Integrations, Webhooks, APIs

It would be great to add the ability yo not only select a Ticket Type but also a ticket template for each Notification type. This way we'd be able to auto-triage. Maybe it could Ticket Type or Ticket Template.

Ability to create email integrations at the organization level so incident reports for certain organizations will be sent to them and not the account level emails.

Today an API key is created at the account user level and inherits that user’s visibility across every organization in the account. There is no way to issue a key that can only see a subset of orgs. As an MSP we want to expose Huntress data to internal tooling (MCP server, scripts, dashboards) with different trust levels. Two examples- A key for our technicians that can query all client organizations but not our own internal Protek org. Compliance-driven scoping, for example a key used by out-of-country staff that is limited to the orgs they are cleared for, or a client-specific key for a regulated tenant (CMMC / ITAR) that cannot read other clients’ data. The workaround is a dedicated user account per scope, which is clumsy to manage and still exposes everything that user can see. Ask: let an account admin set an org allowlist (or denylist) on an API key at creation time, independent of the creating user’s own access.

I purchased SentinelOne via PAX8 and would like to integrate it with Huntress. Currently, we can only manage Defender, but having the ability to integrate SentinelOne would enhance our workflow and security management. It would be beneficial if this integration could be developed.

Would like to see some sort of integration into Jira. Jira is a widely used service management tool and being able to route incidents, events, etc into Jira would be helpful for tracking purposes, esclations, etc. This is something that S1 can do today but their implementation is wonky.

Great to have this integration built. We have one request. Can Huntress add the mapping of priorities? We would like to match the Huntress "Critical, High and Low" with ticket priorities in HaloPSA. This would help flag critical and high events more quickly. Thanks!

The HaloPSA ticket integration now features the option to change the status of the HaloPSA request after resolution via the "Status after Huntress Resolution" option. Currently, this is a "silent" action on HaloPSA. Is it possible for this action to add a note to the ticket, just like the e-mail integration sends a "This incident has been resolved" email after the incident is closed on Huntress side.

Would it be possible to get a 'Last Updated' date/time field on all Escalations? We're mainly concerned about the "macOS EDR - Endpoints Missing Key EDR Functionality" Escalation, as that piles all endpoints into one alert. The issue is that made a PSA ticket when the Escalation was created, but we got 0 updates as more endpoints were added, and that meant for just under a week we missed about 15 devices that didn't have EDR cover. A 'Last Updated' style field would work, so the PSA ticket gets updated whenever there's a new update on the Escalation.

Would love to see the ability to close a PSA ticket, and in turn, that resolves the incident.

We'd like to use the API to insert and remove Isolation exclusions at programmed times to coordinate with known pentest activity. As it stands, these adds and deletes have to be done manually and sometimes out of business hours. We'd love to be able to automate this from our Rewst platform.