How Huntress Uses ClickHouse to Monitor EDR Agent Health at Scale
Summary
Huntress describes using ClickHouse to aggregate observability data from millions of endpoints, helping monitor EDR agent health and stability and identify conditions that could affect availability.
Key points
- Huntress says its EDR agents generate billions of data points per day across millions of endpoints.
- The company uses ClickHouse for detailed observability, from global agent health down to individual endpoints.
- AggregatingMergeTree tables and materialized views aggregate observations hourly and daily.
- Observations are tagged with details such as agent version, operating system, architecture, and configuration to support analysis and trend identification.
- Huntress says sorting tags enables grouping and aggregation, while compressing terabytes of tag data to dozens of gigabytes.
- The company plans to surface more insights in a redesigned EDR dashboard and prioritize environmental issues such as low disk space and network problems.
Article Details
- Topic
- Using ClickHouse for scalable internal observability of Huntress EDR agent health and stability