From huntress
Lists, filters, monitors, and investigates Huntress security signals from endpoint agents for proactive threat hunting and SOC analysis.
How this skill is triggered — by the user, by Claude, or both
Slash command
/huntress:signalsThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Signals are security-relevant events detected by Huntress agents on managed endpoints. Not all signals become incidents — they represent the raw detection layer that feeds into Huntress SOC analysis. Monitoring signals provides visibility into the threat landscape before incidents are formally created.
Signals are security-relevant events detected by Huntress agents on managed endpoints. Not all signals become incidents — they represent the raw detection layer that feeds into Huntress SOC analysis. Monitoring signals provides visibility into the threat landscape before incidents are formally created.
Signals cover various detection categories including:
huntress_signals_list
Parameters:
organization_id — Filter by organizationpage_token — Pagination tokenExample response:
{
"signals": [
{
"id": "sig-555",
"type": "suspicious_process",
"description": "PowerShell execution with encoded command",
"organization_id": "org-456",
"hostname": "ACME-WS-042",
"severity": "medium",
"created_at": "2026-02-26T14:00:00Z"
}
],
"next_page_token": "eyJwYWdlIjoyfQ=="
}
huntress_signals_get
Parameters:
signal_id — The signal IDExample response:
{
"signal": {
"id": "sig-555",
"type": "suspicious_process",
"description": "PowerShell execution with encoded command",
"organization_id": "org-456",
"hostname": "ACME-WS-042",
"severity": "medium",
"created_at": "2026-02-26T14:00:00Z",
"details": {
"process_name": "powershell.exe",
"command_line": "powershell.exe -EncodedCommand ...",
"parent_process": "cmd.exe",
"user": "ACME\\jsmith"
}
}
}
huntress_signals_listhuntress_signals_getCause: Invalid signal ID or signal has been archived Solution: List signals to verify available IDs
Cause: Unfiltered signal queries return many results Solution: Use organization filters and pagination; signals are high-volume
npx claudepluginhub wyre-technology/msp-claude-plugins --plugin huntressManages Huntress security incidents: lists, triages, investigates, resolves them, and handles remediations with bulk approve/reject workflows.
Unified SOC analyst workflow for CrowdStrike NGSIEM — triage alerts, investigate security events, hunt threats, and tune detections. Use when triaging alerts, investigating detections, running daily SOC review, or tuning for false positives.
Unified SOC analyst workflow for CrowdStrike NGSIEM — triage alerts, investigate security events, hunt threats, and tune detections. Agent-delegated architecture: Haiku for mechanical tasks, Sonnet for substantive work, Opus for judgment.