The Huntress Operations Console replaces the need for MSP engineers to monitor the Huntress web portal directly. It aggregates agent health, active incidents, foothold detections, ransomware events, and process anomalies into a single always-on interface built for speed. Engineers filter by detection type, severity, or client. Clicking any row opens a full investigation panel with MITRE ATT&CK mappings, host context, process trees, and context-aware one-click actions.

The console is the Huntress-specific layer of the MSP · CMD stack. It is designed as a companion to the RMM and PSA dashboards — alerts are identified here, tickets and scripts are dispatched through the PSA/RMM layer.

All runtime state lives in the global H object at the top of the script block. The mock/live branch is controlled by the commented production block inside hFetch() rather than a single DEMO flag.

Five service health rows with colored status dots and latency values. Rendered by hRenderApiHealth(s). In live mode each row should reflect a real liveness probe to the associated endpoint.

Two rows of filter buttons. Applied client-side against H.data.alerts and H.data.incidents — no re-fetch on filter change.

Scrollable list of up to 20 combined alerts + incidents, newest at top. Each row shows timestamp, title, host/client, and severity badge. Clicking any row calls hSelectRow(id) which loads the right investigation panel. Rendered by hRenderStream(alerts). Live count shown in #stream-ct.

Eight flex cards across the top of the center column. Each card has a 2px top border that pulses red (animation: cp) when status is critical. Rendered by hRenderPlatCards(s, devices, incidents).

Seven-column grid. Alerts + incidents merged, sorted by severity then age ascending. Left-edge 2px stripe colored by severity. Clicking a row highlights it and loads the investigation panel. Rendered by hRenderTable(); rows sourced from hGetRows() which applies H.filter and H.sev.

The Huntress REST API uses HTTP Basic Authentication. Credentials are an apiKey and apiPassword (not a username) base64-encoded in the Authorization header. Credentials must never appear in the frontend HTML file.

• Provision server-side proxy (Node.js/Express, Cloudflare Worker, or equivalent)
• Store HUNTRESS_API_KEY and HUNTRESS_API_PASSWORD as env vars — never in the HTML file
• Implement GET /api/huntress/alerts → GET /v1/incidents?status=open,investigating&limit=50
• Implement GET /api/huntress/devices → GET /v1/agents?limit=50
• Implement GET /api/huntress/incidents → GET /v1/incidents?incident_type=ransomware_canary,footholds
• Implement aggregation route GET /api/huntress/summary: fire both /v1/agents + /v1/incidents, compute severity breakdown, read X-Total-Count for agent total
• Implement write route PUT /api/huntress/agents/:id/isolate → PUT /v1/agents/{id}/isolate
• Implement write route PATCH /api/huntress/incidents/:id → PATCH /v1/incidents/{id}
• Set CORS headers for the console's serving origin
• Return consistent JSON error shapes for 4xx/5xx so Promise.allSettled branches correctly
• Test all four GET routes against a live Huntress account — verify response shapes match what the mock generators return (same field names the render functions expect)

• Open stack-huntress.html and locate hFetch(endpoint) in the script block
• Uncomment the three-line production block: return fetch(endpoint, {credentials:'include', headers:{'Accept':'application/json'}})
• Comment out (or remove) the return new Promise(function(resolve){ setTimeout(... mock block below it
• Reload the console — the init toast should read "Live" not "Demo"
• Verify rail counters populate with real values within 5 seconds
• Verify alert table shows real Huntress incident IDs (not HTR-3000, INC-1100)
• Test isolation on a non-production test device — confirm modal completes and isolation is reflected in the Huntress portal
• Test resolve on a test incident — confirm status changes in the Huntress portal

Cause: hLoadAll() resolved but hRenderRail() received an empty summary object, or the promise chain threw before reaching hRenderAll().

Fix (demo): Check browser console for JS exceptions inside a mock generator function. In demo mode this should never occur.

Fix (live): Confirm the proxy is running and returning valid JSON from /api/huntress/summary with all expected fields: critAlerts, highAlerts, medAlerts, openIncidents, totalAgents, atRiskHosts.

Cause: One or more hFetch() calls returned a rejected promise (Promise.allSettled catches it and triggers the warning toast).

Fix (demo): Should never appear — a mock generator threw a runtime error. Check browser console for exceptions inside mockSummary(), mockAlerts(), etc.

Fix (live): The proxy returned a non-2xx status for at least one route. Check proxy logs, verify Huntress credentials, confirm the API key has read access to incidents and agents.

Cause: H.data.alerts and H.data.incidents are both empty arrays, or hGetRows() is filtering everything out.

Fix: Click "ALL" severity and "All" type to confirm filters are reset. Log H.data.alerts and H.data.incidents in the console — if both are empty, the fetch cycle did not complete successfully. In live mode verify the proxy returns non-empty arrays from both routes.

Cause: hSelectRow(id) could not find the clicked ID in the combined alerts + incidents array.

Fix: Check browser console for errors after clicking a row. Confirm the row ID format matches what is in H.data.alerts (demo: HTR-3000 style; live: Huntress UUIDs). Ensure hRenderTable() and hRenderStream() are using the same ID field as hSelectRow().

Cause: hStartRefreshTimer() was not called, or both H.refreshTimer and H.countTimer were cleared without being restarted.

Fix: Confirm hLoadAll() and hStartRefreshTimer() are both called in the DOMContentLoaded listener. Verify H.countTimer is not null via the console. Manually trigger hRefresh() with the Refresh button to confirm the data cycle works independently of the auto-timer.

Cause: The next() inner function inside hRunModal() threw before firing, or ACTION_STEPS[type] returned undefined.

Fix: Check browser console for errors after triggering an action. Confirm the type string passed to hAct() is one of: isolate, contain, ticket, escalate, script, report, resolve.

Cause: API credentials are invalid, expired, or not being injected by the proxy.

Fix: Verify HUNTRESS_API_KEY and HUNTRESS_API_PASSWORD are set in the proxy environment. Confirm the proxy constructs Authorization: Basic base64(key:password) correctly — it is key and password, not a username. Test the credential directly: curl -u "yourKey:yourPassword" https://api.huntress.io/v1/organizations

Cause: Write operations require an API key with write permissions. A read-only key returns 403 Forbidden.

Fix: In the Huntress portal under Account Settings, verify the API key has write scope. Generate a new key with write access if needed. Do not use write-access keys in shared or unauthenticated environments.