Managed EDR

Users may not know the software and or don't want it because IT installed it. Would be nice to password protect the installation to require a PIN or something to remove.

It would be great if Huntress looks to add control for the following items: -tamper protection -controlled folder access -join Microsoft MAPS > Advanced MAPS (GPO or local) -Block at first sight (GPO or local) -Configure extended cloud check > 20 seconds (GPO or local) -Cloud protection level > High+ blocking level (GPO or local)

Allow "Jump to page" or "jump to timestamp" option in process insights.

We are very happy with the host isolation feature but it would be very helpful to have the ability to whitelist our RMM even if it had to be done manually. That way we can confirm remediation and preform additional scans before restoring complete LAN access to a host. Also many 3rd party antiviruses are cloud hosted now. We would like the ability to whitelist the AV cloud servers so that we can continue to manage security/AV on isolated hosts. I know there is a concern that the RMM may be infected itself so you could have a new option after isolation occurs. i.e. A manual "Allow RMM hosts or Allow Whitelisted hosts" button rather than having to completely remove the isolation protection to gain access. Or possibly allow whitelist connections for X minutes.... Something to avoid having to dispatch a technician onsite for verification before completely lifting the isolation.

Use case is to allow techs to manage the majority of our Orgs. Which can be done by adding the user at the Account level. However, that will also give access to our internal Org. Being able to exclude specific orgs from users at the account level will be helpful. Otherwise, we'd have to create users per Org.

Display which host(s) were investigated We don't have a way to show this currently. In addition to investigating suspicious/malicious items, we also use investigations to internally categorize legitimate applications such as security products and system administration tools. For commonly used software like antivirus applications and system management tools, the investigation may apply to multiple organizations (and hundreds of hosts). This makes it hard for us to visually represent when there are a large number of organizations and/or hosts https://support.huntress.io/article/54-how-do-i-determine-which-host-an-investigation-applies-to

Now all our users receive an email when an unresponsive agent of a customer is installed. Please make it so only admins will get this. Thanks :)

Regarding the recent "Huntress detected one or more files on this endpoint that may contain passwords" notifications. We want the option to schedule this as a recurring scan. We and our customers found it to be extremely useful.

Huntress now also searches for password files. Please bring in other languages as well, e.g. I often have files with customers in German-speaking countries that are not called Password something like "Passwörter" or "Passwortliste". Source is this reddit post: https://www.reddit.com/r/msp/comments/16zanc5/huntress_low_incident_about_files_that_contain/

For the purposes of our IR documentation, I think it may be prudent to add a testing feature where you can automatically isolate a host to test alerting.