Which Huntress incidents are waiting on us, and what does the SOC want us to do?
Huntress connects Memtro to your managed security. It reads incident reports with subject, SOC summary, severity, status and organisation, each report's remediation plan and comments, escalations, agents by host name with OS, versions, isolation and Defender status, SOC signals and organisations with their counts. When asked, and once an administrator has granted the action by name, it can comment on a report, approve or reject its remediation plan, mark a manual remediation done, resolve a report or escalation, isolate or release a host, and set an agent's tags or tamper protection. IP and MAC addresses are never returned.
Ask in plain English from chat, your editor, a scheduled job or your own agent. The model picks the right Huntress tool, reads what it needs, and answers with the source cited.
These tools change something in Huntress. The model is told to use them only when you ask for exactly that, and an administrator grants each one by name to the teams that may use it; a personal connection acts only after its owner allows it.
Turn events on in the connection's Events tab on the Connections page, then add the address it shows as a webhook in Huntress, choosing the same kinds; the tab shows Huntress's own steps. Each event can start a job, with the event as its input. Huntress signs every delivery, and one whose signature does not check out is refused before it is read.
Events and webhooksOnce Huntress is connected, these are the kinds of things people ask. Plain questions, no syntax. If the answer lives partly in another system you have connected, Memtro looks there too.
Huntress + MemtroWhich incident reports are waiting on us?
What remediations has the SOC proposed for the latest critical report?
Which hosts are isolated right now?
Which escalations are overdue?
Isolate the host ACME-WS-114 from the network
Tom Reilly, IT manager at Acme Ltd, asked which Huntress incident reports were waiting on his team. Memtro listed two sent reports with severity, host and the SOC's summary, and showed the unapproved remediations on the critical one.
Sarah Chen, security lead at Northwind, asked Memtro to isolate a workstation named in a critical report. Memtro isolated it in Huntress, which showed Pending Isolation until the host confirmed. The user of the machine lost network access.
The teams that lean on Huntress most, a question each of them asks, and what they connect beside it.
A record in Huntress is rarely the whole story. Connect the systems that hold the rest and Memtro checks them together, then remembers what it learned so the next question starts further along.
Using something else for the same job, or both? Each connector has its own tools; connect as many as you like.
UptimeRobot
Honeycomb
Cronitor
FireHydrant
StatusCake
GlitchTip
GLPI
Langfuse
LibreNMS
NetBox
Snipe-IT
Woodpecker CI
Zabbix
LangSmith
Helicone
GrowthBook
Drata
Intruder
GitGuardian
Secureframe
ilert
JumpCloud
ConfigCat
Split
Aikido Security
Astronomer
Comet Opik
CrowdStrike Falcon
Detectify
Domotz
LambdaTest
LangWatch
LlamaCloud
Logz.io
Lunary
NinjaOne
Northflank
Portkey
PromptLayer
PRTG Network Monitor
Raygun
Retell AI
Runpod
Shodan
Spike.sh
Squadcast
Tenable
UpGuard
Uptime.com
Vanta
Zenduty
Cortex
WorkOS
Kandji
Automox
SimpleMDM
Healthchecks.io
Rapid7 InsightVM
ZenhubIn the Huntress portal, logged in as a user with Admin privileges, open Menu → API Credentials → User API Credentials → Add.
Pick the user the key acts as and name it Memtro. A user key can do what its user can, and for reading only make it for a user with a read-only role. Copy the key and the secret, both shown once.
In Memtro, open Connections → Huntress and paste them into API key and API secret.
Ask your first question: which incident reports are waiting on us?
Chat in the dashboard, the OpenAI-compatible API, scheduled jobs, and any MCP client: Claude Code, OpenCode, Cursor, Claude Desktop. The Huntress tools are the same everywhere.
Only when you ask, and only what it has been granted: comment on an incident report (people who get incident report notifications are told); approve an incident report's remediation plan (Huntress runs the assisted remediations at once); reject an incident report's remediation plan (sends it back to the Huntress SOC); mark a manual remediation as done or not done; resolve an incident report (permanent); resolve an escalation (for unwanted-access escalations this can create access rules and revoke and disable identities); isolate a host from the network; release a host from isolation; replace an agent's tags; turn an agent's tamper protection on or off. Every other tool reads, searches or lists. The Connections page labels the tools that act, an administrator grants each one by name to the teams that may use it, and a personal connection acts only after its owner allows it.
A personal connection serves only your own requests. A shared connection serves the organisation: everyone, or only the teams an admin chooses. Admins can always add shared connections; other members need the permission.
Credentials are encrypted at rest. Tool results are cached briefly so agent loops do not repeat identical calls, and the facts the model extracts are saved to your organisation's memory with provenance (system, record and link) so they can be checked and superseded.
API key and API secret. In the Huntress portal, logged in as a user with Admin privileges, open Menu → API Credentials → User API Credentials → Add.
Yes. Turn events on in the connection's Events tab on the Connections page, then add the address it shows as a webhook in Huntress, choosing the same kinds; the tab shows Huntress's own steps. A job set to start "When an event arrives" then runs once for each matching event, with the event as its input. The run treats the event as outside data, never as instructions, and anything the run remembers is kept as unverified.
Seven-day free trial, then one monthly price per organisation. Connectors, jobs and memory are never metered.
Sign in, add a provider key, create an API key and point your tools at Memtro. It takes about five minutes.
7-day free trial · card on file, nothing charged until it ends · cancel any time
