SOC/Incident/Investigations

During large-scale or successful lateral movement incidents, we would like to speak with a Huntress security analyst for additional background and guidance, beyond what is listed in the incident report. A 1-hr SLA would be fine.

Would love to see the ability to close a PSA ticket, and in turn, that resolves the incident.

Please add the ability to add comments to the incidents, as that would improve communication between our team, so they don't have to login to the ticket system and find the ticket to see what the update is.

Can you add the texts and robocalls for critical incidents at the organization level? It would be nice to be able to set this up for IT managers, etc. at individual customers.

We have a request in from a customer to be able to view the Escalations menu. Currently this is only available to the MSP Partner

Good Afternoon, Cytek currently has an Organization within Huntress called USOSM. Now, we have many clients underneath this organization. Currently, we know we can download a threat report for each organization. But corporate will not have the time to go through over 100 reports and we were hoping that we could just combine each report into one. After some discussions with Andrew Meier and Kyle Sada, we now know this is not a current possibility therefore, I am submitting a feature request in hopes that one day it can be. Thank you again and have a good day. -Tyler A.

Having the ability to "release all" isolated endpoints with a single click would be nice as it can get tiring having to manually release each endpoint when more than 10-15 are isolated on an org-wide incident.

When Windows Defender detects blocked Brute Force login attempts to a device, please can Huntress Trigger an Incident investigation which would in turn create a open ticket in our sytems to also investigate.

When automatic and auto-approved remediations are enabled, and when manual remediations are required by the MSP for an incident, the incident should not be resolved until manually resolved by the MSP. Example event: There has been a compromised user within Active Directory and one of the manual remediation tasks is to reset the user's password. Huntress isolates the host. One of the steps for remediation in the example above was to reboot the host, which part of our standard patching our RMM did reboot the host. When the machine booted back up, Huntress thought that was a remediation step which took the host out of isolation automatically. However, the user's password had not been changed and by removing isolation had opened the machine up to further attacks. The incident should remain active until the password has been rotated and should only be manually resolved. The host should also remain isolated until all manual remediations have been completed. Further information can be found in ticket 102738.

We receive a ticket now for hosts isolated by the Huntress team as a part of an investigation, but we'd also like a ticket for any manual host isolations performed. If someone calls in because their device can't access the internet, I want a tech to be able to easily identify that as the reason within our ticketing system. If they weren't the tech that isolated within Huntress, they'd have no way of knowing it was triggered there unless they had credentials to the Huntress dashboard and thought to look there.