Managed EDR

Under the "Escalations" page, could we display the user's UPN in the "Entities" column? Since these alerts are user-specific, showing the UPN would provide more meaningful context. Currently, the field displays N/A. Thank you kindly

Our organization relies heavily on Huntress agent tags to classify and manage distinct endpoint populations, including vessel endpoints, shoreside endpoints, servers, and other operational device groups. We are currently seeing two limitations with the tag functionality in the Huntress Agents view: The Tags column is not consistently displayed. At times, the entire Tags column is missing from the Agents page. After refreshing the page one or more times, the Tags column may reappear, at which point tags are visible and editable again. Even when tags are visible, there is currently no practical way to filter the Agents list by tag. For our environment, tags are not simply informational metadata. They are actively used to identify and separate endpoint populations with different operational and security requirements. For example, we use tags such as: * vessel * shoreside * server Being able to consistently view and filter by these tags would allow us to quickly identify the correct endpoint population when reviewing deployment coverage, endpoint health, troubleshooting issues, investigations, and reporting. Requested improvements: * Ensure the Tags column loads consistently in the Agents view without requiring page refreshes. * Add Tag as an available filter in the existing Agents filter menu. * Allow filtering by one or multiple tags. * Support include/exclude conditions where possible. * Preserve tag filtering during exports. * Consider exposing tag filtering in other endpoint-related views where applicable. The existing tag capability is valuable for our organization, but inconsistent visibility and the lack of filtering significantly reduce its usefulness for endpoint administration. Specific area of the issue: Huntress Portal > Organization > Agents > Tags Column / Filter Menu Observed behavior: The Tags column will intermittently not appear in the Agents table. After refreshing the browser, the Tags column may return and tags can once again be viewed and edited.

request to have this generate an alert automatically - not a query every 30 minutes

The option to enable notifications or admin emails when a risky exclusion is created.

Hello! Posting here on behalf of a partner who was requesting additional information from the detections page when exporting it. Here's what he said: "Is there any way to obtain the more detailed information about each detection that is shown when clicking on the detection name, as in the screenshot below? This detail doesn't appear to be included in the CSV export, so I'm wondering whether it is available elsewhere or perhaps accessible via the API. It would be useful to review the detections and their associated telemetry without having to manually click through potentially tens or hundreds of alerts across multiple endpoints. The CSV export is useful for the high-level information, but it loses quite a bit of the context behind each detection. For example, being able to see that a particular detection related to an apparently free calendar application installed by a specific user, which was subsequently blocked, provides considerably more useful context than the detection and remediation status alone."

We use a single Microsoft Defender for Endpoint tenant across multiple endpoint populations that need to be separated into different Huntress organizations for operational and policy requirements. Currently, Huntress allows an MDE tenant to be mapped to only one Huntress organization. As a result, when Huntress agents are moved into a second organization, MDE Device Discovery can no longer associate those endpoints with their active Huntress agents and reports them as Agent Missing. It would be helpful if a single MDE tenant could be associated with multiple Huntress organizations, with Device Discovery correlating each MDE endpoint to the Huntress organization containing its corresponding agent. Our use case is separating shoreside and vessel endpoints into different Huntress organizations while both populations remain within the same Microsoft MDE tenant. The Huntress agents and EDR remain active in both organizations, but Device Discovery cannot accurately represent coverage across both because of the current one-tenant-to-one-organization mapping limitation.

Hello Team, Could you please create a feature where MSSPs can receive specific reports monthly rather than daily for passwords saved locally on users machines and SharePoint. With large customers with many organisation units this can be quite prevalent and this in turn generates many alerts that analysts need to triage. Having an option where these can be deferred to a monthly report will help to combat alert fatigue.

would be great to be able to add <dynamic> Tags during deployment from RMM (NinjaOne and Addigy) using the install script

I am looking for a straightforward way to install the Huntress agent using Jumpcloud. Currently, there isn't a specific guide available for this method. Having a dedicated guide would simplify the process and make it more accessible for users who rely on Jumpcloud for installations.

I can see that when a device is isolated, it creates an HTML file that pulls some data from Huntress (provider name, etc.). Can we have a feature that means you can actively customise this to contain things like phone numbers and email addresses to contact. This will make triaging easier, and allow for faster response times from end users when a device is isolated.