Managed ESPM

Screen connect installs all have a particular instance - and the install is named accordingly as is the install path folder - if the ESPM RMM console would display the instance ID and allow for quick allow and deny actions based on that instance name.

As part of ESPM, it would be great to be able to lock down USB ports on devices. It's a feature that many MSP's have asked me about

Would like the ability to approve/reject a specific RMM tool for certain endpoints only, or approve/reject globally with exception for specific endpoints.

Many security and compliance frameworks require organizations to enable and enforce some form of Application Control and to maintain a list of organization-approved applications that can be installed and run. In the many conversations we've had with our partners and prospects, we've found that managing Application Control and maintaining a list of approved applications is a significant burden even for larger teams and nearly impossible for small teams. The journey of starting in audit mode and building a list of approved applications and eventually getting to enforced mode is one that many folks never finish. Our intention is to build a fully managed Application Control capability into the Huntress portal that will allow the Huntress SOC to manage and maintain lists of legitimate applications and will enable our partners to add those applications to approved lists, while maintaining a short feedback loop for end users so they don't get stuck waiting days for security approval. This feature request will act as an umbrella for this functionality. If you are interested in helping us build this out by joining a Private Beta group, please upvote this feature request and we will email members of this group as we open up more spots in the beta.

The "last seen" date field could indicate a tool was removed, or that a computer has been offline for a long time. Adding an indicator that the tool was found on the last scan, or no longer exists on the endpoint would make the tool more usable.

We use different RMM tools with different clients so it would be nice to allow anydesk for example just for one organization rather than for all organizations

It should be useful to export the RMM tools inventory at a device level - list organization, endpoint, tool, status, last seen and possibly install path. Especially when onboarding ESPM, seeing a consolidated list of tools would be a big time saver.

The various RMM tools can be sourced from different vendors. We need to have a breakdown of each tool by account ID linked to the software. For example, Datto RMM has a Cagservice.exe.config file that is a JSON with a lot of data about the installer source. There is an accountUID field that shows the account that the installer is linked to. While I know that blocking of tools can't be limited by key, but the reporting should have these details.

It would be great if you could have starter queries for things like: VPN Connections Blocked outbound traffic website / content filter (for quick troubleshooting) SDWAN / VPN Tunnel messages WAN interface health / drops

There are many programs that customers will use that give remote access to actual vendors. It would be nice if they do need to run one of those programs it pops up an alert for them to call x phone number for approval. Then us as techs get a text with the customer account name. Name of the program and an access key we can give them to give them the ability to run the program for 1 hr (or this is a threshold we set within huntress as a default) So once they call we do some investigating into what its for before giving them the access key.