
    Create time-boxed travel and geolocation exceptions with an automatic expiry date, plus VPN and IP rules — so a user abroad stops generating unwanted-country escalations without anyone permanently whitelisting a country.
  </Card>

  <Card title="Organizations" icon="building">
    Enumerate the customers under your Huntress account, and create, rename, or remove organizations during onboarding and offboarding.
  </Card>

  <Card title="Reporting" icon="chart-line">
    Read monthly, quarterly, and yearly summary reports for QBRs and security-posture reviews, plus account and reseller invoices. Read-only.
  </Card>
</CardGroup>

## Why connect Huntress

1. **The alert context arrives with the ticket.** A Huntress-generated ticket normally sends a technician into the Huntress portal to find out what actually happened. With the integration, the agent pulls the incident report, its indicators, and the affected host into the ticket before anyone opens it.
2. **Containment and remediation stay one approval away.** Isolating a host and approving remediations are single actions the agent can prepare and a technician can approve, instead of a portal round trip under time pressure.
3. **Recurring geolocation noise becomes self-cleaning.** Travel exceptions get created with an expiry date, so the exception disappears on its own when the trip ends.
4. **Posture and billing data feeds reporting agents.** Summary reports and invoices are readable, so QBR and reconciliation agents work from Huntress's own numbers.

## How agents reach Huntress

When you enable any Huntress permission group on an agent, Neo automatically adds the Huntress tool to that agent's toolbox. Nothing to install, no toolbox tweaking. Every call uses the key pair you saved in the dashboard and stays inside the areas and access levels you allowed.

Some Huntress actions are always gated behind technician approval, whatever the agent's automation level: **isolating or deleting a host, approving or rejecting remediations, resolving an incident or escalation, and any change to who has Huntress portal access.**

## Where to go next

<CardGroup cols={2}>
  <Card title="Connecting Huntress to Neo" icon="plug" href="/integrations/huntress/connecting-to-neo">
    Generate the API key pair, save it in Neo, and decide what each agent can do.
  </Card>

  <Card title="Huntress API tool" icon="wrench" href="/agents/tools/security/huntress-api">
    The tool reference: permission groups, access profiles, and safety controls.
  </Card>
</CardGroup>