Huntress Low Code Plugin

.github/CODEOWNERS

@@ -5,6 +5,7 @@
 
 # Request review from original author
 plugins/DigiCert/*  @shaswot77
+plugins/Huntress/*  @Deenk
 plugins/FantasyPremierLeague/*  @TimWheeler-SQUP
 plugins/GoogleSheets/*  @kieranlangton
 plugins/MetOffice/*  @blackgrouse

plugins/Huntress/v1/configValidation.json

@@ -0,0 +1,11 @@
+{
+    "steps": [
+        {
+            "displayName": "API access",
+            "dataStream": { "name": "organizations" },
+            "success": "Successfully connected to Huntress",
+            "error": "Cannot connect to Huntress. Check your public and private API keys.",
+            "required": true
+        }
+    ]
+}

plugins/Huntress/v1/cspell.json

@@ -0,0 +1,12 @@
+{
+    "words": [
+        "huntress",
+        "edr",
+        "itdr",
+        "substatus",
+        "subdomain",
+        "ipv4",
+        "footholds",
+        "ransomware"
+    ]
+}

plugins/Huntress/v1/custom_types.json

@@ -0,0 +1,16 @@
+[
+    {
+        "name": "Huntress Agent",
+        "sourceType": "Huntress Agent",
+        "icon": "laptop",
+        "singular": "Agent",
+        "plural": "Agents"
+    },
+    {
+        "name": "Huntress Organization",
+        "sourceType": "Huntress Organization",
+        "icon": "building",
+        "singular": "Organization",
+        "plural": "Organizations"
+    }
+]

plugins/Huntress/v1/dataStreams/agents.json

@@ -0,0 +1,160 @@
+{
+    "name": "agents",
+    "displayName": "Agents",
+    "description": "All agents registered with your Huntress account",
+    "tags": ["Security", "Agents"],
+    "baseDataSourceName": "httpRequestUnscoped",
+    "config": {
+        "httpMethod": "get",
+        "endpointPath": "/v1/agents",
+        "pathToData": "agents",
+        "expandInnerObjects": true,
+        "getArgs": [],
+        "headers": [],
+        "paging": {
+            "mode": "token",
+            "pageSize": {
+                "realm": "queryArg",
+                "path": "limit",
+                "value": "500"
+            },
+            "in": {
+                "realm": "payload",
+                "path": "pagination.next_page_token"
+            },
+            "out": {
+                "realm": "queryArg",
+                "path": "page_token"
+            }
+        }
+    },
+    "metadata": [
+        {
+            "name": "id",
+            "displayName": "Agent ID",
+            "shape": ["number", { "decimalPlaces": 0 }],
+            "role": "id",
+            "visible": false
+        },
+        {
+            "name": "hostname",
+            "displayName": "Hostname",
+            "shape": "string",
+            "role": "label"
+        },
+        {
+            "name": "organization_id",
+            "displayName": "Organization ID",
+            "shape": ["number", { "decimalPlaces": 0 }]
+        },
+        {
+            "name": "account_id",
+            "displayName": "Account ID",
+            "shape": ["number", { "decimalPlaces": 0 }]
+        },
+        {
+            "name": "domain_name",
+            "displayName": "Domain Name",
+            "shape": "string"
+        },
+        {
+            "name": "os",
+            "displayName": "Operating System",
+            "shape": "string"
+        },
+        {
+            "name": "platform",
+            "displayName": "Platform",
+            "shape": "string"
+        },
+        {
+            "name": "arch",
+            "displayName": "Architecture",
+            "shape": "string"
+        },
+        {
+            "name": "ipv4_address",
+            "displayName": "IPv4 Address",
+            "shape": "string"
+        },
+        {
+            "name": "external_ip",
+            "displayName": "External IP",
+            "shape": "string"
+        },
+        {
+            "name": "mac_addresses",
+            "displayName": "MAC Addresses",
+            "shape": "json"
+        },
+        {
+            "name": "tags",
+            "displayName": "Tags",
+            "shape": "json"
+        },
+        {
+            "name": "version",
+            "displayName": "Agent Version",
+            "shape": "string"
+        },
+        {
+            "name": "edr_version",
+            "displayName": "EDR Version",
+            "shape": "string"
+        },
+        {
+            "name": "defender_status",
+            "displayName": "Defender Status",
+            "shape": "string"
+        },
+        {
+            "name": "defender_substatus",
+            "displayName": "Defender Substatus",
+            "shape": "string"
+        },
+        {
+            "name": "defender_policy_status",
+            "displayName": "Defender Policy Status",
+            "shape": "string"
+        },
+        {
+            "name": "firewall_status",
+            "displayName": "Firewall Status",
+            "shape": ["state", { "map": { "success": ["Enabled"], "error": ["Disabled"], "warning": ["Pending Isolation", "Isolated", "Pending Release"] } }]
+        },
+        {
+            "name": "os_build_version",
+            "displayName": "OS Build Version",
+            "shape": "string"
+        },
+        {
+            "name": "serial_number",
+            "displayName": "Serial Number",
+            "shape": "string"
+        },
+        {
+            "name": "last_callback_at",
+            "displayName": "Last Callback At",
+            "shape": ["date", { "timeZone": "Etc/UTC" }]
+        },
+        {
+            "name": "last_survey_at",
+            "displayName": "Last Survey At",
+            "shape": ["date", { "timeZone": "Etc/UTC" }]
+        },
+        {
+            "name": "created_at",
+            "displayName": "Created At",
+            "shape": ["date", { "timeZone": "Etc/UTC" }]
+        },
+        {
+            "name": "updated_at",
+            "displayName": "Updated At",
+            "shape": ["date", { "timeZone": "Etc/UTC" }]
+        },
+        {
+            "pattern": ".*"
+        }
+    ],
+    "timeframes": false
+}

plugins/Huntress/v1/dataStreams/agentsByOrganization.json

@@ -0,0 +1,169 @@
+{
+    "name": "agentsByOrganization",
+    "displayName": "Agents by Organization",
+    "description": "Agents filtered by a scoped Huntress Organization",
+    "tags": ["Security", "Agents"],
+    "baseDataSourceName": "httpRequestScoped",
+    "objectLimit": 1,
+    "matches": {
+        "sourceType": {
+            "type": "equals",
+            "value": "Huntress Organization"
+        }
+    },
+    "config": {
+        "httpMethod": "get",
+        "endpointPath": "/v1/agents",
+        "pathToData": "agents",
+        "expandInnerObjects": true,
+        "getArgs": [
+            { "key": "organization_id", "value": "{{objects[0].id}}" }
+        ],
+        "headers": [],
+        "paging": {
+            "mode": "token",
+            "pageSize": {
+                "realm": "queryArg",
+                "path": "limit",
+                "value": "500"
+            },
+            "in": {
+                "realm": "payload",
+                "path": "pagination.next_page_token"
+            },
+            "out": {
+                "realm": "queryArg",
+                "path": "page_token"
+            }
+        }
+    },
+    "metadata": [
+        {
+            "name": "id",
+            "displayName": "Agent ID",
+            "shape": ["number", { "decimalPlaces": 0 }],
+            "role": "id",
+            "visible": false
+        },
+        {
+            "name": "hostname",
+            "displayName": "Hostname",
+            "shape": "string",
+            "role": "label"
+        },
+        {
+            "name": "organization_id",
+            "displayName": "Organization ID",
+            "shape": ["number", { "decimalPlaces": 0 }]
+        },
+        {
+            "name": "account_id",
+            "displayName": "Account ID",
+            "shape": ["number", { "decimalPlaces": 0 }]
+        },
+        {
+            "name": "domain_name",
+            "displayName": "Domain Name",
+            "shape": "string"
+        },
+        {
+            "name": "os",
+            "displayName": "Operating System",
+            "shape": "string"
+        },
+        {
+            "name": "platform",
+            "displayName": "Platform",
+            "shape": "string"
+        },
+        {
+            "name": "arch",
+            "displayName": "Architecture",
+            "shape": "string"
+        },
+        {
+            "name": "ipv4_address",
+            "displayName": "IPv4 Address",
+            "shape": "string"
+        },
+        {
+            "name": "external_ip",
+            "displayName": "External IP",
+            "shape": "string"
+        },
+        {
+            "name": "mac_addresses",
+            "displayName": "MAC Addresses",
+            "shape": "json"
+        },
+        {
+            "name": "tags",
+            "displayName": "Tags",
+            "shape": "json"
+        },
+        {
+            "name": "version",
+            "displayName": "Agent Version",
+            "shape": "string"
+        },
+        {
+            "name": "edr_version",
+            "displayName": "EDR Version",
+            "shape": "string"
+        },
+        {
+            "name": "defender_status",
+            "displayName": "Defender Status",
+            "shape": "string"
+        },
+        {
+            "name": "defender_substatus",
+            "displayName": "Defender Substatus",
+            "shape": "string"
+        },
+        {
+            "name": "defender_policy_status",
+            "displayName": "Defender Policy Status",
+            "shape": "string"
+        },
+        {
+            "name": "firewall_status",
+            "displayName": "Firewall Status",
+            "shape": ["state", { "map": { "success": ["Enabled"], "error": ["Disabled"], "warning": ["Pending Isolation", "Isolated", "Pending Release"] } }]
+        },
+        {
+            "name": "os_build_version",
+            "displayName": "OS Build Version",
+            "shape": "string"
+        },
+        {
+            "name": "serial_number",
+            "displayName": "Serial Number",
+            "shape": "string"
+        },
+        {
+            "name": "last_callback_at",
+            "displayName": "Last Callback At",
+            "shape": ["date", { "timeZone": "Etc/UTC" }]
+        },
+        {
+            "name": "last_survey_at",
+            "displayName": "Last Survey At",
+            "shape": ["date", { "timeZone": "Etc/UTC" }]
+        },
+        {
+            "name": "created_at",
+            "displayName": "Created At",
+            "shape": ["date", { "timeZone": "Etc/UTC" }]
+        },
+        {
+            "name": "updated_at",
+            "displayName": "Updated At",
+            "shape": ["date", { "timeZone": "Etc/UTC" }]
+        },
+        {
+            "pattern": ".*"
+        }
+    ],
+    "timeframes": false
+}