Managed EDR

In environments where third‑party AV (e.g., Symantec) is intentionally the primary protection on certain servers (such as domain controllers), the “Hosts not being properly protected” escalation creates recurring, non‑actionable noise. Today, the only portal action available is Remove, which clears the current hit but does not persist. When the next health check runs and Defender real‑time protection is still disabled by design, the escalation reopens. Request: Add a persistent, per‑host suppression / “expected configuration” option for this escalation. Desired behavior: Scoped to individual hosts Scoped to this escalation only Requires an admin note for auditability Does not affect other escalations or detections Value: This keeps the escalation effective for workstations and genuinely misconfigured systems, while eliminating repeated noise for servers with intentional third‑party AV configurations. It improves signal‑to‑noise and aligns with real‑world data center security models without reducing protection.

Add a Huntress-initiated "Repair Defender" action that can be invoked. Behind the scenes, this could orchestrate the existing recommended sequences, (e.g., validate Defender services, attempt lightweight reset, then optional deeper OS/Defender repair path), provide status back to the portal and log what was executed. Configuration could include safeguards (e.g., only when Defender is primary/only AV, confirmation prompts for destructive steps, etc.) There is excellent documentation for resetting and repairing MS Defender (Reset Platform, uninstall/re-install on Server, resetting policies, etc.) but it is all manual or script-driven today. There is no simple Huntress platform "Repair Defender" action in the UI. Frontline technicians must copy scripts, run OS-level repair commands and interpret output which can be error-prone and time-consuming.

Provide a dedicated AV Inventory/Health reporting capability that can be: * Filtered and exported at Account and Organization scope. * Show per-endpoint AV Product, Security Center Status, service status, health (Protected/Unhealthy/Umanaged/etc.) and last scan/update. *Optionally summarized by organization (counts of endpoints per AV product and health state) to support QBRs and cleanup work.

When the portal tells us a machine has "Other AV" Would be nice to know exactly which AV so we can action faster, thanks!

Currently, if an EDR Escalation generates a ticket in Halo PSA, updates to the escalation are not reflected in the ticket. Once the initial escalation is resolved, the ticket closes. If new hosts are added to the escalation, notification is only sent via email and the ticket system has no visibility into the unprotected/escalated hosts. This leaves endpoints unprotected due to lack of visibility.

It would be nice to be able to schedule Full Scans the way we are able to schedule Quick Scans to run on a given time interval.

Managed Antivirus on the endpoint is being monitored by Huntress and surfaced in the dashboards. Unfortunately we can't live in the Huntress dashboard, but we do live in our PSA and will visit the Huntress dashboard if tickets are raised for actionable items. Please add the ability to create tickets for Managed defender unhealthy devices to ensure they're surfaced for resolution by our support teams as tickets.

Be able to force enable defender when defender is disabled.

One of the key components of Windows Defender is the Attack Surface Reduction (ASR) Rules. In my opinion, the ASR rules is what makes Defender such a powerful platform. It would be great if we could include the ability to turn on, manage, and add exclusions for the ASR rules in huntress. Other competitor platforms can do this and it works quite well. These rules exponentially expand the effectiveness of Defender.

Hi team, would love the ability to control tamper protection for MAV via Huntress. We have a few clients that use it and it can get turned off for a variety of reasons and would love to have that control in a policy.