Managed EDR

Hi, there are a few requests, one completed, for Halo PSA sync. Its there for tickets but its one way. Seems to me that a quick code improvement could give us two way sync. Far more importantly, we need billing sync please! We are moving to Halo from CW after 15 years in CW and the accounts team need this badly. Please push up the list!

We would love for Huntress to also feature a command shell option that we could hit. This would help investigation when a device is isolated as well as another way to start or stop processes.

Partner request for an MSP level dashboard on SAT similar to the Command Center on the Huntress .io. Also for SAT, an MSP level Report, rather than just each Customer. This would allow the MSP with lots of customers to be able to see at high level which customers need more attention and help, and then they could share how other customers are doing comparatively.

Current Huntress modules like Managed AV etc can be turned off at the MSP level, and turned on at the organization level, or vise versa. With SIEM you can turn it on at the top level, but to disable it you have to create an exclusion. While this provides the function, it would be easier to turn it off at the top level and turn it on for customers that opt in. Having the same behavior across the platform would be simpler as well.

Most of our devices are windows but having coverage on linux would be nice.

It would be really awesome if, when the ITDR recognizes a critical incident (and would normally disable a cloud only user) if it was able to identify if a domain controller exists in the same MDR tenant and pass through a powershell command to disable that user, and run a delta sync.

Users may not know the software and or don't want it because IT installed it. Would be nice to password protect the installation to require a PIN or something to remove.

In order to audit network connections to and from a device. Can the windows firewall logs be parsed and ingested into the SIEM platform?

It'd be nice if we could add rules for identities rather than entire orgs right from the VPN incidents. Ex: User suddenly logs in from Nord VPN, we call the user "Oh yeah I use that on my cell phone, I pay for it personally for when I'm travelling and using public wifi" or they suddenly show up in Mexico "Oh yeah, I'm down here visiting my abuela, I come 2-3 times a year" it'd be nice if we could from the incident screen just create the rule for just that user, rather than exposing the entire company, or having to go chase down the rule and create a new one for just that identity.

You don't currently detect the very common browser hijacker and adware known as OneLauch. I contacted support and was told you don't plan on doing so as it doesn't currently do anything more severe like provide remote access or execute commands. However, it installs itself through deceptive means through scareware advertisements. It makes itself very hard to remove and recreates links to itself when deleted. It serves up further scareware ads that other firms have said are linked to account compromises. It spreads through shared environments such as RDS servers and causes serious functionality issues. It also is detected by competing EDR solutions such as Crowdstrike. I implore you to reconsider and start detecting it. Thank you!