From huntress
Lists, filters, monitors, and investigates Huntress security signals from endpoint agents for proactive threat hunting and SOC analysis.
npx claudepluginhub wyre-technology/msp-claude-plugins --plugin huntressThis skill uses the workspace's default tool permissions.
Signals are security-relevant events detected by Huntress agents on managed endpoints. Not all signals become incidents — they represent the raw detection layer that feeds into Huntress SOC analysis. Monitoring signals provides visibility into the threat landscape before incidents are formally created.
Provides UI/UX resources: 50+ styles, color palettes, font pairings, guidelines, charts for web/mobile across React, Next.js, Vue, Svelte, Tailwind, React Native, Flutter. Aids planning, building, reviewing interfaces.
Fetches up-to-date documentation from Context7 for libraries and frameworks like React, Next.js, Prisma. Use for setup questions, API references, and code examples.
Calculates TAM/SAM/SOM using top-down, bottom-up, and value theory methodologies for market sizing, revenue estimation, and startup validation.
Signals are security-relevant events detected by Huntress agents on managed endpoints. Not all signals become incidents — they represent the raw detection layer that feeds into Huntress SOC analysis. Monitoring signals provides visibility into the threat landscape before incidents are formally created.
Signals cover various detection categories including:
huntress_signals_list
Parameters:
organization_id — Filter by organizationpage_token — Pagination tokenExample response:
{
"signals": [
{
"id": "sig-555",
"type": "suspicious_process",
"description": "PowerShell execution with encoded command",
"organization_id": "org-456",
"hostname": "ACME-WS-042",
"severity": "medium",
"created_at": "2026-02-26T14:00:00Z"
}
],
"next_page_token": "eyJwYWdlIjoyfQ=="
}
huntress_signals_get
Parameters:
signal_id — The signal IDExample response:
{
"signal": {
"id": "sig-555",
"type": "suspicious_process",
"description": "PowerShell execution with encoded command",
"organization_id": "org-456",
"hostname": "ACME-WS-042",
"severity": "medium",
"created_at": "2026-02-26T14:00:00Z",
"details": {
"process_name": "powershell.exe",
"command_line": "powershell.exe -EncodedCommand ...",
"parent_process": "cmd.exe",
"user": "ACME\\jsmith"
}
}
}
huntress_signals_listhuntress_signals_getCause: Invalid signal ID or signal has been archived Solution: List signals to verify available IDs
Cause: Unfiltered signal queries return many results Solution: Use organization filters and pagination; signals are high-volume