We've given Unsecured Credentials a complete overhaul, with a new dashboard, full visibility into what's being flagged, and the ability to allowlist files you don't want reported on.
What's new
  • Credential Files page. A new home for Unsecured Credentials, available from the Process Insights dashboard in Managed EDR. View and manage every file triggering an Unsecured Credentials report in one place.
  • See before you enable. You can now preview which Credential Files would generate an Incident Report, without turning reporting on!
  • Allowlisting. Exclude the files you've reviewed and accepted, so reports stay focused on what actually needs attention.
Turned these off before? Give them another look.
If you disabled Unsecured Credential Incident Reports because they were too noisy, allowlisting and the new preview view solve exactly that problem. Now's a good time to revisit.