Huntress: protected endpoints, EDR coverage, and SOC incidents

Huntress is managed detection and response: an agent on each endpoint, and a security operations centre of human analysts who investigate what it finds and write up what mattered. This connector reads three things out of it: which endpoints are protected and how well, the SOC incident reports raised against them, and the per-product counts Huntress keeps for each of your organizations. Each one hangs off the matching Current company, so it feeds your security business reviews and the company alert band. Current reads Huntress and can never change anything in it.

1. 1
   1 · Open API Credentials in your Huntress portal

   Sign in at your own Huntress address, which looks like your-subdomain.huntress.io, as an account administrator. Open the menu at the top right and choose API Credentials; the same page also sits under Account Settings. If there is no such menu item, your Huntress account has not been granted API access yet — that is the first thing to ask Huntress about, and nothing below will work until it is sorted.
2. 2
   2 · Generate an ACCOUNT key pair, not a user key

   The page has two sections: account credentials and user credentials. Generate the account pair. Huntress makes the account key read-only by design and has never added write capability to it, so that credential cannot change anything in Huntress even in theory. A user key is different: it carries whatever permissions its person's role carries today, and it gains more the moment somebody promotes them, without telling Current. If you must use a user key, make it belong to a user whose account-level role is Read-Only.
3. 3
   3 · Copy the secret before you leave the page

   Huntress shows the API secret key exactly once, at the moment you generate it. There is no way to look it up afterwards — a lost secret means generating a fresh pair. Copy both halves now.
4. 4
   4 · Paste both halves into Current and test

   Integrations → Huntress → Connect. Paste the key and the secret and press Test connection. Current makes one read against Huntress to confirm the credentials work and can actually see your account, then stores them server-side only; they are never shown again and never reach your browser.

In Huntress each end-customer is an organization under your account. Current lists all of them and links each to a Current company by normalized name — lowercased, with punctuation and Inc/LLC/Ltd-style suffixes stripped — and only when exactly one company matches. Two companies that both fit stay unmapped for you to decide.

1. 1
   Let the auto-matcher run first

   Every sync links each organization to the one Current company whose normalized name matches. Most organizations map themselves; only the ambiguous ones need a hand.
2. 2
   Open the mapping panel

   Integrations → Huntress → Manage → Customer mapping. It opens on the Unmapped tab, which lists every organization the matcher could not place.
3. 3
   Map an organization to its company

   On an unmapped row press Map, type a few letters of the Current company, and pick it. That organization's endpoints and incidents attach to the company right away, rather than waiting for the next six-hour sync.
4. 4
   Ignore internal or test organizations

   For an organization that should never map to a partner — your own internal fleet, a lab, a demo — press Ignore. It moves to the Ignored tab and stops counting against the card's unmapped badge.
5. 5
   Fix a wrong match later

   The Mapped tab lists every linked organization; Unmap corrects a bad auto-match, and the Ignored tab's Un-ignore brings a dismissed one back. A mapping you set by hand is never overwritten by a later auto-match, and neither is a manual unlink. Mapping an organization once also teaches Current its identity tenant id, so a later rename on either side does not break the link.

• ＋The company's posture panel: protected endpoints, how many are online, EDR coverage, and the open incident count by severity for the mapped organization.
• ＋The company's security card, alongside your other endpoint-security feeds, with coverage gaps listed one line each: endpoints with no EDR installed, firewall disabled, or tamper protection off.
• ＋The Security posture chapter of a Strategic Business Review, beside your other security feeds.
• ＋Dashboard security metrics — endpoint coverage and open-critical counts read from Huntress once it is connected and mapped.
• ＋The company alert band: an open critical Huntress incident joins the same critical-security entry your other endpoint-security feeds already fire, rather than adding a second line that says the same thing twice.