Managed EDR

On the Command Center, Managed Antivirus widget it currently only displays Windows Defender and then Unhealthy and Unmanaged if there are devices with another EDR/AV product installed. It woudl be very useful to have subtotals of WHICH EDR/AV products are observed. In some cases we use Sophos plus Huntress, so just showing Windows Defender as Unhealthy and Unmanaged is not helpful nor totally accurate if the customer uses another EDR/AV product by design. It also makes it difficult finding the devices we need to target to remove a previous MSPs tools since we cannot see the list of products.

Manual Sync of devices survey

The screenconnect host section is very useful. It would be great if we could get a notification about new hosts appearing in here because it would be untypical for a new SC server to be added normally and would usually indicate either an incident, or something that needs to be addressed (i.e the previous IT companies remote access being deployed from somewhere). Ideally this would be expanded to alert on additional Remote Access and RMM tools. E.g Splashtop. Attackers are increasingly using industry standard MSP tools to stay under the radar and being able to give us a heads up directly about this would be great. I appreciate the SOC would alert on suspicious activity, though the MSP will be more aware of the context - the ability for us to toggle an option on for this would be ideal.

Would be good to collect the Mac logs into the SIEM its a requirement for some of our clients right now and makes sense to be in Huntress.

It would be great to be able to create alerts (if Huntress isn't alerting on them already), based on a certain condition, such as an event ID, condition or query. Example alerts we would like to create or have Huntress alert on: o AD User Account Created o AD User Account Deleted o AD User Account Disabled o AD User Added to Privileged Group o AD User Added to Universal Group o AD User Removed from Group o Failed AppGate Logins Failed OpenVPN Logins o Firewall- DoS Protection Triggered o Firewall - Fan Failure / Critical Thermal Reading o Firewall - Local User Created o Firewall - Logs Cleared [URGENT] o Firewall Log Status o Firewall Multiple Failed Admin Login Attempts o Multiple Failed AD Logins o Rapid Successful AD Logins o Windows Event Log Cleared

Adding Firewall rule monitoring to have visibility to when an attacker attempts to block comms with Huntress, enhancing logs to lead to Detectors that'll alert us to potential tampering and locking down the uninstall process even further

It would be great to be able to create alerts (if Huntress isn't alerting on them already), based on a certain condition, such as an event ID, condition or query. Example alerts we would like to create or have Huntress alert on: o AD User Account Created o AD User Account Deleted o AD User Account Disabled o AD User Added to Privileged Group o AD User Added to Universal Group o AD User Removed from Group o Failed AppGate Logins Failed OpenVPN Logins o Firewall- DoS Protection Triggered o Firewall - Fan Failure / Critical Thermal Reading o Firewall - Local User Created o Firewall - Logs Cleared [URGENT] o Firewall Log Status o Firewall Multiple Failed Admin Login Attempts o Multiple Failed AD Logins o Rapid Successful AD Logins o Windows Event Log Cleared

When "Assisted Remediations" timeout (not failed) on a host, it would be great to have the ability to re-run them. This will lower the number of manual remediations by the customer in the event of laptop becoming docked (therefore changing the device's IP) or the device being shutdown while the remediations are being attempted.

Tracking and recording user logon and logoff events on a protected Endpoint to monitor access, ensure security, and detect unauthorized activities

Are there any plans to add a browser add in for edge and chrome toprotect from hijacking browsers