Managed ITDR

I ran into an incident report, for foreign country. However the % was 0. USA was 100%. The report showed Guatemala, with 2 logins there. I reached out to Huntress Support, Sam said "we round down to 0, since the number of logins was less than 1% for the Organization, we round down to 0" I explained that this is misleading, and requested this says <1% for the foreign country. He said to submit feedback here.

Add Cisco AnyConnect and OpenVPN as options to the VPN Rules

An alert should be generated if a random global admin account is created in an office 365 tenant. When a user is assigned privileged access it very well could be an IoC

Caused false positive events.

It would be great if there were a true two-way sync of incident statuses

ITDR Incident reports do not include the Entra Correlation/Request IDs for the sign-ins that are reported as malicious. This makes correlating the malicious activity in Entra harder than it needs to be. This change will allow customers to better understand the IoCs whether false positive or true positive.

Description: When a suspicious inbox rule was created in a shared mailbox, the detection was correct but the remediation targeted the shared mailbox account. Issue: Shared mailboxes have login disabled by default; they are accessed via delegate accounts. The compromised delegate account was not identified or contained. Impact: This leaves the attacker’s access intact, as the delegate can continue creating rules or exfiltrating data. Recommendation: Update detection/remediation to correlate session identifiers across mailbox events and target the actual compromised delegate account for containment.

Have a m365 ITDR client that has 8 authoritative domains and we manage 6 of the 8.

While other escalation and incidents include the organization name somewhere in the body of the email notification, it is not included in the specific escalation "Login without Usage Location".

There are a few errors with the GCCHigh Huntress App Registration powershell script. The first is that the Connect-AzureAD command needs the "-Environment AzureUSGovernment" to connect to a govcloud tenant. The second error is the login URL needs to be changed from ".com" to ".us" to denote govcloud. After those two changes, the script ran mostly without issue up until the logo file clean up at the end. I've attached a screenshot of that error.