Great news for your quality of life with your Huntress environment: Our PSA integrations now support auto-updating ticket status! After an incident report is closed within the Huntress Dashboard, you can have it automatically update your PSA to keep your tool in sync with Huntress incidents.

To enable this functionality, log into your Huntress Dashboard, navigate to the integrations page, and edit your PSA integration settings.

Imani is taking a much needed vacation, but when someone catches wind of a big deal her company is working on, will she be able to protect the incredibly valuable details while working remotely?

Learning Objectives:

We're excited to announce that Unwanted Access for MDR for Microsoft 365 is now in General Availability! Unwanted Access protects your identities by detecting malicious activity related to logins to your Microsoft tenants. Unwanted Access introduces several new features:

Huntress now detects differences within login events from the same session. Our SOC analyzes these differences and will report on and isolate the identity if warranted.

Huntress now allows partners to configure Expected and Unauthorized rules within the Unwanted Access dashboard. These rules allow partners to tailor their SOC experience and provide context to Huntress analysts investigating potential malicious activity. Expected rules allow partners to specify countries and/or VPNs through which logins are expected to occur. By default, the identity’s usage location (country) from Microsoft will be treated as an Expected country.

Huntress will still evaluate all events for malicious activity, but Expected rules help the SOC filter out anomalies from confirmed malicious activity. Unauthorized rules allow partners to specify countries and/or VPNs through which logins should never occur. Huntress will send an incident report and isolate identities that trigger Unauthorized rules.

Huntress will now generate escalations for unknown login locations and unknown VPNs. These escalations provide partners with the ability to tell Huntress (via rules) if activity is Expected or Unauthorized. Escalations are only indicative of unexpected login activity and should not be considered incident reports.

We are continually iterating and improving upon Unwanted Access. To request specific features and see what is coming, please visit http://feedback.huntress.com/.

You can now configure which hosts collect Windows Event logs at the Account, Organization, or Host level. We recently added a configuration page that provides an Account-level setting to determine if all supported Windows hosts collect Event logs. With this setting you can specify whether you want to collect Event logs with a broad stroke. If you want to collect Event logs everywhere, then you can enable this and you are done.

If instead you want to customize which Organizations and Hosts collect Event logs, you can alter the settings at the Organization or Host level to override the Account-level setting. This way if you want to only collect Event logs from a few Organizations, you can leave the Account-level setting disabled and create override settings for only those Organizations where you want to collect logs. On the other hand, if you want to collect Event logs from everywhere a few hosts, then you can enable collection using the Account-level setting and create override settings for the Organizations where you don't want to collect logs.

On Monday, August 19, Huntress will activate email and PSA ticket notifications for two new types of escalations. Escalations are important security-related inquiries that Huntress would like your help in answering. They are not incident reports and do not indicate that malicious activity is occurring.

Starting Monday, you might see these two new types of these escalations via email or PSA (depending on how you’ve configured escalation notifications in the portal).

- This escalation is sent with low severity. It specifies which identities within a particular organization are missing their Microsoft Entra Usage location. Huntress relies on the usage location to determine the “home location” for the identity and to alert you if the identity logs in from somewhere else. This escalation type provides details on the affected identities and links to the Huntress knowledgebase article explaining how to set the usage location in Microsoft.

- This escalation is sent with high severity. It indicates that an identity has logged in from an unexpected location or with an unexpected VPN. If the Huntress SOC detects clear signs of malicious activity, they might follow up this escalation with an incident report. This escalation can be resolved by creating an Unwanted Access configuration rule that labels the login location or the VPN as expected or unauthorized. Setting the location/VPN as expected helps tune your environment and assist our SOC in filtering out false positives when responding to potential incidents. Setting the location/VPN as unauthorized immediately logs out and disables any affected identities; it will also do the same to those identities logging in from that location/VPN in the future.

We’ve been rapidly iterating on this functionality and will continue to introduce improvements over the next several weeks. Please visit feedback.huntress.com or reach out to support with any questions or concerns. Thanks!

Huntress Product Team

Huntress MDR for Microsoft 365’s Unwanted Access capability is now in public beta! Unwanted Access protects your identities by detecting malicious activity related to logins to your Microsoft tenants. Unwanted Access consists of several new features for our partners:

: Huntress now detects differences within login events from the same session. Our SOC analyzes these differences and will report on and isolate the identity if warranted.

: Huntress now allows partners to configure Expected and Unauthorized rules within the Unwanted Access dashboard. These rules allow partners to tailor their SOC experience and provide context to Huntress analysts investigating potential malicious activity. Expected rules allow partners to specify countries and/or VPNs through which logins are expected to occur.

Huntress will still evaluate all events for malicious activity, but Expected rules help the SOC filter out anomalies from actual malicious activity. Unauthorized rules allow partners to specify countries and/or VPNs through which logins should never occur.

: Huntress will now generate escalations for unknown login locations and unknown VPNs. These escalations provide partners with the ability to tell Huntress (via rules) if activity is Expected or Unauthorized. In beta, these escalations do not generate PSA tickets or emails, but will generate reports if activity is deemed Unauthorized by the partner.

Huntress values partner feedback and, during this public beta, will maintain a keen eye on feedback.huntress.com.

You can now simulate incidents for EDR and Microsoft 365! This feature lets you experience the Huntress incident response workflow as if a critical-severity incident was occurring in your network or Microsoft 365 tenant. Incident simulation aims to answer the question of "Is this thing on?", but can also be used during tabletop exercises to test security response protocols.

Today we update our ConnectWise, Autotask, Syncro, and HaloPSA integrations! We will now automatically have tickets update when a Remediation Plan is Approved or Rejected within the Huntress Dashboard, the following information will be parsed into the PSA Ticket:

No additional configuration will be required to include this new functionality.

We’re excited to announce an update to the Huntress UI Dashboard with new icons on the lefthand navigation that streamline access to our core product offerings:

When selected, these icons will lead you to the associated service detail pages you have accessed in the past.

Additionally, you'll notice the reporting icon has been moved to the top navigation button for easier access, and the Partner Enablement icon is now accessible through the top right menu.

We are excited to announce that we have updated the Huntress Platform to highlight comments from our SOC Analysts on investigations they have conducted, even for cases that were reviewed and closed without further action. Analyst comments were previously included with our foothold-specific investigations, but were phased out of the UI design when we released the more all-encompassing Signals Investigated feature. We are now reintroducing this information to reinforce the human-centric management and support that Huntress has always provided.

You will now see the investigative comments and the analyst's first name for all signals investigated by the Huntress SOC.

Please note that this change does not affect the signals we have reported to you; it only applies to signals that did not warrant a report being sent, as they were found to be benign.

For more information, please take a look at our Support Doc