R
Reni Nishku
Hi Huntress Team,
It has been unnecessarily confusing to investigate VPN-related ITDR alerts, particularly in BYOD environments where users access corporate resources from personal cellphones using VPN services.
I've raised this concern multiple times, but we're still running into the same issue.
A few improvements would make these alerts significantly more actionable:
  • Device context: Clearly distinguish between sign-ins originating from personal mobile devices and corporate-managed laptops directly on the alert review screen.
Show this upfront.
  • IP enrichment: Provide more context about the source IP. Is it residential, cellular, commercial VPN, or a data center? Who is the ISP?
  • Alert investigation: Surface enough information to help analysts determine whether the activity is genuinely suspicious without having to cross-reference Microsoft Entra sign-in logs every time.
Currently, we routinely have to validate these alerts against Microsoft logs to understand what actually happened.
This raises a bigger question about the value of ITDR as a standalone product. If we consistently have to rely on Microsoft Entra and Defender logs to validate Huntress alerts, it becomes difficult to justify paying for ITDR rather than configuring the appropriate detections and alerts directly in Microsoft Defender.
The value of a managed detection product should be reducing investigation effort, not adding another layer of alerts that require manual validation every time.
I'd appreciate knowing whether these improvements are on your roadmap or if there are existing capabilities we're overlooking.
Thanks,
Reni