AC-Hunter Installation¶

For prerequisites, deployment planning, and downloading the install bundle, see Getting Started.

Installation steps¶

1. Install Docker¶

AC-Hunter requires Docker before running the installer. You can install Docker using either method below.

Option A: Convenience script (quickest)¶

Docker provides an official convenience script that detects your distribution and installs Docker Engine automatically:

curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh

See the Docker convenience script documentation for details and options.

Option B: Manual installation¶

Follow the official Docker install guide for your OS:

• Ubuntu
• CentOS
• RHEL
• Rocky Linux

Verify Docker is running¶

After installing with either method, confirm Docker is installed and running (sudo/root privileges may be required):

docker --version

2. Extract the install bundle¶

From the directory where you saved the downloaded bundle:

tar -xvf AC-Hunter-v7.0.4.tar.gz

3. Run the installer¶

./AC-Hunter-v7.0.4/install_achunter.sh

Follow the on-screen prompts to finish the installation.

4. Initial configuration¶

After installation, open a browser and go to your server’s hostname or IP (e.g. https://your-server-ip).

1. Access the web interface. Navigate to the AC-Hunter URL. On first visit, follow the prompts to create the initial administrator account.

2. Configure internal subnets. After logging in, go to Settings → Filtering → Internal Subnets. Add your organization’s internal ranges in CIDR notation (e.g. 10.0.0.0/8, 192.168.1.0/24) so AC-Hunter can correctly distinguish internal vs. external traffic.

Your AC-Hunter server is ready. The next steps are to deploy your Zeek sensor and connect it:

• Zeek Configuration: Deploy the Zeek sensor, configure the capture interface, and verify logs are being written.
• Zeek Log Transport: Set up ZeekShip to deliver logs from the sensor to this AC-Hunter server.

After Installation: What to Expect¶

Once the installer completes and Zeek is running, AC-Hunter will begin receiving logs, but data does not appear in the interface instantly.

• Immediately after install: Only sample datasets are visible. This is normal. AC-Hunter ships with example data so you can explore the interface before real network data arrives.
• Within the first few hours: As Zeek logs accumulate and are processed, your real network data will begin appearing in the interface.
• By the next day: You will have a full 24-hour block of data to analyze.

If you log in right after install and see only sample data or an empty dashboard, give it a few hours before assuming something is wrong.

Upgrading¶

Upgrading from AC-Hunter v6 to v7¶

To upgrade from v6:

1. Deploy a fresh, fully updated Linux system that meets the hardware and OS requirements.
2. Follow the standard Installation steps above on the new system.
3. Historical v6 data cannot be migrated to v7. If you need to retain it for reference, keep the old system available separately until it is no longer needed.

Upgrading between AC-Hunter 7 versions¶

For updates within the v7 release line, re-running the installer on the existing system is sufficient, no fresh OS installation is needed:

1. Download the latest download bundle from the customer portal and extract the AC-Hunter installer (see Download the Install Bundle).
2. Transfer the AC-Hunter installer to the AC-Hunter server and extract it.
3. Run the installer:

./AC-Hunter-v7.0.4/install_achunter.sh

The installer will update AC-Hunter components while preserving your existing configuration, user accounts, and data.

Custom certificates¶

SSL/TLS certificates for the frontend¶

By default, AC-Hunter generates a self-signed certificate for HTTPS. To use your own certificate and avoid browser trust warnings, you have two options.

Option 1: Provide certificates before installation¶

Place your certificate and key in the install bundle before running the installer:

AC-Hunter-v7.0.4/files/etc/tls/server/huntcert.crt
AC-Hunter-v7.0.4/files/etc/tls/server/huntcert.key

The installer will copy them into the correct location automatically. This is the simplest approach if you have the certificate files ready.

Option 2: Replace certificates after installation¶

Copy your certificate and key into the server’s config directory:

sudo cp /path/to/your-cert.crt /etc/AC-Hunter/tls/server/huntcert.crt
sudo cp /path/to/your-cert.key /etc/AC-Hunter/tls/server/huntcert.key

Then restart the frontend:

hunt restart frontend

Reload AC-Hunter in the browser; the lock icon should show your certificate as trusted.

CA certificates for outbound requests (e.g. proxies)¶

If your environment uses an internal CA or a proxy that presents its own certificate (e.g. for HTTPS inspection), AC-Hunter’s API must trust those CAs to make outbound web requests successfully. CA certificate files can use any name (e.g. .crt or .pem); there is no required naming convention.

Option 1: Provide CA certificates before installation¶

Place your CA certificate file(s) in the install bundle before running the installer:

AC-Hunter-v7.0.4/files/etc/tls/ca/

All files in that directory are installed as trusted CAs automatically.

Option 2: Add CA certificates after installation¶

Copy your CA certificate(s) into the config directory on the server:

sudo cp /path/to/your-ca.crt /etc/AC-Hunter/tls/ca/

Then restart the API:

hunt restart api

AC-Hunter will then use the added CA(s) for outbound TLS connections (e.g. through a corporate proxy).

Special environments¶

Air-gapped setup¶

Air-gapped installation instructions are being developed by the Active Countermeasures team. If you need to deploy AC-Hunter in an air-gapped or network-restricted environment, please contact [email protected] for assistance.