Show IP Addresses on Escalation Page for Unexpected Country | Voters

Show IP Addresses on Escalation Page for Unexpected Country

complete

The incident/escalation page for unexpected M365 logins shows countries, VPN, browsers, but not IP address(es).
Would be very handy to have the list of IPs on this same page.
Recently we had a false positive, and had to go into Entra logs to review, only to realize it was our own IPs.

August 6, 2024

Rich Mozeleski

Merged in a post:

Add IP Address to VPN Escalations

Nicholas Cornoni

Please add source VPN IP address to the escalations where there is unrecognized VPN traffic.

April 11, 2026

Autopilot

Merged in a post:

Show VPN session detail in Escalation

Daniel Angell

Upon a VPN unrecognized alert, show details about the vpn session that triggered it. Presently you have to click into that user and review access to ID the VPN that caused the alert.

November 3, 2025

Stevez Gomes

The IP Address should be included in the emails/tickets sent. It wastes time to login to the huntress portal each time to figureout what IP Address the alert is being triggered from. The current email shows ORG had an unexpected login, which forces us to login to the portal to get more details, this can easily be avoided by simply including the IP Address and the user.

The user, ORG, and IP Address should be listed on the unexpected country emails/ticket sent ou without the need to login to the portal.

Rich Mozeleski

marked this post as

complete

Rich Mozeleski

marked this post as

in progress

Rich Mozeleski

marked this post as

planned

We will be adding IP address details to escalations as part of some post-GA enhancements in the next few weeks.

Todd Swartzman

Thanks, looking forward to it

Russell Tammany

absolutely necessary

Mike Fuchs

Really this needs to be built into all login Escalations not just the VPN it is standard on other products.

Russell Tammany

This also needs to be done for Country Escalations. Bonus points if you integrate with ipinfo.io IP database :)