Changelog
GuidesAPI ReferenceRecipesChangelog
Start typing to search…
Back to All
added

Check Huntress Agent Health in N-central

3 months ago by Jason Murphy

This service integrates with the Huntress EDR Agent Health API to provide near real-time monitoring of agent status, services, and connectivity using a lightweight PowerShell script.

What It Does
This custom AMP-based service collects data from the local Huntress agent via http://localhost:24799/health, using a PowerShell script to expose actionable health data through N-central’s monitoring engine.

What It Monitors
Metric Purpose Alert Logic
HuntressStatus Overall agent health (healthy, unhealthy, startup) Normal: healthy
HuntressStatusMessage Diagnostic message string For visibility
AgentServiceStatus Huntress Agent service state Normal: running
HuntMonitorServiceStatus Monitor service state Normal: running
HuntressRioServiceStatus Rio component service state Normal: running
HuntressUpdaterServiceStat Updater service state Normal: running
AgentVersion, etc. Version info of each component Logged for auditing
ErrorTS, EventsTS, etc. Hours since last: error, event, survey, task, update Warning >1h, Fail >24h

Why This Matters

  • Detect failed or stalled Huntress agents
  • Validate that all Huntress services are running
  • Audit version consistency across installations
  • Confirm agent connectivity to the Huntress cloud
    Technical Details
  • Runs via AMP/Automation Manager
  • Polls every 5 minutes
  • Returns string and numeric values for flexible alerting
  • Fully documented with human-readable output messages
    To implement it, import the 1-PDS - Check Huntress V2 service into your N-central instance. For more details or to download, visit developer.n-able.com.
    Known Issues
    The API returns degraded status if any installed service is in the stopped state, or any connectivity timestamp is older than 24 hours. When a system is rebooted, for example, the API will return degraded until all related services have started up.
    The issue is that if an endpoint isn't very active then the API will return a degraded status due to the survey time stamp being over 24 hours. Our experience is this can result in a large portion of the Huntress agents incorrectly returning a degraded status.
    Note: Huntress have identified this as a bug that will be fixed in a future release of the Huntress Agent API.

Huge thanks to Darren Chapman from Pivotal Data Solutions (https://pivotaldata.com.au) for developing this module!