Managed EDR

It would be extremely helpful if agents that remain unresponsive for a certain period could automatically transition into a non-billable state. We’ve noticed that in co-managed environments where customers handle their own device refresh cycles - devices are sometimes wiped and shelved when a user leaves, but the Huntress agent isn’t uninstalled. This results in continued billing for inactive devices. Ideally, if an agent remains unresponsive beyond a defined threshold, it would be marked as non-billable. Should the device come back online or re-register, billing and protection could automatically resume.

I have done some testing with canary files. One thing I have noticed is that it does not seem like encrypting a canary file causes the agent to sync early. As in both tests it took 15-20 minutes for it to detect the canary has been encrypted. Then 5-10 minutes for the host to be isolated and a report sent. With things like SSD's being more common that time period allows a lot of damage to be done and for network shares to be encrypted. Maybe have it check the canaries every 60 seconds and force sync with Huntress if one turns up missing. This would take down the time to around 10-15 minutes for a response instead of 25-30 minutes. It appears this happened to someone on reddit already. It probably would have been stopped much earlier if it force synced. Full conversation here for context: https://www.reddit.com/r/msp/comments/16xfmou/bitdefender_mdr/k32q8fp/?context=3

Adding credential theft monitoring seems like an easy fit for Huntress and would kill off a competitor service too.

Ability to deploy canaries to network drives/custom locations

Due to age and trying to prevent this topic from becoming stale, im recreating this post: https://feedback.huntress.com/ransomware-canaries/p/ransomware-canaries-ability-to-put-deploy-canaries-to-network-drives-custom-loca This needs to be implemented as soon as possible. Not monitoring all system drives is a huge blind spot and I'm baffled this has not been implemented yet. One of our clients were recently hit with ransomware and the attackers went after the data drives first. It's common for a large majority of critical data to be stored on a separate data drive on a server and then shared out to the network. I don't think we need to specifically add "Network share ransomware canaries." I think we'd be fine just making sure each system has canaries distributed to all local system drives. For NAS, maybe we can assign one server/device on the network to watch the canaries. You guys are awesome, but I feel this is a critical oversight/blindspot.. especially considering this is exactly what we just saw in the wild. Would appreciate any and all attention you can give to this post so we can get this implement and on the roadmap.

I am looking for a straightforward way to install the Huntress agent using Jumpcloud. Currently, there isn't a specific guide available for this method. Having a dedicated guide would simplify the process and make it more accessible for users who rely on Jumpcloud for installations.

If Canaries are disabled across client base, please send an email to the Point of Contact for the account. Thanks.

Our team/MSP would like to have the ability to pull or ad hoc a canary report that has the canaries/agents/user profiles. would be great to cross check protected users and find unique users total vs just total user count

Updates to Ransomware Canaries service.

It would be invaluble for huntress to be able to mark a file as tamper-proof/offer tamper protection for various system files. We had a TA bypass DUO by pushing changes to the host file and flooding the API to localhost .