Managed EDR

The Problem: Currently, VPN alerts might trigger regardless of whether the device is a managed/registered asset. This creates noise for IT teams who allow remote users to connect via VPN on their company-issued laptops. (e.g. access WhatsApp from Dubai) The Solution: Implement a "Device Awareness" filter for VPN-related detections. Known Device: If a VPN connection originates from a device with the Huntress agent already installed or a device registered/joined in the Intune, the escalation should reflect that.

When you decide to close an incident using the "dismiss once" option you can't add a comment explaining why you made this decision.

prevent orgs from installing more agents and be able to set a limit to the number of agents for an org.

Can we get the ability to set up all defender and intune settings through here instead of the limited ones? Currently if we have devices that are intuned joined we leave it in audit mode and let intune manage because it has more options

We found a few devices in our fleet which was running Ubuntu versions way past end of life. Would it be possible to set up checks against OS versions on host and see if they run an OS which is past its end of life, and then flag it or send a warning? This goes for all OS ofcourse, not only Linux.

Adding credential theft monitoring seems like an easy fit for Huntress and would kill off a competitor service too.

A path for submitting an email for analysis and potential integration with the SAT platform if it is a legitimate phishing campaign. This could help validate user training and also provide better feedback for why a message was classified the way it is. However this may be something where an alternative is tapping into the telemetry from Microsoft to capture and visualize if a user is being targeted by phishing more than others and potential escalation to ensure accounts are sufficiently monitored/locked down.

Tracking and recording user logon and logoff events on a protected Endpoint to monitor access, ensure security, and detect unauthorized activities

Ability to deploy canaries to network drives/custom locations

Partners could establish what RMM they use and if another RMM appears on a machine under their management, an alert/isolation could take place. This could prevent an attacker from leveraging what's typically viewed as trusted RMM software as a persistence mechanism other than an autorun.