ITDR (MDR for Microsoft 365)

Add the ability to add multiple countries when creating location rules.

Currently this is only available at the Account / MSP level and not granular down to Organization / Client level.

We have certain accounts that are used by contractors around the globe. We do not want Huntress to keep notifying us of unexpected logins, and I don't want to have to spend my time creating and maintaining rules for all the countries that are allowed. We want to allow logins from any country except those that are high-risk or sanctioned, like North Korea, Russia, Iran, etc. If we do have a contractor working in one of these countries, then we'd also like the option to create an exception for that specific country while disallowing all the other risky countries.

It would be amazing if you could create an expected location rule for a specific user with a policy expiration date through the Huntress API. Seeing as how you already sponsor CIPP, I think this would be a great addition to their existing vacation mode, which excludes a user from a conditional access policy for a period of time. This would prevent the Huntress escalation for the unknown location, as it would already be defined before the user traveled. Other partners could also use this API with other automation platforms like Rewst. This would reduce the need to hop to different portals, allow us to be more proactive, and provide better details to the Huntress team without our help desk forgetting.

Whenever access is revoked for a user through ITDR, it should log this action somewhere so other users can audit this. Or at the very least have record of when the access was revoked (timestamp with username)

it's a bit of a pain to have to log in to huntress to see who these notifications are referring to, especially when i see the notification through my phone or via my ticketing system it would be helpful to have the user and tenant listed in the subject line or at least the body of the email so i can jump right into their m365 tenant and verify is the sign in is a problem

We have many requests from customers for Organisation admins to have the ability to create Unwanted/Authorised access rules. This is a vital improvement for us.

Unwanted Access sends the alert emails in another style than the normal incidents. The customer tenant name is not included in the subject. This is mandatory for filtering the mails to the proper customer queues.

I realize this would be tricky to implement because of the numberous different ways organizations can implement conditional access policies to block unwanted countries. However, with the introduction of the feature to track unwanted access by countries in Huntress ITDR we've now been doing double duty having to track and enter scheduled exlusions in both Huntress and Entra ID (we utilize the open source CIPP to schedule these exclusions). It would be great if Huntress would integrate with Entra ID so that the scheduled/timed exclusion that we're creating in Huntress to mark that country as allowed would have the ability to link to a conditional access policy that it can update on the start/end dates of the scheduled travel as well. Due to everyone potentially having different conditional access policies - the easiest way I can invision this being implemented is simply pulling a list of the Conditional Access policies from the tenant when scheduling the exclusion and requesting which policy should be used for this particular exclusion. Then Huntress can add the user to that conditional access policy for the exclusion when the scheduled travel starts and then remove them when the scheduled travel ends. This is coincidentally the same way CIPP handles these exclusions. This allows this functionality to work for anyone who has individual conditional access policies for each country, one single conditional access policy for all countries, or anywhere inbetween.