Managed EDR

A Search bar at the top that allows you to search/switch organizations that stays up at the top no matter where you are. Right now, it's just hovering over the portal name at the top left and then having pick the customer, or clicking the organization tab, which disappears after clicking within any organization.

When partners work with third-party vendors for IR, Forensics, etc., sometimes those teams need to use additional tooling that is difficult to do when a host is isolated. The partner in this example has a team needing to use CrowdStrike and the allowlist the app says it needs is by URL only and there are about 30 of them. They would like the option to add the URLs or select specific tools instead of having to lookup each IP tied to the URL, add IP, rinse, repeat, etc.

I spoke to support on this. We have surveyed our user base and been sending them the free link to the SAT for password storing. The feedback is grim, none of them login to watch it. I am willing to bet that the same applies for the majority of people that send that out. This is a missed opportunity. We would like it, and I am sure Huntress would like it, as a way to give them training video quickly, but to ALSO promote SAT. Surely there is a way to publish that link as a public link, and then slap advertising around it for Huntress and us, the partner?

Granular Control of Unresponsive Agents

I am working with a partner who would like to add more than one point of contact in the Emails & Notifications section of the Huntress Dashboard.

It would be good to include disabled firewalls, screenconnect hosts, password file detections etc on the monthly reports. We're currently going through a proof of value campaign with our customers and without that information on the reports unless there is an actual security event we have less information to prove value.

I manage my exclusions by group policy and MDM, and I'd like them to not be flagged as non-compliant. It would be good to have a way to provide account and organization exclusion lists to huntress that wouldn't actually apply the exclusions, just check the host exclusions against the list and consider them compliant.

Currently there is no control from Huntress to manage syslog sources, no ability to mark a source as illegitimate, or delete inerrant logs from an undesired source. I understand this can be managed by firewalls, but since it is not secured by TLS and SIEM ingestion has data and cost implications from within Huntress, managing this from Huntress grants control within same department/interface.

It would be great to being able to manage the Agent version and perform roll-back from within the portal itself. Like some other vendors offer. That you can update clients based on organization level or groups - specially if Auto provisioning is in place