Managed EDR

Currently Organization keys can be accessed via Settings -> Download Agent page, which is more of a "Global Admin" workflow. There is no quick way to see each Organization's key when you're already scoped to it. This increases the risk of mis-deployments when technicians are in a hurry and is not very intuitive. The place where agents are managed should not be the be the place where you see the key needed to deploy more agents for that organization

In EDR > under the section, Binaries - there are several columns, but nothing for the actual filepath or at least filename. Currently in order to see what unknown or suspicious binaries, I have to click on SHA256 or the VirusTotal link to see what it is. Add the filepath column next to SHA256

Today we have to click on individual agents and infer "online vs. offline: from "Last Seen" check-in behavior. The Agents dashboard for both Accounts and Organizations does not expose a simple explicit state at a glance. This slows down triage and makes it more difficult for technicians to quickly confirm if a device is "live." Add a clear, Online/Offline (or Currently Connected) indicator directly in the "Agents" list view (add to both global and organization levels), ideally with sortable/filterable status and hover text explaining logic (e.g., seen in last X minutes). This request is in addition to the Organizational Level "Last Seen" and "Unresponsive" Agent Behavior.

Ability to have unique keys per organization (similar in length/uniqueness to account keys) that can then be disabled in the event that a customer departs and the Huntress Account holder needs to disable the account. If you give this an upvote, do us a favor and submit your use case! This will help us get things moving.

While it's great to know when an unsupported AV other than Windows Defender for Defender for Endpoint is on the device, the "Red icon" status raises more concern than necessary when reviewing the console. Instead, could classifying it as "Incompatible" like you do with macOS be better?

When adding an exclusion, it would be helpful to have a description about why we are adding the exclusion - otherwise, over time users will forget why they are added.

It would be nice to have the agents page be able to filter our recently online or online machines on top of the other filters. You can sort by date on the Agents page but if you need to sort by Agent or EDR version it resets the date.

I do not like your change of the Last Seen column to an absolute time instead of 5 minutes ago, 4 days ago.

It would be helpful to have visibility into the number of pilot endpoints in our organization and determine which devices are flagged as pilots. Additionally, understanding if these change over time and whether pilots are assigned per organization or across the entire account would provide better control and planning.

The current wording suggests that installing the mobileconfig will also install the agent, which is misleading. It would be beneficial to clarify that the mobileconfig only sets permissions and does not install the agent itself. This change would prevent confusion for users who are setting up deployments.